Tech i need help in finding ip of website

[freecartoonporn]

ok some website is reverse proxying using nginx to my website.

how can i find its ip address ?

current servers setup is like this.


stealer -> my front end box -> my backend box

i tried accessing phpinfo (); from his website, and got bunch of ip addresses, but none of them is his server ip

what should i do ?

Thanks for your time.

is there some script/code if i put it on my backend box , and access it from stealer 's website, i will get his server's ip address ?

thanks

[SIK]

1. put up some shit html page only you know on your site like:
http://www.your site.com/ lets-see-the-hacker.html

2. access that html on copycat site www.copycatsite.com/lets-see-the-hacker.html

3. check IP in server logs

[freecartoonporn]

Originally Posted by SIK

1. put up some shit html page only you know on your site like:
http://www.your site.com/ lets-see-the-hacker.html

2. access that html on copycat site www.copycatsite.com/lets-see-the-hacker.html

3. check IP in server logs

i have disabled access logs to lower the server load, i guess, its time to enable them.

thanks,

[SIK]

you can look around the forum (I wrote more on this issue..)

my problem is that a shitload of clone sites copy my shit and spoof shit around, and even though I'm pretty sure they are doing damage to me (google..) - there is no real way to combat it

problem being, by the time you figure out you've been copied, google has already indexed the shit out of it and it is pretty much stuck in their system as duplicate content and so on and so on......

tldr - no real way to combat it, it is up to google to finally decide to start rewarding ORIGINAL (first instance) content, instead of "strongest" (most backlinks and shit)

but anyway, good luck

[freecartoonporn]

Originally Posted by SIK

1. put up some shit html page only you know on your site like:
http://www.your site.com/ lets-see-the-hacker.html

2. access that html on copycat site www.copycatsite.com/lets-see-the-hacker.html

3. check IP in server logs

all i am getting cloudflare ip addressess

[SIK]

Originally Posted by freecartoonporn

all i am getting cloudflare ip addressess

1. if your site is using cloudflare - stop using it
2. blacklist all cloudflare ips on your server

[freecartoonporn]

Originally Posted by SIK

1. if your site is using cloudflare - stop using it
2. blacklist all cloudflare ips on your server

my server is set up such a way if user does not comes from cloudflare then block that access.

what i need to do is install Module ngx_http_realip_module

then i can see real ips in my server logs instead of cloudflare ips .

[freecartoonporn]

okay, iset up custom log format in nginx and restarted nginx and boom, found his ip address

log_format main '$http_x_forwarded_for - $remote_user [$time_local] "$host" "$request" '
            '$status $body_bytes_sent "$http_referer" '
            '"$http_user_agent" $request_time';

and then

access_log  /var/logs/nginx/access.log main;

[freecartoonporn]

motherfucker using 100+ ips to send curl requests.,

so far i have banned 90 ips , and found 100 new ips. looks like he is rotating 1k+ proxy ip addresss to scrape my site.

[SIK]

Originally Posted by freecartoonporn

motherfucker using 100+ ips to send curl requests.,

so far i have banned 90 ips , and found 100 new ips. looks like he is rotating 1k+ proxy ip addresss to scrape my site.

yep..

like I said earlier, I'm having this problem for years and years now and I took a lot of fuckers down through various tricks but I am yet to discover a 100% solution to it

I even tried asking prominent googlers on twitter and such about that issue (10+ questions) and they ignored every single one of them.

THEY KNOW about that issue, they just can't fix it, not with current way google works

[rowan]

If you want to more aggressively block IPs, you can find a number of lists here:

FireHOL IP Lists | IP Blacklists | IP Blocklists | IP Reputation

Be aware that there's going to be some collateral damage - for example, it's going to catch legit surfers using a VPN that also funnels a lot of abuse - but if you block aggressively for a few days it may be enough to make the cloner decide to move on.

Another option is to look at a much lower level to find patterns in the request headers. Most scrapers don't bother to perfectly mimic a browser, so they stand out like a sore thumb when you view the complete HTTP request.

[iceboi]

Since you are using cloudflare, you should enable "I'm under attack" mode, which will show a captcha for proxy/VPN ips and all other unusual requests.

[rowan]

One other tip regarding HTTP headers. If the scraper is using assorted open proxies, some of those proxies will leak the real IP of the server via headers such as X-Forwarded-For, X-Real-IP, Client-IP, etc. Since the IP of the server is unique the presence of this can be used to automatically ban proxies.

[freecartoonporn]

Originally Posted by iceboi

Since you are using cloudflare, you should enable "I'm under attack" mode, which will show a captcha for proxy/VPN ips and all other unusual requests.

ill try it.

thanks.