#1 2018-01-05 5:41 pm

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

SpambotSecurity

I’ve been getting Error 503 : Service Temporarily Unavailable when trying to connect since sometime yesterday; still happing now.

Anyone else also not able to connect to spambotsecurity.com?

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

Maikuolan

Member

From: Perth, Western Australia

Registered: 2011-08-09

Posts: 799

Website

Re: SpambotSecurity

I've been able to connect, but it's been on-and-off. One of the problems that I have is that sometimes host resolution times out, and my browser caches that the resolution timed-out, preventing me from consequently trying to reconnect until I either clear my cache or manipulate the request enough as so that my browser thinks it's a new request and ignores the cache. PITA, but is what it is, I guess.

Could give that a go on your end, to see whether it helps (clearing your browser cache). Fixes the problem for me, until it doesn't (i.e., not a permanent fix, but helps convince the browser to at least try to reconnect, usually with some level of success for a while).

Papa Parrot

Member

From: Mexico

Registered: 2011-08-19

Posts: 1,826

Website

Re: SpambotSecurity

I didn't have any problem just now.

---

Everything is for the Birds

And now, Papa Parrot and his kids

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

Cleared my browsers cache/history. Didn’t help. Still getting the 503. I was, for an unknown reason, blocked from our own forum (kubuntuforums.net) yesterday, and was receiving the same error message. I’m a forum Administrator there, and my IP address is whitelisted. I still had access to our site via SSH, so I logged in and cleared the ZB Block 503 log files. I was able to log back in to our site fine afterwards.

It seems too coincidental that I was blocked out of our forum yesterday and haven’t been able to connect to SpambotSecurity since then as well, so I’m thinking that I’ve been 503 blocked by SpambotSecurity also.

I know there are Administrators/Moderators here that are also Admins on SpambotSecurity, so could one of you check/clear the 503 files?

Last edited by Snowhog (2018-01-05 7:51 pm)

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

kpatz

Member

Registered: 2008-10-09

Posts: 1,437

Re: SpambotSecurity

I just got in fine.  Sounds like you somehow got into ZB Block's IP ban list.

You could try emailing Zaphod at the forum's domain (I'm deliberately not providing the full address so spam scrapers don't pick it up)... he's the head honcho over there, he is also a mod here but he hasn't been around in quite some time.  I don't know if there's another admin that can help.  But try emailing.

You could also try waiting 24 hours, in case he has a cron job that clears out the IP ban list after a period of time.  Or, if you're on a dynamic IP ISP, reset your modem or router to try and get a different IP.

Last edited by kpatz (2018-01-05 8:03 pm)

---

Spam happens when greed meets stupidity.

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

Thanks. Reaching Zaphod is almost impossible; has been for over two years now; ever since he took his new job in Corrections. That’s why I’m reaching out here, as I know there is at least one SpambotSecurity Admin who ‘works’ here. I’m certain that you are right, that I got accidentally banned ‘for an unknown reason’. I’m known on their forum, and Zap and I used to communicate often, again, before he took his new job.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

kpatz

Member

Registered: 2008-10-09

Posts: 1,437

Re: SpambotSecurity

I posted a thread on SBS mentioning your problem.  We'll see if an Admin responds.  If you could PM me your IP I can give it to them once I get a response.

---

Spam happens when greed meets stupidity.

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

PM sent.

What an Admin on SpambotSecurity needs to do is remove the following files:

ippbdb.csv ipddb.csv ippbdb.txt

These are dynamic and will be regenerated. They hold IP addresses that are blocked with the 503 message.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

kpatz

Member

Registered: 2008-10-09

Posts: 1,437

Re: SpambotSecurity

I got your PM, I'll let you know if someone on there can remove it for you.  Apparently Zap's killed_log is available for view on the site, but I couldn't find the link.  With that, we could at least determine why your IP got blocked.

In the meantime, can you go to a McDonalds or something and use their wifi?  Or tether to a cell phone, and access the forum that way?

---

Spam happens when greed meets stupidity.

kpatz

Member

Registered: 2008-10-09

Posts: 1,437

Re: SpambotSecurity

I found where Zap makes his killed_log file available, and your IP that you PMed me isn't showing on it, which means it wasn't blocked by ZB Block.  Maybe your IP changed?  Can you access the site now?

---

Spam happens when greed meets stupidity.

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

Tethering my iPad to my iPhone, I can reach SpambotSecurity. I just logged in.

Added:
However, untethering my iPad from my iPhone, I am still not able to reach SpambotSecurity. I still get the 503 page.

As I stated, deleting the three specified files will fix this. It’s what one does on their own site when this happens.

Last edited by Snowhog (2018-01-06 2:05 am)

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

kpatz

Member

Registered: 2008-10-09

Posts: 1,437

Re: SpambotSecurity

So, you get the 503 using your iPad, WiFied to your router, but not if tethered to your iPhone?

How about if you access it via the iPhone itself?

We didn't find the IP you PMed me, but we found a "nearby" one.  Maybe you PMed me your gateway IP and not your actual IP?

Here's the info from SBS (I asterisked out part of the IP in case you don't want it public).  It appears that your device is quoting the user-agent which is causing the block. 

Anyway. That exact IP isn't blocked, but another Comcast MN in a nearby netblock is.

#: 874907 @: 2018-01-04, Thu - 09:25:22 -07:00 Running: 0.4.10a4 / MS-77g / D30-2014-11a / BADHOST-2015-02a / BADIP-2015-02a / COOK-2015-02a
Host: c-69-180-***-***.hsd1.mn.comcast.net
IP: 69.180.***.***
Score: 2
Violation count: 1 
Why blocked: Quoth the raven (UA-0270.0). Nevermore (UA-0270.1). 
Query: 
Referer: 
User Agent: "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1"
Reconstructed URL: http:// www.spambotsecurity.com /forum/index.php

#: 874908 @: 2018-01-04, Thu - 09:25:39 -07:00 Running: 0.4.10a4 / MS-77g / D30-2014-11a / BADHOST-2015-02a / BADIP-2015-02a / COOK-2015-02a
Host: c-69-180-***-***.hsd1.mn.comcast.net
IP: 69.180.***.***
Score: 2
Violation count: 2 
Why blocked: Quoth the raven (UA-0270.0). Nevermore (UA-0270.1). 
Query: 
Referer: 
User Agent: "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1"
Reconstructed URL: http:// www.spambotsecurity.com /forum/index.php

#: 874909 @: 2018-01-04, Thu - 09:26:51 -07:00 Running: 0.4.10a4 / MS-77g / D30-2014-11a / BADHOST-2015-02a / BADIP-2015-02a / COOK-2015-02a
Host: c-69-180-***-***.hsd1.mn.comcast.net
IP: 69.180.***.***
Score: 2
Violation count: 3 BANNED
Why blocked: Quoth the raven (UA-0270.0). Nevermore (UA-0270.1). 
Query: 
Referer: 
User Agent: "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1"
Reconstructed URL: http:// www.spambotsecurity.com /forum/index.php

For some reason, Snowhog's useragent string is wrapped in quotes. His isn't the only one, there are a few other connections (all since iOS 11 came out) that are also blocked for this.

I have seen iOS 11 on my forum, that useragent string isn't Apple's default or I would have a hundred angry women yelling at me. Maybe an app added the quotation marks, does Snowhog have any apps that relate to a Quote of the Day sort of thing?

Until he gets the quotes off his UA, he's going to keep getting banned if he visits here on his iPhone. I downloaded Opera and turned the proxy on (it's in Privacy & Security, under VPN) and it can access this site just fine. Zap hasn't blocked it.

But I've no idea why Snowhog's CURRENT IP (the one you offered) isn't in the log. Maybe he can get in here from another device on that IP, maybe the iPhone browser is remembering the 503 and refusing to return. (But it'd get reblocked until the UA is fixed anyway.)

Last edited by kpatz (2018-01-06 3:18 am)

---

Spam happens when greed meets stupidity.

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

Just tried accessing SpambotSecurity from my iPhone. Got the 503 page. Cleared the browser cache and history on the iphone and tried again. Still the 503 page.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

I just tried connecting to SpambotSecurity from my laptop (Kubuntu Linux, using the latest Firefox browser) which is also connected to our home network. It too, receives the 503 page.

The router IP I PM’d you is correct; it’s the IP that Comcast issued to the router, and the IP that the world ‘sees’. The PC specific IP’s won’t do you (or anyone else) any good, as those are internaly assigned IP’s within the home network (we use two Apple Timecapsules; one being bridged to the other (Primary). The Primary Timecapsule is wired to the Comcast router. The second Timecapsule (bridged) is connected to the Primary wirelessly.

I was able to run traceroute (from the laptop) and it reports partial success, but fails to actually reach spambotsecurity. A ping of spambotsecurity.com fails completely.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

Found this: https://www.jordanmerrick.com/posts/ios-11-smart-punctuation

On my iPad, this was enabled. I've disabled it. Would that potentially have resulted in the useragent string being wrapped in quotes?

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

kpatz

Member

Registered: 2008-10-09

Posts: 1,437

Re: SpambotSecurity

I can't imagine it would, but you could always try turning it on and off and visiting https://www.whatismybrowser.com/detect/ … user-agent to see if it changes.

I wouldn't think any legitimate app would wrap the user agent in quotes, but who knows.

---

Spam happens when greed meets stupidity.

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

I already turned if off. That sites reports my useragent (from my iPad) as:

Mozilla/5.0 (iPad; CPU OS 11_2_1 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) Version/11.0 Mobile/15C153 Safari/604.1

Turning it back on had no effect on the reported useragent string.

Last edited by Snowhog (2018-01-06 4:56 pm)

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

zero-tolerance

Member

Registered: 2013-02-25

Posts: 339

Re: SpambotSecurity

"ping spambotsecurity.com" fails on my machine also, as does a traceroute, but I can see the site just fine in the browser.

Perhaps this is a network infrastructure issue at Zap's hosting provider?

Maikuolan

Member

From: Perth, Western Australia

Registered: 2011-08-09

Posts: 799

Website

Re: SpambotSecurity

Or more so, possibly an infrastructure problem with his ISP; He self-hosts a server unit via his home DSL.

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

To be clear(er).

Our ISP is Comcast. We have one of their routers. We use mostly Apple products in the house. We have three iMacs, three iPhones, and three iPads. There are two Apple Airport Time Capsules, of which one is our 'primary' and is connected to the Comcast router by ethernet cable. That Time Capsule serves as our 'primary' wireless access point. The second Time Capsule is bridged to the first and in a different location within the house so as to provide additional signal coverage to the basement (basement, main floor, second floor house). The primary Time Capsule is on the second floor.

About a week ago now, we were having network connection and speed (download/upload) problems, which we reported to Comcast. They remotely updated/reconfigured the router, after which our speeds returned to normal; to what we were paying for and had been experiencing. That has been the only thing about our 'system' that has changed. However, I know that I was on SpambotSecurity after that happened, so I really don't think that had anything to do with my issue now.

Being a Site Admin on our Forum, and having been using ZB Block on that forum since 2012, I know how to resolve 'false' 503's. That's the deleting of the three previously mentioned files in the 'Vault', namely, ippbdb.csv ipddb.csv ippbdb.txt. These files are dynamically maintained by ZB Block. If deleted, ZB Block will recreate them as the situation warrants. It's much simpler to fix a false 503 in this way than any other approach. In fact, doing so is what Zaphod recommends to users of ZB Block.

So, if someone other than Zaphod has Administrator access to the ZB Block vault directory on SpambotSecurity, deleting those three files will fix my issue immediately. Just say'n.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

Papa Parrot

Member

From: Mexico

Registered: 2011-08-19

Posts: 1,826

Website

Re: SpambotSecurity

So, if someone other than Zaphod has Administrator access to the ZB Block vault directory on SpambotSecurity,

But , it appears nobody else has that kind of access, If Maikuolan did, I am sure he would have spoken up by now.

What about other sites, that are using ZBBLOCK, do you have the same problem, or is it only at Zaps site, ?
For example, I am using zbblock here: http://www.elchanate.org/

There might be a edit that can be done to the signature.inc file, but again, if nobody has access to those files
on Zaps site, there is nothing that can be done on that end.

---

Everything is for the Birds

And now, Papa Parrot and his kids

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

As I stated in my first post in this thread, I got 503'd on the forum I help Administer. I have no idea what caused me to be 503'd, but it happened. I SSH'd into our server and removed the three files from the ZB Block 'vault', and I was back in business.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

Papa Parrot

Member

From: Mexico

Registered: 2011-08-19

Posts: 1,826

Website

Re: SpambotSecurity

Well, that is fine, for you on your site, but if nobody has access to the files on Zaps site, How can any body besides Zap himself, do that ? If Maikuolan, does have access, then he could do it, I think by now, if he could, he would have said something by now.
==== edited====
Actually he did "speak up" here:

Maikuolan>>Yeah.. Although I have full admin rights to the forum, I don't have any backend access to the website itself (i.e., no FTP/SSH/whatever, and no way to modify any of the files of the ZB Block installation protecting SBS), so, I suspect that contacting Zap would be the only way to effectively clear out the banned IPs file here, unfortunately. If it was a matter of clearing out a ban performed by the phpBB software, I could help with that, but I'm likely a bit useless for our purposes in this particular case.

=================================================
The same thing happened to me years ago, but slightly different, we edited the signature.inc file, me on my end mine, and Zap on his end,.. but the problem here is Zap is not around, this is what we did, in my case.
http://www.spambotsecurity.com/forum/vi … =15&t=2403

Thanks Zap, this seems to be working,
Quote:
I THINK if you change the HNB-000 regex to this:

$ax += regexmatch($hoster,"(?:^[:.-]|[:.-]$|[.:][a-z\d-]{64,}[.:]|[^a-z\d\_:.-]+|^(?:\d+|.{256,})?$)",'Illegal Character, Illegal Configuration, Empty Field, or Too Many Characters in RDNS (HNB-000). ');

The quotes, in your ISP

It will fix everything. But please know... I brutally suck at regex!
Zap

Yours may be a slightly different solution, but nobody here has ssh access to  Zaps site, so it does not
matter.

I can send him a message, and see if he responds,... but no promises.
===== edited again ====
I did send him a note, with links to both threads, here and at SBS,... so we just have to wait and see if
and when he responds.

---

Everything is for the Birds

And now, Papa Parrot and his kids

Snowhog

Member

From: Minnesota

Registered: 2012-09-09

Posts: 60

Website

Re: SpambotSecurity

Appreciated. Thank you.

---

Administrator - Kubuntu Forums . Net
"It is a capital mistake to theorize before one has data." - Sherlock Holmes
Using Kubuntu Linux since March 23, 2007

Papa Parrot

Member

From: Mexico

Registered: 2011-08-19

Posts: 1,826

Website

Re: SpambotSecurity

Unfortunately, still have not heard from or seen any response from Zap,.....

---

Everything is for the Birds

And now, Papa Parrot and his kids