1

I am getting lots of click bombs from xlhost.com.

Here is a list of IP addresses that I collected from access_log.

209.51.205.58
209.51.197.114
173.45.90.90
207.182.146.34
209.51.199.34
209.51.197.58
209.51.197.42
209.51.197.242
209.51.197.234
209.51.197.218
209.51.197.210
209.190.96.90
209.190.96.130
209.190.6.194
209.190.54.98
209.190.54.90
209.190.54.82
209.190.54.170
209.190.54.162
209.190.54.154
209.190.54.146
209.190.54.138
209.190.54.130
209.190.54.114
209.190.33.2
209.190.31.194
206.222.7.218
206.222.7.202
206.222.7.194
206.222.7.130
206.222.7.106
206.222.6.58
206.222.6.242
206.222.6.234
206.222.5.242
206.222.5.202
206.222.5.146
173.45.101.42
173.45.101.18
173.45.101.10
173.244.160.74
64.79.94.10
209.51.197.90
209.51.197.26
209.190.6.18
206.222.19.106
173.45.101.146
173.45.101.106
209.51.192.226
209.190.95.2
173.45.101.58
173.45.101.114
173.244.168.170
209.51.197.50
209.51.205.130
209.51.205.106
209.190.6.10
207.182.132.154
206.222.19.114
206.222.16.74
173.45.81.90
173.45.81.66
173.45.81.50
173.45.81.26
173.45.81.18
173.45.81.122
173.45.81.114
173.244.171.74
173.244.170.58
173.244.170.186
173.244.170.178
173.244.169.98
173.244.169.218
173.244.169.194
173.244.169.170
173.244.168.234
173.244.167.250
173.244.167.242
173.244.167.218
173.244.167.210
173.244.167.194
173.244.167.170
173.244.167.162

But manually blocking all IP addresses is difficult. How can I block xlhost.com more efficiently? I thought to block IP range of xlhost.com but how can I determine the IP range of xlhost.com?

Result of whois xlhost.com

  Whois Server Version 2.0

  Domain names in the .com and .net domains can now be registered
  with many different competing registrars. Go to http://www.internic.net
  for detailed information.

     Domain Name: XLHOST.COM
     Registrar: NETWORK SOLUTIONS, LLC.
     Sponsoring Registrar IANA ID: 2
     Whois Server: whois.networksolutions.com
     Referral URL: http://networksolutions.com
     Name Server: DNS2.EE.NET
     Name Server: DNS3.EE.NET
     Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
     Updated Date: 05-jan-2016
     Creation Date: 05-jan-2000
     Expiration Date: 05-jan-2026

  >>> Last update of whois database: Fri, 08 Apr 2016 06:40:17 GMT <<<

  For more information on Whois status codes, please visit https://icann.org/epp

  NOTICE: The expiration date displayed in this record is the date the
  registrar's sponsorship of the domain name registration in the registry is
  currently set to expire. This date does not necessarily reflect the expiration
  date of the domain name registrant's agreement with the sponsoring
  registrar.  Users may consult the sponsoring registrar's Whois database to
  view the registrar's reported date of expiration for this registration.

  TERMS OF USE: You are not authorized to access or query our Whois
  database through the use of electronic processes that are high-volume and
  automated except as reasonably necessary to register domain names or
  modify existing registrations; the Data in VeriSign Global Registry
  Services' ("VeriSign") Whois database is provided by VeriSign for
  information purposes only, and to assist persons in obtaining information
  about or related to a domain name registration record. VeriSign does not
  guarantee its accuracy. By submitting a Whois query, you agree to abide
  by the following terms of use: You agree that you may use this Data only
  for lawful purposes and that under no circumstances will you use this Data
  to: (1) allow, enable, or otherwise support the transmission of mass
  unsolicited, commercial advertising or solicitations via e-mail, telephone,
  or facsimile; or (2) enable high volume, automated, electronic processes
  that apply to VeriSign (or its computer systems). The compilation,
  repackaging, dissemination or other use of this Data is expressly
  prohibited without the prior written consent of VeriSign. You agree not to
  use electronic processes that are automated and high-volume to access or
  query the Whois database except as reasonably necessary to register
  domain names or modify existing registrations. VeriSign reserves the right
  to restrict your access to the Whois database in its sole discretion to ensure
  operational stability.  VeriSign may restrict or terminate your access to the
  Whois database for failure to abide by these terms of use. VeriSign
  reserves the right to modify these terms at any time.

  The Registry database contains ONLY .COM, .NET, .EDU domains and
  Registrars.


  Domain Name: XLHOST.COM
  Registry Domain ID: 16620358_DOMAIN_COM-VRSN
  Registrar WHOIS Server: whois.networksolutions.com
  Registrar URL: http://networksolutions.com
  Updated Date: 2016-01-05T20:53:14Z
  Creation Date: 2000-01-05T18:46:09Z
  Registrar Registration Expiration Date: 2026-01-05T05:00:00Z
  Registrar: NETWORK SOLUTIONS, LLC.
  Registrar IANA ID: 2
  Registrar Abuse Contact Email: abuse@web.com
  Registrar Abuse Contact Phone: +1.8003337680
  Reseller:
  Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
  Registry Registrant ID:
  Registrant Name: eNET Inc.
  Registrant Organization: eNET Inc.
  Registrant Street: 3000 E. Dublin Granville Road
  Registrant City: Columbus
  Registrant State/Province: OH
  Registrant Postal Code: 43231
  Registrant Country: US
  Registrant Phone: +1.9999999999
  Registrant Phone Ext:
  Registrant Fax: +1.9999999999
  Registrant Fax Ext:
  Registrant Email: ski@EE.NET
  Registry Admin ID:
  Admin Name: Kharazi, Saeed
  Admin Organization: eNET Inc.
  Admin Street: 3000 East Dublin-Granville Road
  Admin City: Columbus
  Admin State/Province: OH
  Admin Postal Code: 43231
  Admin Country: US
  Admin Phone: +1.6147945971
  Admin Phone Ext:
  Admin Fax: +1.6147949016
  Admin Fax Ext:
  Admin Email: ski@EE.NET
  Registry Tech ID:
  Tech Name: Kharazi, Saeed
  Tech Organization: eNET Inc.
  Tech Street: 3000 East Dublin-Granville Road
  Tech City: Columbus
  Tech State/Province: OH
  Tech Postal Code: 43231
  Tech Country: US
  Tech Phone: +1.6147945971
  Tech Phone Ext:
  Tech Fax: +1.6147949016
  Tech Fax Ext:
  Tech Email: ski@EE.NET
  Name Server: DNS2.EE.NET
  Name Server: DNS3.EE.NET
  DNSSEC: Unsigned
  URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
  >>> Last update of whois database: Fri, 08 Apr 2016 06:40:17 GMT <<<

  The data in Networksolutions.com's WHOIS database is provided to you by
  Networksolutions.com for information purposes only, that is, to assist you in
  obtaining information about or related to a domain name registration
  record. Networksolutions.com makes this information available "as is," and
  does not guarantee its accuracy. By submitting a WHOIS query, you
  agree that you will use this data only for lawful purposes and that,
  under no circumstances will you use this data to: (1) allow, enable,
  or otherwise support the transmission of mass unsolicited, commercial
  advertising or solicitations via direct mail, electronic mail, or by
  telephone; or (2) enable high volume, automated, electronic processes
  that apply to Networksolutions.com  (or its systems). The compilation,
  repackaging, dissemination or other use of this data is expressly
  prohibited without the prior written consent of Networksolutions.com.
  Networksolutions.com reserves the right to modify these terms at any time.
  By submitting this query, you agree to abide by these terms.
  • 1
    First "rude" option on my mind blocking IP blocks as described here on serverfault: serverfault.com/questions/592061/block-range-of-ip-addresses - maybe there a smarter solution, thus i just posted the comment. – user20874 Apr 8 '16 at 6:12
  • 1
    Since XLHOST owns their own IP space you can look up the IP blocks they own using the ARIN whois lookup. There could be other IP blocks that are not listed here in which they are using but it looks like they are all listed. whois.arin.net/rest/org/ENET/nets – Analog Apr 8 '16 at 6:22
  • @Analog, Thank you very much for your help. Would you mind sharing the procedure how do you get the IP block from ARIN lookup? I edited question to add whois lookup. I can not find any IP Range in the output. Is there any utility that can provide the IP block from ARIN lookup by shell script or terminal please? – NecNecco Apr 8 '16 at 6:52
  • 1
    @NecNecco I created an answer to explain better, but you have to whois the IP address and not the domain name. – Analog Apr 8 '16 at 7:23
2

Since XLHOST owns their own IP space you can look up the IP blocks they own using the ARIN whois lookup. There could be other IP blocks that are not listed here in which they are using (such as if they were utilizing IP space in which they do not directly own and are just leasing from other providers) but it looks like they are all listed.

XLHOST Netblocks on ARIN site

To find this information I did the following:

From command line i did a whois on 1 of the IPs you mentioned

whois 209.51.205.58


which gave the following results (among other info)

NetRange:       209.51.192.0 - 209.51.223.255
CIDR:           209.51.192.0/19
NetName:        ENETNAP
NetHandle:      NET-209-51-192-0-1
Parent:         NET209 (NET-209-0-0-0-0)
NetType:        Direct Allocation
OriginAS:
Organization:   eNET Inc. (ENET)
RegDate:        1997-05-07
Updated:        2008-07-10
Comment:        ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
Ref:            https://whois.arin.net/rest/net/NET-209-51-192-0-1

From here I just went to the Ref link (You could lookup the "NetName" on the ARIN site as well). From that page i clicked on "Organization" and then "Related Networks".


Once you have all the netblocks you could use iptables to block these addresses by blocking the subnets or IP ranges.

To block an entire subnet (both inbound and outbound) enter the following in command line. Where "1.1.1.0/24" is the subnet you want to block.

iptables -A INPUT -s 1.1.1.0/24 -j DROP
iptables -A OUTPUT -s 1.1.1.0/24 -j DROP

To block a range of IPs within a subnet use the following:

iptables -I INPUT -m iprange --src-range 1.1.1.10-1.1.1.20 -j DROP
iptables -I OUTPUT -m iprange --src-range 1.1.1.10-1.1.1.20 -j DROP

Make sure to save your rules with service iptables save

| improve this answer | |
  • 1
    @NecNecco I have updated my answer. But yes the CDIR is the subnet you would use in the iptables rule for each block. – Analog Apr 8 '16 at 7:55
  • 1
    @NecNecco The result from ARIN should never be incorrect. ARIN is not a 3rd party website providing the whois data; they are the actual registry for all internet numbers (IPv4 / IPv6) for the Americas. ARIN is a RIR which plays a key role in the internet which is too much to explain in a single comment. You can read more about ARIN, RIR, IANA, and ICANN's roll in the internet on their wikipedia pages. Just Google "ARIN wiki", "RIR wiki", "IANA wiki", or "ICANN wiki". Basically it is just how IP addresses are delegated globally. – Analog Apr 8 '16 at 8:25
  • 1
    @NecNecco Regarding the 85.175.252.7 address. This address will not be in the ARIN whois because it was delegated from a different RIR (see the wiki pages i mentioned in the previous reply about RIRs, there are 5 separate RIRs for IP delegation in different geos around the world). What you will see if you whois this IP is "RIPE" which is basically the ARIN for Europe, Russia, the Middle East, and Central Asia. You can search the RIPE database here - apps.db.ripe.net/search/query.html Just enter the IP address and press search. – Analog Apr 8 '16 at 8:32
  • 1
    @NecNecco Because of the way that RIPE stores their data I would recommend looking up IP addresses that were delegated from RIPE using the RIPE database. Reason being is because even though ARIN does give you a response for a RIPE address it is listing that address as part of the Class A block which while true is not the information you want. For example ARIN says that 85.175.252.7 is part of 85.0.0.0/8 which means 85.0.0.0 - 85.255.255.255. While this is true that's WAY too many addresses. RIPE would give you this answer 85.175.0.0 - 85.175.255.255 along with the owner of the netblock. – Analog Apr 8 '16 at 8:45
  • 1
    D'oh, Actually my mistake. whois in the command line does query the ripe database and will show your the proper results. Not enough sleep too much coffee :p What i meant was if you lookup RIPE addresses on the ARIN site it will give you the class A block. But whois in the command line is smart enough to query the proper RIR – Analog Apr 8 '16 at 8:49
1

Additionally XLHost is a U.S registered company with an abuse report email that sell dedicated servers. It is quite possible they are unaware that their services are being used for click bombing. Do go ahead and block the range as it is unlikely a genuine website user will be accessing the site through a hosted dedicated server, but also try emailing the abuse email which can be found at http://www.xlhost.com/contact/ and let them know that their servers are being used in a click bombing attack on your site. If they follow industry best practices the click bombing should stop rather quickly when the servers are taken offline by the host.

| improve this answer | |
  • Thanks for the details. But I think they know the issue already. The problem is widespread and you can search xlhost adsense on google to see the issue dates back more than 2 years. Some say abuse email reports do not help so I did not bother to send them. – NecNecco Apr 10 '16 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.