I've had a Smoothie up and running for a month now and I'm slowly adding more and more utils to it.
I'm currently blocking Chinese/Korean IP addresses using a list from this website - Okean - The Goods - and an additional mod (Active IP Block MOD) to block repeat traffic from a single IP address. This is working well.
After monitoring the block logs for a few hours I can see I'm getting a lot of traffic from Canada.
An IP address from the above range appears in my blocked list (firewall/logs) in blocks of three at 5 minute intervals.Code:Shaw Communications Inc. OrgID: SHAWC Address: Suite 800 Address: 630 - 3rd Ave. SW City: Calgary StateProv: AB PostalCode: T2P-4L4 Country: CA ReferralServer: rwhois://rs1so.cg.shawcable.net:4321 NetRange: 24.64.0.0 - 24.71.255.255 CIDR: 24.64.0.0/13 NetName: SHAW-COMM NetHandle: NET-24-64-0-0-1 Parent: NET-24-0-0-0-0 NetType: Direct Allocation NameServer: NS7.NO.CG.SHAWCABLE.NET NameServer: NS8.SO.CG.SHAWCABLE.NET
The simple solution is to add "24.64.0.0/13,off.DROP,on" to my ipblock config file but I'd first like to know why. What's going on in Canada?


LinkBack URL
About LinkBacks
Reply With Quote

