Malicious hacker ip address blacklist is not checkable nor valid

Is the Outgoing Connections Manager a useful firewall?

Many years ago, if I remember correctly it was around 2013 or 2014, I was trying to use the Outgoing Connections Manager in Hepsia control panel to only allow emails to certain IP addresses to be sent out. cPanel has similar features.

By doing this, mail to other IP addresses were to be blocked. This was to prevent hackers from installing bad scripts that publishes thousands of emails per day from my websites. If these email hackers succeeded in spamming the world through my website then my email address would be black listed and I would not be able to send emails to friends and clients.

In order to do this I needed to know all the IP addresses used by SMTP servers for such activity and needed provide a list of all these SMTP servers IP addresses in the Outgoing Connections Manager.

After a lot of searching and analyses I realized I would never know all the IP addresses used by Google or Yahoo or other SMTP servers. And I could not specify certain IP addresses as when the SMTP server IP address changed my own outgoing mail would be blocked. This meant I had failed in my quest to block emails going out to irrelevant SMTP servers. It also meant that the function of the Outgoing Connection Manager was useless. In the end I deactivated my Outgoing Connections Manager.

I did report this issue to my hosting services tech support staff and they too had no solution to this problem. In the final analysis I informed them to change the system so that instead of making a list if IP address that were to be allowed by the Outgoing Connection Manger I should be allowed to just specify the name of the SMTP server. For example 'Google' or 'Yahoo' or 'Hotmail' or the name of any valid SMTP server - as if there was a DNS or a reverse DNS for SMTP servers. A list of IP addresses could be held by the server or in a database or my hosting server could contact, say Google, to confirm whether it is their IP address before the email is sent out. To date I have not seen this or anything similar being implemented. Google, Microsoft, Yahoo, Apache and the like, please come out with a solution.

Defending my website against hackers

I have been defending my websites form hackers since 2013. In 2011, my first WordPress website, http://bachutha.com, which was on a shared hosting plan, was hacked. The server tech support team could not put the site back together again nor did they know how to clean up the hacker codes embedded into my site. In the end they deleted all the contents of the server and then restored a backup that I uploaded to them. I was lucky that I had saved backups on my PC instead of depending on the server backups.

By 2013 the hacking attacks on my website became a daily affair. My site would hang, show corrupt pages or just not appear to any visitor. I asked many people for help as most WordPress security plugins were not effective against hacking activity. Worst still I did not know who was hacking my site. It was a very frustrating time as I could not identify hackers and did not know how to block the hackers. I found out later that those that had websites and knew PHP did not know what to do to protect their websites from hackers. After that I moved my website to another web hosting provider.

The hackers were having a field day attacking us. Many of us were on tight budgets so we could not hire experts to help us out. In the end by 2013 I decided to learn PHP and try to develop code to block hackers.

Today in 2018, 5 years later I have been able to defend my websites from hackers with my Bad Bot Exterminator program. As a result I found out that most hackers came from USA, Canada, France, Germany, Netherlands, Moldova, Ukraine, Russia, Turkey and the most dangerous were the Chinese. Even the Muslim terrorist had a cyber warfare arm focused on damaging websites that they did not like and I had been on their receiving end.

Do not ever think it is just individuals who hack your sites? I have found hackers originating from large well known American corporations too. I think they tried to hack my site to see how well I was able to defend it from hackers. Their DOS attacks have failed miserably.

I found out that the Eastern European and Russian hackers find out about your site through Yandex search engine. The Chinese hackers and the Chinese military find out about your site through Baidu and other crawlers which are registered as American and Canadian owned. This means that if you do not want hackers form Eastern Europe, Russian and China to know about your website block Yandex and Baidu from visiting your website.

I found out that hacker crawlers ignore what is written in robots.txt. In fact they use the information in robots.txt to know which directories are important to you, in order to search for precious files that can be damaged and corrupted.

In the end I resorted to blocking certain search engines by placing instructions in my .htaccess file. For the novice web publisher this can be done by the example shown on stackoverflow.

ip address lookup

Over the years I found that the single most important piece of information that can be used to block hackers is their IP address. With their IP address you can find out who owns the ip address and determine which country and town they come from, which corporation is issuing these hacking crawlers, which web hosting provider is providing them server & hosting facilities and how often they are visiting your site.

Unfortunately, as of March 14th 2018, all that changed. Many large corporations have decided not to provide the IP addresses of the crawlers. It has now become even more difficult to block hackers as they are taking advantage of the changes in information provided by the visitor.

The IP address of visitors to your site is now meaningless

For those who are technical some examples of the information provided is shown below.

A Sample of IP addresses

With the latest changes, IP addresses of visitors are not revealed and only 'IP NAMES' are provided as shown below:-

IP Addresses have been changed to IP Names

You will observe that many bots and hackers are using the new system to hide their IP addresses. Some have used terms like 'unknown' or placed other numbers to mislead their real identity. The list above is just a small sample. Over the last 5 years I have discovered many abuses by hackers and badbots.

What do you do if a hacker claims his crawler is a genuine Google crawler? Like shown below:-

This is a fictitious example of an IP address that is very similar to Google's bot IP address.

Hacker bots pretending to be Google bot

I have found alot of misinformation in the data provided by hackers. It is almost garbage data with no relevance to the real information. For example, between February and March 2018, I found 5 or 6 crawlers pretending to be Google. They were imposters. Please see the table below.

Without the actual IP address or replacing the IP address with an IP name, makes it very much more difficult to track and defend against hackers. How are we going to report ip address of hackers? How are we going to trace a hacker ip address and block them in future? Worst still it does not help in identifying IP addresses that are allowed or blocked by the Outgoing Connection Manager.

Recommendation to PHP developers

My recommendation to PHP developers is to block any visitor that does not reveal his IPv4 or IPv6 address as it is the safest technique to block hackers.

Recommendation to Google, Microsoft, Apache, ...

IP address should only be IPv4 or IPv6 and nothing else. It should be hardwired into the server global variable so that it cannot be modified to an IP Name or a fake ip address. If the internet users need an IP Name they should place the IP Name in a new global variable such as $_SERVER['IP NAME'] instead of using global variable such as $_SERVER['REMOTE_ADDR'].

It is just terrible that they have removed IP addresses of visitors. This means that hackers will have a great time attacking web sites, anonymity and immunity against any protective hacker defense system and the law.

Update to this article Ip Names and IP addresses

I found out later that it was my hosting provider, ... & ..., that were substituting the IP address of my visitors with their domain names. Why on earth would anyone want to do that? My only guess is that there are internal staff that were trying to hack my site and did not want to be identified as the culprits. This is because my files were encrypted so that it is impossible for them to read my files from their console panels. My advice to you is that if you notice this occuring at your site please leave your hosting service provider and move to someone else or else their staff will pirate your work.

Is China pretending that it is Google?

I have been monitoring visitors to my website and noticed one visitor with the IP address 64.233.173.156. I checked this IP address and the information given by https://www.proxydocker.com/en/proxy/ is

Which is shown on the map as located in China. The remote host is identified as : google-proxy-64-233-173-156.google.com

The information I was looking for, which it appears google cannot provide, is "Is the crawler at ip address 64.233.173.156 a genuine google crawler or a fake crawler pretending that its ip address is a google ip address?" The User Agent does not mention "http://www.google.com/bot.html" as shown below:-

Mozilla/5.0 (Linux; Android 7.1.1; CPH1801 Build/NMF26F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36

and it looks like the visitor was using a Android smartphone.

Is it true that the ip address, the user agent, the remote host can be faked?

I would like to know if this is a genuine Google crawler or is this a Chinese crawler pretending to be a Google crawler?

The worrisome thing about this is that is this how China is now hacking American contractors and other American sites by pretending they are Google?


- Dr.Peter Achutha, 2nd May 2018, updated 11 June 2018

Please do show me your appreciation of this article by Buying me a coffee.

And do get the "I Won" t-shirt