how can i trace this fucker? plz help!!
 

someone is using hitbot on my site causing me to send fake hits to my traders

the proxy ips are these:

212.138.47.13
212.138.47.11
212.138.47.12

he or she uses all the same ips the whole time so my trades record to high repetetive hits from these ips. it even generates too many clicks when it goes to my trade partners.


i edited my script to find out who this is and the $HTTP_X_FORWARDED_FOR variable turns out to be this ip:

212.71.51.81

how can i find out who the fuck this is?
tracert in Dos prompt doesnt give too much info..

do you have any ideas how to find this fucker?


thanks,
Lane

Your not going to believe this but here's one
212.138.47.13

This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-serv...copyright.html


inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE


route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
source: RIPE


role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE

holy mutha fucka

Bin Laden must be surfing my site

muhahahaahha

[This message has been edited by Lane (edited 09-13-2001).]

inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE


route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
source: RIPE


role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE

212.138.47.12

inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE


route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
source: RIPE


role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE


and the last one on your list
212.138.47.12
AT&T ITS (NET-ATT)
200 Laurel Avenue South
Middletown, NJ 07748
US

Netname: ATT
Netblock: 12.0.0.0 - 12.255.255.255
Maintainer: ATTW

Coordinator:
Kostick, Deirdre (DK71-ARIN) [email protected]
(888)613-6330

Domain System inverse mapping provided by:

DBRU.BR.NS.ELS-GMS.ATT.NET 199.191.128.106
DMTU.MT.NS.ELS-GMS.ATT.NET 12.127.16.70
CBRU.BR.NS.ELS-GMS.ATT.NET 199.191.128.105
CMTU.MT.NS.ELS-GMS.ATT.NET 12.127.16.69

Record last updated on 06-Nov-2000.
Database last updated on 10-Sep-2001 23:16:26 EDT.

Lane, I think you've got to read between the lines.

I think it's the CIA monitoring your site looking for Bin Laden. http://bbs.gofuckyourself.net/board/biggrin.gif

Shit they should be knocking on your door any time now. http://bbs.gofuckyourself.net/board/smile.gif

You sure you don't know this guy Bin Laden?


Jim

hehehehe

what about this ip?

212.71.51.81

and can you give me the url where you trace it like this?