用shadowsocks的大神看过来

xieshenglin

分享的shadowsocks帐号，用的linode和krypt服务器，目前都收到了机房的投诉。

投诉内容如下：

Dear Customer,
We received abuse complaint regarding to your server, suxowu8svp.suvm at 98.126.*.*.
Your server is attacking other networks. Please, stop this activities immediately.


COMPLAINT


To whom it may concern,

Pursuant to Sony Network Entertainment International LLC ("SNEI")
corporate policy, the below IP addresses were blacklisted from using our
services because SNEI detected activity that is abusive to our network services.
In our determination, the abusive activity was not related to velocity or
volume, but matched the specific patterns of known abuse of our publicly
available services. This abuse may be the result of a computer on your network
that has been compromised and is participating in a botnet abuse of our
services.

The following table of IP addresses, dates and times should help you correlate
the origin of the abusive activity. The time stamps are approximate from our
logs. The actual timing of the events depend on the signature matched. It is
very likely to have occurred both before, during and following the times
listed.

Approximate Time Range (UTC), IP Address, Reason
2016-06-16 20:16 ~ 2016-06-16 20:46 (UTC), 98.126.219.3, Account Takeover
Attempts

It is most likely the attack traffic is directed at one of the following
endpoints:

account.sonyentertainmentnetwork.com
auth.np.ac.playstation.net
auth.api.sonyentertainmentnetwork.com
auth.api.np.ac.playstation.net

These endpoints on our network are resolved by Geo DNS, so the IP addresses they
resolve to will depend on the originating IP address.

The destination port will be TCP 443.

Please take the necessary measures to correct the malicious activity from the
above-listed IP addresses as soon as possible to avoid any further disruptions.
If we were to remove any of these IP addresses from the blacklist and subsequent
abusive activity is detected, the IP address will be promptly blacklisted again.



We thank you for your prompt attention to this matter. If you require assistance
or additional information please contact [email protected] and include
the IP address in question.

Thank you


--
Sincerely,
Kraiphob Tanaboriboon, Anti-Abuse & NOC analyst

Rate us at https://my.krypt.com/app/rate

kingjci

327253236 发表于 2016-6-24 20:42
你这方法我也是醉了，直接
echo "127.0.0.1 *投诉的网址" > /etc/hosts

如果他直接使用ip的话还是可以访问的，直接使用ip的时候跳过了dns解析的过程，写入host文件没有用，只能在服务器向远端目标服务器发起连接的时候抛弃连接

itsme

不分享。几块10几块的ss账号，这种都不愿意出的人，只能说不是出不起而是必然滥用的多。

okhost

kingjci 发表于 2016-6-24 12:48
可以看shadowsocks里面的源代码，在tcpRelay.py里面_handle_stage_addr函数，解析到来自客户端的目标主机和 ...

这几个ip是会变得，来自CDN
嘿，只有封帐号
下面还有人说hosts，也是有问题的。因为很多都是解释完ip才到ss服务端的。
怎么样，我卖服务器的，连这种都要做售后服务。

327253236

kingjci 发表于 2016-6-24 12:48
可以看shadowsocks里面的源代码，在tcpRelay.py里面_handle_stage_addr函数，解析到来自客户端的目标主机和 ...

你这方法我也是醉了，直接
echo "127.0.0.1 *投诉的网址" > /etc/hosts

gger

我就看懂了索尼

ade

应该是扫帐号

kingjci

可以看shadowsocks里面的源代码，在tcpRelay.py里面_handle_stage_addr函数，解析到来自客户端的目标主机和端口后，做一个黑名单，把发投诉信得网址添加进去，直接把到这些网站的socks连接抛弃

风象星座

楼主是1个IP开SS共享 所以大家用的都是一个IP 找不到是谁干的 才来求助的

嫂子抱紧我

当跳板搞爆破psn帐号 自己看ip封帐号 有多难