Author Topic: Impersonators (Read 42659 times)

AgentSmith · « **Reply #40 on:** April 17, 2006, 01:31:57 PM »

Round about 3 or 4 millions of people should have an IP starting with 84.153 O_O (+ In Jitspoe's log he used Ip's starting with 67.... (what means he lives in the US, near washington!)

I believe P!nk that this just can't be only one person...

1. People in the area of 84.153 don't have such high pings on MeMi server

2. too many names faked : DT (that funname "[er33t] Dirty") , A GT tag was faked, I got faked, my bro (fidel) got faked etc.

I dont think one person could fake all these people..

admins should look into their logs how many, and WHAT different IP's were used by following names: [eR33t]Dirty (funname); [e33t]dirtyburrito ; [GT]Nick

Matze · « **Reply #41 on:** April 17, 2006, 01:40:16 PM »

Quote from: AgentSmith on April 16, 2006, 10:40:45 AM

but I didnt take any ppl in GT since my IP doesnt even start with 84.153 ...
/
Round about 3 or 4 millions of people should have an IP starting with 84.153

sigh...So your IP does start with those numbers ?

Im sure Jits wont say those two IPs were the same when it were just 5 numbers of it, since he knows most of the germans do have static IPs.

KnacK · « **Reply #42 on:** April 17, 2006, 02:02:18 PM »

In the logs that Jitspoe posted:

Quote

IP Address: 67.181.161.114

This is the resolution of the ip address:
c-67-181-161-114.hsd1.ca.comcast.net
Since that is not a proxy server, ALL ofthose logins are from the same location/home/router.

AgentSmith · « **Reply #43 on:** April 17, 2006, 02:06:42 PM »

and since it is an IP from the US, it possibly CAN'T be me...

but knack, how u found out that it's not a proxy ?

KnacK · « **Reply #44 on:** April 17, 2006, 02:14:51 PM »

Let me refine my statement:

*IF* it belonged to a web host or soemthign like that, the web host could be used as a proxy forwarding service ( unlikely) .

SInce the IP is owned by Comcast and it is a residentially issued IP address, more than likey it is coming from a house. Unless.... someone has figured out a way to do a Q2 proxy via someones house.

TinMan · « **Reply #45 on:** April 17, 2006, 02:27:40 PM »

That probably is their home IP, setting up a proxy isn't hard at all, but Comcast has really bad upload, so they would lag like hell if they were using it as a proxy. So who plays dpball in California? Check your logs.

AgentSmith · « **Reply #46 on:** April 17, 2006, 02:32:11 PM »

lol 4thX used to live in california but I dont think he is a namefaker....

jitspoe, I have a question to the global ban system:

If you'd ban me, couldnt I just change IP and come back?!

jitspoe · « **Reply #47 on:** April 17, 2006, 02:35:16 PM »

Currently, but I'm going to try to add some kind of hardware bans in the future.

Derrek · « **Reply #48 on:** April 17, 2006, 02:49:04 PM »

Jits, I guess I was given the wrong IP. I asked someone in memi irc chan if they had ops, and ComaBull said he did. Since he was not sure how to get the IP, I gave him the command (listip <username>) and he told me the IP that he found. Since you have access to the direct logs, I would believe you are correct.

AgentSmith....sorry if I tarnished your good name, sir, I was merely posting with the information I had. I removed the ban on the IP given to me, so if that was yours, you should be able to access GT servers again.

DT, thx for the clarification on Skaters use of the er33t tag. Skater...sorry for the false accusation.

It does look like this poser was only one person. Originally Dirty Burrito. (or Ur_Master, or Pimp_Ster) He must have started using the GT tag because I called him out when he started using the e33t (and then er33t) tag.

It would be wise to cut this guy out of the game since he is obviously not going to stop this kind of activity. iptables works great for bans, as the person would never see the server again. PM me if you need help with iptables.

Jits, did you search for that IP on the forums? I doubt that he is using the forums as he has not kept a consistent name in the game.

Thanks everyone for your support in this issue. Continued diligence is the only way to weed out the abusers in this game.

-Derrek

TinMan · « **Reply #49 on:** April 17, 2006, 02:54:21 PM »

MAC address? Just remember that MAC addresses are spoofable, very easy to spoof in Linux at least.
Does b16 have an option to "perma-ban", or only "tban"? I want to be able to perma-ban, yet still have them able to view my site for information on how to be unbanned.

jitspoe · « **Reply #50 on:** April 17, 2006, 03:07:27 PM »

I searched for the IP on the forums and found no matches. I also added it to the GBL, at least for a few days. Perhaps that will wake him up.

For perm bans:
sv addip <ip address>
sv writeip

As for what method of hardware bans I will use, I don't know yet. Anything is spoofable, but that doesn't mean we can't make it really difficult to get off of the ban list.

KnacK · « **Reply #51 on:** April 17, 2006, 03:14:50 PM »

for all of the nix servers, have the GBL interface with iptables......

THAT would be slick.

AgentSmith · « **Reply #52 on:** April 17, 2006, 03:39:50 PM »

Puh, I'm glad that I'm not seen as a "guilty" person here,
since meini told me over ICQ I would be banned and started a little party over DP, (I couldnt read that thread cause dpball.com seemed to be down then) so I was a bit afraid of what would be in here...

Derrek, I have OPS on Freud servers, if there is maybe a guy called "newbie" , I just have to type listip newbie to get his ip, right? but what if he uses a funname?

Quote from: Derrek on April 17, 2006, 02:49:04 PM

sorry If I tarnished your good name

For the germans, I never had a "good name" so no matter man, wasn't your fault!

jitspoe · « **Reply #53 on:** April 17, 2006, 04:05:26 PM »

I think the "listuserip" command lists the ip's of all the players.

AgentSmith · « **Reply #54 on:** April 17, 2006, 04:11:15 PM »

ah that works, thx alot jit!

why do all the players use different ports?!

jitspoe · « **Reply #55 on:** April 17, 2006, 05:24:07 PM »

The ports are randomized to prevent attacks.

Derrek · « **Reply #56 on:** April 17, 2006, 11:18:56 PM »

Quote from: KnacK on April 17, 2006, 03:14:50 PM

for all of the nix servers, have the GBL interface with iptables......

THAT would be slick.

No...ick...Dont do that!!! I would never upgrade to a server that has that much control. a simple IP spoof with the right ip address could potentially lock all addresses from accessing the server completely. In essence, it would make the box un-networked. That just scares the crap out of me. besides, the pball server would have to run as root to be able to do anything with iptables (except maybe a list). Besides, windows servers don't use iptables.

-Derrek

AgentSmith · « **Reply #57 on:** April 18, 2006, 04:34:19 AM »

Whew thats the part where I should stop reading since I dont understand what iptables are

KnacK · « **Reply #58 on:** April 18, 2006, 07:14:23 AM »

Quote

No...ick...Dont do that!!! ...

We actually have a small script that does that on a forum I am a moderator on. 80k + members and the problem members, when we ban their ip address, the web server and forums just disappear.

It works great, but took a lot of testing.

You do have a great idea though... maybe a page redirect....

hmm....

XtremeBain · « **Reply #59 on:** April 18, 2006, 07:05:57 PM »

[PMW]UR_MASTER connected [67.181.161.114:6584]