Comments on: Forward Confirmed reverse DNS, или, Зомби не пройдут

By: SJCaptcha Lite: невидимая защита от спама | Ars Longa, Vita Brevis

SJCaptcha Lite: невидимая защита от спама | Ars Longa, Vita Brevis — Sat, 06 Sep 2008 07:18:54 +0000

[...] Проверка FCrDNS оказалась черезмерно эффективной: да, она спасает от спам-ботов. Но, к сожалению, из-за большого радиуса кривизны рук некоторых провайдеров, которые не могут нормально PTR-записи прописать (или поставить им в соответствие A-записи), отсеиваются и вполне нормальные пользователи. Что обидно. [...]

By: Vladimir

Vladimir — Tue, 03 Jun 2008 15:53:31 +0000

По просьбам трудящихся… Тот, с кого лимонад, знает это сам

/**
* Forward Confirmed Reverse DNS (FCrDNS) Check
*
* @param string $ip IP address to be checked ($_SERVER['REMOTE_ADDR'] if null)
* @return int Check status (0 = success, 1 = failed, -1 = PTR record not found)
*/
function fcrdns_check($ip = null)
{
if (true == is_null($ip)) {
$ip = $_SERVER['REMOTE_ADDR'];
}

$rev = preg_replace('/^(\\d+)\.(\\d+)\.(\\d+)\.(\\d+)$/', '$4.$3.$2.$1', $ip);

$authns = array();
$add = array();

$ptrs = @dns_get_record("{$rev}.IN-ADDR.ARPA.", DNS_PTR, $authns, $add);
if (true == empty($ptrs)) {
return -1;
}

foreach ($ptrs as $x) {
if (true == isset($x['target'])) {
$target = $x['target'];
$a = @dns_get_record($target, DNS_A, $authns, $add);
if (true == is_array($a)) {
foreach ($a as $y) {
if (true == isset($y['ip'])) {
if ($ip == $y['ip']) {
return 0;
}
}
}
}
}
}

return 1;
}

By: Vladimir

Vladimir — Sat, 24 May 2008 07:05:37 +0000

Еще адреса, не прошедшие проверку FCrDNS:

213.133.101.6 - delta.freckdach.net - 213.239.208.6
213.133.101.16 - siara.splashgame.org - 87.72.38.105
213.133.101.41 - sputnik.stetic.de - 212.133.101.41
213.133.101.57 - epsilon.eliteplaying.si - 91.185.193.139
213.133.101.59 - beta.eliteplaying.si - 85.190.14.199
213.133.101.60 - alfa.eliteplaying.si - 85.190.14.197
213.133.101.61 - thebofh.de - 88.198.1.116
213.133.101.69 - www.mitterwald.de - 213.133.101.52
213.133.101.85 - max.saxophon.com - 88.198.0.195
213.133.101.110 - nibbler.duggen.net - 78.47.116.145
213.133.101.111 - nibbler.fizzelpark.com - 87.230.78.251
213.133.101.115 - hope.g8.cx - 88.198.244.254
213.133.101.116 - www.testbank.de - 213.133.101.175
213.133.101.130 - www.msecm.com - 213.133.101.182
213.133.101.151 - de-2.tric.nl - 85.17.15.13
213.133.101.154 - lisa.netbit.ch - 80.74.157.12
213.133.101.166 - www.homola.de - 217.243.246.3
213.133.101.174 - ns2.medien-service.net - 62.159.226.167
213.133.101.197 - mail.it-chaos.com - 87.230.34.170
213.133.101.198 - server001.handelshaus.de - 82.165.26.169
213.133.101.243 - backup.web.style-design.de - 80.67.16.8

By: Vladimir

Vladimir — Fri, 23 May 2008 21:52:38 +0000

Одно из практических применений: обнаружена целая зомби-сеть.

217.20.122.13 - 217-20-122-13.coolnetirc.de - 213.239.199.148
217.20.122.17 - cikcik.com - 84.16.235.34
217.20.122.23 - mail.doggabyte.de - 217.188.246.14
217.20.122.24 - server186.xl-server.org - 77.37.6.115
217.20.122.33 - privatecamshot.com - 89.31.143.3
217.20.122.35 - web.krennzgenial.at - 88.198.191.189
217.20.122.38 - server1.michaelzoet.de - 77.37.6.114
217.20.122.44 - www.test.de - 217.110.104.156
217.20.122.52 - sip2.vr-city.de - 217.20.118.120
217.20.122.64 - promotion-network-company.de - 89.149.237.105
217.20.122.67 - ip-ltd.co.uk - 88.198.49.140
217.20.122.75 - prenzlau-online.de - 78.46.47.240
217.20.122.81 - fire.rshost.net - 91.191.173.20
217.20.122.86 - main46.vserver4free.de - 77.37.0.254
217.20.122.94 - mail.domains-und-mehr.de - 80.86.82.164
217.20.122.96 - ich-sag-euch-nichts.hopto.org - 69.65.19.125
217.20.122.97 - 2172012296.cryptronic.de - 85.10.222.14
217.20.122.98 - ns1.megaonline.net - 91.191.164.29
217.20.122.99 - ns2.megaonline.net - 91.191.164.30
217.20.122.100 - main53.vserver4free.de - 77.37.0.254
217.20.122.101 - filter.sysver.info - 82.98.87.31
217.20.122.105 - c0der.devcave.net - 88.221.74.145
217.20.122.108 - 217-20-122-108.nosepope.de - 83.246.119.18
217.20.122.109 - 217-20-122-109.nosepope.de - 83.246.119.18
217.20.122.110 - ffm110.target-host.de - 84.16.227.112
217.20.122.111 - 217-20-122-111.gs-networks.de - 91.121.23.112
217.20.122.112 - hochstift-chat.de - 80.67.27.71
217.20.122.115 - no PTR record
217.20.122.131 - flat1.megabit-space.de - 84.16.224.125
217.20.122.133 - mail.attilon.de - 217.20.122.49
217.20.122.138 - dr-pepper.net - 84.244.146.17
217.20.122.149 - main86.vserver4free.de - 77.37.7.32
217.20.122.151 - 217-20-122.151.internetserviceteam.com - 217.20.112.72
217.20.122.152 - ns1.iveahosting.com - 84.16.253.192
217.20.122.154 - main75.vserver4free.de - 77.37.7.33
217.20.122.155 - colpaert.biz - 83.220.128.27
217.20.122.162 - main40.vserver4free.de - 77.37.0.254
217.20.122.163 - oostkamp.org - 83.220.128.24
217.20.122.165 - 217-20-122-165.viking-pc.com - 217.20.122.164
217.20.122.166 - main38.vserver4free.de - 77.37.0.254
217.20.122.170 - shop.rumsoft.de - 78.47.135.85
217.20.122.179 - shop.rumsoft.de - 78.47.135.85
217.20.122.185 - server3.burning-crew.de - 62.141.43.12
217.20.122.188 - geist.dronf.de - 89.31.143.1
217.20.122.189 - geist.is-root.de - 84.16.233.231
217.20.122.203 - gay.shit.la - 217.20.118.148
217.20.122.205 - versicherungsvergleich.versdirekt.de - 217.20.113.178
217.20.122.210 - thegaminzone.com - 217.20.122.61
217.20.122.213 - 217-20-122-213.rege.net - 84.16.251.161
217.20.122.216 - k.o.a.la - 213.146.149.143
217.20.122.218 - server01.w-lan-solutions.de - 83.246.118.93
217.20.122.220 - 217-20-122-220.chaosempire.net - 217.20.113.104
217.20.122.221 - 217-20-122-221.chaosempire.net - 217.20.113.104
217.20.122.224 - irc.schwarzes-gera.de - 84.16.230.231
217.20.122.225 - germangothic.schwarzes-gera.de - 84.16.230.231
217.20.122.227 - forum.the-arena.de - 213.239.223.19
217.20.122.230 - hollmann.org - 217.20.122.229
217.20.122.243 - 217-20-122-243.coolnetirc.de - 213.239.199.148
217.20.122.245 - 217-20-122-245.coolnetirc.de - 213.239.199.148
217.20.122.246 - 217-20-122-246.coolnetirc.de - 213.239.199.148