P2p Privacy Update 1.5 - 06.02.2003

[BaNe^]

Fixes in this version:
-Deleted Dead Hosts
-Added New ips from PG IP Database
-Updated some ips
-Removed Double ips

Currently Blocks 102306280 IPs!

Installation:
See ReadMe

Supported Firewalls:
PeerGuardian 1.95b or later and Sygate Personal Firewall (Pro) 5.0 or later

Download:
http://www.freewebs.com/eno/p2p_privacy_update15.zip

Right Click on the link and select "Save target as..."

[red101]

What does this do and is it any good for dial-up networks

[BaNe^]

It's a Blocklist(Big list of spammers,net cops etc.) update for PeerGuardian and SPF. Connection type doesn't have anything do to with this....It just blocks bad things/guys from your computer.

[Infested Cats]

I installed your blocklist into my SPF, and I now cant access any of the google websites (google, news.google, froogle, etc).

google.com = 216.239.33.99
news.google.com = 216.239.33.104
froogle.com = 216.239.51.90

[BaNe^]

Sorry about this! theres a error in one range in the .Dat file....if somebody figures out that range, please inform me......

[Infested Cats]

GUI%GUICONFIG#SRULE@ADVRULECONFIG#Normal_279

Thats the rule that the log refers to when the google sites get blocked.

[BaNe^]

Ok. Found the range and fixed it. Just download the update again.... Damn, you shouldn't add ips when you have terrible hangover :)

[Infested Cats]

thx for the fix! Great stuff Btw

[infamousalbo101]

i jus did it for sygate personal firewall so do i have to do it for peerguardian because i dont really use peerguardian soo is it the same if i jus did it wit sygate

[dingdongding]

BaNe^, just wondering what other sites you use besides meth's and zerodatas' for updates(and eremeni as well)

wow, now i'm up to 153893540 IPs from 539 profiles (i'm sure i have some dups but i removed most of them)

thanks for the update!
ddd

[lunatacs]

[/QUOTE]i jus did it for sygate personal firewall so do i have to do it for peerguardian because i dont really use peerguardian soo is it the same if i jus did it wit sygate [QUOTE]

No, when you enter it into your sygate firewall, it will block just like Peerguradian does. peerGuradian is just like any firewall but its sol being is to only block ips, a firewall does more, thats about it.

[lunatacs]

also, thank you for making this update, its something i i very much thankful for you making, and its something that will all help us.


thanks

cheers

[infamousalbo101]

thankz for the help :D

[enoroxid]

Thanks tons - I've been waiting for this. Much appreciated.

[RealitY]

Thanks as well.

[Texallen]

:huh: OK,Here is the gratuitous idjit noob question. I honestly try to ask only one per thread. (Brain Damage is a serious problem on Mondays.) So,here it is. How do you load the update into Sygate? :huh:

[Infested Cats]

its in the readme man!

right click on your sygate icon in your system tray, click on "Advanced Rules...", (OPTIONAL: Click REMOVE ALL), right-click in the white area and click "import rule", browse to your *.dat is that you extracted, and hit ok.

that makes no sense, but like i said, it's in the readme!

[Texallen]

AAWWWW hell. That makes perfect sense. (Note to self: Readme's on Monday twice.) Thanks :lol:

[BaNe^]

Originally posted by dingdongding@3 June 2003 - 02:08
BaNe^, just wondering what other sites you use besides meth's and zerodatas' for updates(and eremeni as well)


I use the www.shareaza.com security forum..... and this forum of course :)

[dingdongding]

appreciate the response and thanks again- i'm just trying to figure out the best sources (and in an ideal world if there's a way to streamline them)- they seem to be you, meth, zerodata, and eremini

[fozzys1]

not sure about this can somebody help? :huh:

if u use zonealarm firewall do u need peerguardian? :unsure:

i thought firewalls did the work 4 u :(

[Switeck]

Dang, I gotta sort this whole new list by ip ranges, kill all the overlaps, and see how it fits into my old one -- which is already over double its length. :(

If you don't hear as much from me for the next day or so -- that may be why. ;)
Originally posted by fozzys1@3 June 2003 - 04:23
not sure about this can somebody help?  :huh:

if u use zonealarm firewall do u need peerguardian? :unsure:

i thought firewalls did the work 4 u :(Zone Alarm probably won't block the kinds of sniffing the RIAA/MPAA/BSA is doing, because it appears as either 'allowed web traffic' or 'Kazaa Lite++ traffic' -- which you HAD to allow to get Kazaa Lite++ working in the first place. The only exception to that is if you have Zone Alarm (Pro?) block incomming connections by ip range -- which is what Peer Guardian does.

Peer Guardian makes no distinction on how you connect, only on who you connect to by ip address. I don't even know if it blocks UDP connections -- it may only block TCP connections.

[dingdongding]

pg just blocks tcp/icp connections

and fozzys1 unfortunately you can't import ips (in this case the pg ips) into za pro- the ones i know you can do that with are agnitum outpost and sygate pro- so if you stick with za pro just keep your pg updated (that's what i do)

[Switeck]

Here's the overlaps I found in the new list and how it stacked up against my old list:

new: (range too small/large?)
RIAA:12.150.191.0-12.150.191.255
was:
RIAA:12.150.190.0-12.150.191.255


new:
Massachusetts Institute of Technology:18.250.2.150
Patriot-Media-Communications:24.225.128.0-24.225.223.255


new: (Range WAY TOO SMALL)
Replies with <search>..exe:38.144.198.24
Replies with <search>..exe:38.144.198.150
was:
Mutella BOT:38.144.68.0-38.144.198.255


new:
Sony-Network-Taiwan-Limited:61.64.232.198
Sony-Network-Taiwan-Limited:61.64.128.0-61.64.255.255
Australian Federal Police:61.88.128.38
www.amcrecords.com:62.72.107.0-62.72.107.255
IFPI.de:62.156.153.103-62.156.153.104
IFPI Germany:62.156.146.128-62.156.147.127
IFPI Germany:62.156.153.0-62.156.153.255
P2P Overflow:62.210.138.0-62.210.138.255
Studios Guillaume Tell / Paris,France:62.210.176.134
MediaForce:63.76.173.32-63.76.173.47


new: (wrong range&#33;)
MPAA:63.199.57.96-63.199.57.128
was:
MPAA:63.199.57.120-63.199.57.127

new:
Web Sense:63.212.171.0-63.212.171.255


new: (ranges wrong/too small&#33;)
OverPeer:64.14.37.128-64.14.37.159
OverPeer:64.14.40.160-64.14.40.191
OverPeer:64.15.224.0-64.15.255.255
OverPeer:64.15.226.96-64.15.226.127
OverPeer:64.15.228.16-64.15.228.191
was:
OverPeer:64.14.0.0-64.14.255.255
OverPeer:64.15.224.0-64.15.255.255


new:
IRMA (Mail):64.32.128.0-64.32.255.255
Big Champagne:64.49.254.0-64.49.254.255
Audible Magic:64.62.143.64-64.62.143.95


new: (overlapping&#33;)
Audible Magic:64.71.166.0-64.71.166.255
Audible Magic:64.71.166.128-64.71.166.191
changed to:
Audible Magic:64.71.166.0-64.71.166.255


new: (range too small&#33;)
Overpeer:64.75.4.192-64.75.4.223
was:
Overpeer:64.75.0.0-64.75.63.255


new: (duplicate PLUS range too small&#33;)
C&DCop:64.106.170.128-64.106.170.191
UnknownC&DCop:64.106.170.128-64.106.170.192
was:
C&DCop-HiSpeed Hosting:64.106.0.0-64.106.255.255


new:
IRMA:64.152.0.0-64.153.0.0
IRMA:64.158.221.50
Presence Studios Westport/Westport, CT:64.159.2.41


new: (range too small&#33;)
MPAA Subdel Valerie Bourne:64.166.187.128-64.166.187.158
was:
MPAA:64.166.187.128-64.166.187.192


new:
P2P port scanner:64.201.104.2


new: (range too small&#33;)
MediaDefender:64.225.202.0-64.225.202.255
MediaDefender:64.225.292.0-64.225.292.127
was:
MediaDefender:64.224.0.0-64.226.255.255


new:
Media signature Virtual Portal Corporation:65.101.193.0-65.101.193.255


new: (range too BIG?)
Cyveillance:65.118.41.0-65.118.41.255
was:
Cyveillance:65.118.41.192-65.118.41.255


new: (ranges too small AND overlap&#33;)
MediaForce:65.192.0.0-65.192.0.255
MediaForce:65.217.219.0-65.217.219.255
www.mediaforce.com:65.217.219.192-65.217.219.255
MediaForce:65.223.0.0-65.223.255.255
MediaForce:65.233.255.0-65.233.255.255
was:
MediaForce:65.192.0.0-65.224.255.255


new: (ranges overlap&#33;)
RIAA:65.244.101.001-65.244.101.255
RIAA:65.244.101.1-65.244.101.255
RIAA.COM:65.244.101.222-65.244.101.222
was:
RIAA:65.244.101.0-65.244.101.255


new:
Fake MP3s:66.28.0.0-66.28.0.0


new: (range too small&#33;)
CogentSystems:66.28.148.0
was:
Cogent:66.28.0.0-66.28.255.255


new: (range too small&#33;)
GAINCME:66.35.247.0-66.35.247.255
GAINCME:66.35.229.0-66.35.229.255
was:
GAINCME:66.35.192.0-66.35.255.255


new:
Universal Studios (ns3.mca.com):66.77.124.7
Replies with <search>:66.111.54.167-66.111.54.182
XBMC.COM:66.117.2.0-66.117.2.255
P2P Scanner:66.118.181.4


new: (range too small&#33;)
Retspan:66.150.161.133-66.150.161.136
was:
Dotster.com-Retspan:66.150.161.128-66.150.161.159


new:
BMI (Broadcast Music, Inc.):66.212.125.0-66.212.125.255
Audible Magic:66.220.31.128-66.220.31.159
popupad.net:66.230.219.137


new: (range too small&#33;)
Fake MP3 file:66.250.24.2-66.250.24.9
Cogent:66.250.32.227-66.250.32.242
was:
Cogent:66.250.0.0-66.250.255.255


new: (new range better than old?)
Telecom italia:80.180.73.96-80.180.73.136
Telecom Italia:80.180.123.205
was:
Telecom Italia:80.180.0.0-80.180.127.255


new:
Secure Group:80.239.22.64-80.239.22.127
BSA.at:81.16.38.0-81.16.38.31
IFPI Germany:81.91.161.0-81.91.161.31
Right Track Studios/New York, NY:129.250.2.220
World Music Group:129.250.5.115
Crescent Moon Studios/Miami, FL:130.94.0.170
Ardent Studios UK:144.232.11.245
Remote Recording Services/New York/Philadelphia:144.232.26.2
Bertelsmann group world wide (includes BMG Music):145.228.0.0-145.228.255.255
National Music Publishers of America:152.63.18.25
Misra records:152.63.66.13-152.63.66.13
Verve Music Group/Los Angeles Ca:152.63.113.57
Universal Music Enterprises/Los Angeles:152.63.113.65
MCA Records:152.63.113.69
Universal Music Group/(Motown Records)/Los Angeles:152.63.113.69
Universal Classics /Los Angeles Ca:152.63.113.69-152.63.113.69
Police of Switzerland:164.128.37.17-164.128.223.145
British Phonographic Industry:166.63.167.10
Metro-Goldwyn-Mayer:166.90.148.200
MCA:167.167.0.0-167.167.255.255


new: (but being in AOL&#39;s webspace means they&#39;re probably dynamic&#33;)
BayTSP:172.178.102.3


New:
Palisade Systems:192.188.162.0-192.188.162.255

new: (range too small?)
Fake Porn:192.217.228.226
was:
FBI:192.217.228.0-192.217.228.255


new: (OVERLAPING&#33;)
Universal Studios:192.251.66.0-192.251.66.255
Universal Studios:192.251.67.1-192.251.67.255
Universal Studios (gate.mca.com):192.251.67.9
Universal Studios (ns2.mca.com):192.251.67.132
converted to:
Universal Studios:192.251.66.0-192.251.67.255


new: (overlapping&#33;)
World Intellectual Property Organization:193.5.88.0-193.5.95.255
WIPO.ORG:193.5.93.80
was:
WIPONET:193.5.88.0-193.5.95.255


new:
IFPI Belgium:193.74.19.0-193.74.19.255
GEMA - German Copyright Society:193.108.8.0-193.108.15.255
Sabam (Belgian Society of Authors, Composers and Publishers):193.121.26.01-193.121.27.255
Federale politie - Police federale (BELGIUM):193.121.83.1-193.121.83.255
IFPI Germany:193.158.124.0-193.158.125.255
Dutch Covernment:193.172.176.0-193.172.177.255
French Department of Defense:193.252.72.142
Prefecture de police de Paris:193.252.228.0-193.252.228.255
it.cw.net used by Guardia di Finanza (Italy):194.79.208.0-194.79.208.255
Finnish Police:194.89.205.0-194.89.205.255
www.emigroup.com:194.129.73.0-194.129.73.255
APP:195.6.115.38


new: (corrected range?)
BSA.lv:195.13.160.32-195.13.160.163
was:
BSA.lv:195.13.160.32-195.13.160.63


new:
EMI Electrola GmbH (Germany):195.14.240.128-195.14.240.159
IFPI:195.40.0.128-195.40.0.255
IFPI:195.40.1.0-195.40.1.255
IFPI (mail):195.40.39.5
French Military Police:195.46.218.178
ADAMI (Society of civil rights for performing artists, France):195.68.59.1-195.68.59.7
Direccion General de la Policia (SPAIN):195.76.172.0-195.76.172.255
GuarDia di Finanza (Italy):195.94.0.0-195.94.255.255
Interpol:195.101.232.0-195.101.232.255
Alpa Association:195.102.60.40-195.102.60.50
Puk Recording Studios/Gjerlev,Denmark:195.122.136.8
BMG Ariola München GmbH (Germany):195.143.92.132-195.143.92.188
Sacem:195.154.72.0-195.154.72.255
Gigasoft:195.215.6.42
Edel Records GmbH (Hamburg/Germany):195.222.252.0-195.222.252.127


new: (range too small?)
Red Led Studios / Madrid,Spain:198.66.34.66
was:
MPAA:198.63.0.0-198.66.255.255


new: (corrected range?)
Double Click:199.95.206.0-199.95.207.255
doubleclick.net:199.95.207.0-199.95.208.0
was:
doubleclick.net:199.95.207.0
doubleclick.net:199.95.208.0
converted to:?
doubleclick.net:199.95.206.0-199.95.208.0


new:
Festival Mushroom Records/Sydney Au:202.139.113.106


new: (better range?)
BSA.com.au:203.26.16.0-203.26.31.255
was:
BSAA.com.au:203.147.240.0-203.147.240.255


new: (overlapping&#33;)
Double Click:204.178.112.170
md1.doubleclick.net:204.178.112.170
was:
md1.doubleclick.net:204.178.112.170


new: (better range?)
Double Click:205.138.3.0-205.138.3.255
was:
gd11.doubleclick.net:205.138.3.62


new:
CAAST.org:205.150.75.0-205.150.75.255
Media signature Tomas Jablonski:205.170.26.0-205.170.26.255
Interliant:206.129.0.0-206.129.0.255
BESS:206.129.1.0-206.129.1.255
US Customs:206.241.30.0-206.241.31.255
BSAPERU.org:207.150.221.96
IRMA:208.162.216.0-208.162.219.255


new: (repeated&#33;)
RIAA:208.192.0.0-208.192.255.255
RIAA:208.192.0.0-208.192.255.255
was:
RIAA:208.192.0.0-208.192.255.255


new:
The Allegro Group:208.196.168.0-208.196.175.255
RIAA:208.207.98.25


new: (overlaps&#33;)
MPAA:209.67.0.0-209.67.255.255
MPAA:209.67.1.131
was:
MPAA-Cable&Wireless:209.67.0.0-209.67.255.255


new: (range too small?)
gd17.doubleclick.net:209.67.38.99
was:
MPAA-Cable &amp; Wireless:209.67.0.0-209.67.255.255


new:
Grayzone.com:209.68.4.0-209.68.4.255


new:
Web Sense:209.132.98.0-209.132.98.255
Web Sense:209.132.99.0-209.132.99.255
simplified to:
Web Sense:209.132.98.0-209.132.99.255


new:
Warner Music Group:209.203.64.0-209.203.127.255


new:(overlapping&#33;)
www.baytsp.com:209.204.130.0-209.204.253.255
BayTSP:209.204.128.0-209.204.191.255
BayTSP:209.204.128.0-209.204.253.255
corrected to:
BayTSP:209.204.128.0-209.204.253.255


new:
bannerfarm.ace.advertising:209.255.6.77
ACCS:210.160.94.192-210.160.94.199
Universal Entertainment GmbH, Berlin/Germany (Universal Music Group):212.1.49.0-212.1.49.31
Politie.nl:212.19.195.8
DR3NET:212.37.45.0-212.37.45.15
DR3NET:212.37.47.0-212.37.47.15
Warner Music (Germany):212.79.56.128-212.79.56.187
www.arsproductions.com:212.123.28.0-212.123.28.255
BumaStemra:212.123.224.160-212.123.224.191
Telecom Italia >>> BSA Host:212.131.0.0-212.131.255.255
KOCH International Multimedia:212.152.174.0-212.152.174.127
MG Sound Studios/Vienna,Austria:212.227.116.140
Capri Digital Studios/Isle of Capri, Italy:213.186.35.203
Zomba Records:213.210.18.0-213.210.18.255


new: (simplified already...)
DoD Network Information Center:214.0.0.0-214.255.255.255
DoD Network Information Center:215.0.0.0-215.255.255.255
was:
DoD Network Information Center:214.0.0.0-215.255.255.255


new: (range too small&#33;)
OverPeer:216.35.73.128-216.35.73.159
was:
OverPeer:216.25.0.0-216.35.255.255


new:
Hexillion:216.46.246.238-216.46.246.238
Time Warner Telecom:216.64.128.0-216.64.191.255
Double Click:216.73.80.0-216.73.95.255
n-Case Ad Delivery:216.74.57.197-216.74.57.216


new: (range too small&#33;)
Sony Music Entertainment Inc.:216.74.128.0
OverPeer:216.74.134.128-216.74.134.159
Sony Music Entertainment Inc.:216.74.154.0-216.74.154.255
Sony Music Belgium:216.74.154.0-216.74.154.255
was:
Cable&Wireless-OverPeer:216.74.128.0-216.74.191.255


new:
Brussel politie - Police bruxelles:216.118.66.0-216.118.66.255
AFMA (American Film Marketing Association):216.120.77.0-216.120.77.255
Interliant:216.205.94.0-216.205.94.255
French Department of Defense:217.167.182.1-217.167.182.255


new: (overlaps&#33;)
IFPI:217.204.27.212-217.204.27.215
IFPI.com:217.204.27.214
IFPI (dr IFPI):217.204.27.214
changed to:
IFPI:217.204.27.212-217.204.27.215

[BaNe^]

Sorry but my english isn&#39;t that good, so what does overlap mean? Those ranges are from PG Ip database and i haven&#39;t modified those.....what the hell i should do with them? :)

[Switeck]

Originally posted by BaNe^@4 June 2003 - 10:10
Sorry but my english isn&#39;t that good, so what does overlap mean? Those ranges are from PG Ip database and i haven&#39;t modified those.....what the hell i should do with them? :)
Overlapping means 2 (or more) ip ranges share the same numbers -- so it&#39;s better to just have 1 range and eliminate an entry.

Fewer ip ranges blocked, even if they&#39;re bigger, should probably make Peer Guardian run faster.

See my other thread -- Switeck&#39;s Peer Guardian list for my modified list.

[BaNe^]

Originally posted by Switeck@4 June 2003 - 15:50
Here&#39;s the overlaps I found in the new list and how it stacked up against my old list:

new: (range too small/large?)
RIAA:12.150.191.0-12.150.191.255
was:
RIAA:12.150.190.0-12.150.191.255


.............
............
I think theyre all corrected now.....but theyre gonna be in next update :)

[Switeck]

Originally posted by BaNe^+4 June 2003 - 13:35--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (BaNe^ @ 4 June 2003 - 13:35)</td></tr><tr><td id='QUOTE'><!--QuoteBegin--Switeck@4 June 2003 - 15:50
Here&#39;s the overlaps I found in the new list and how it stacked up against my old list:

new: (range too small/large?)
RIAA:12.150.191.0-12.150.191.255
was:
RIAA:12.150.190.0-12.150.191.255I think theyre all corrected now.....[/b][/quote]Actually, it&#39;s one thing to consolidate the lists...

It&#39;s another to make sure they&#39;re correct.

For instance, this WHOIS info:

AMERICAN COUNCIL OF LIFE INSURERS AMERICAN257-190 (NET-12-150-190-0-1)
12.150.190.0 - 12.150.190.255

RECORDING INDUSTRY ASSOC OF AMERICA RECORDIN50-191 (NET-12-150-191-0-1)
12.150.191.0 - 12.150.191.255

yet...
RIAA:12.150.190.0-12.150.191.255
has both of them in its range.
Should p2p users consider "AMERICAN COUNCIL OF LIFE INSURERS" a hostile group? :P

But what if they no longer have that ip range and it IS now used by someone else...?

[Infested Cats]

When do you plan on coming out with the next version, or perhaps the more appropriate question is, how often do you put out a release?

[Switeck]

Originally posted by Infested Cats@4 June 2003 - 17:57
When do you plan on coming out with the next version, or perhaps the more appropriate question is, how often do you put out a release?
If you mean me, I&#39;m working daily to tweak the settings.
(But get the list I posted yesterday for the time being -- it&#39;s good for a stand-alone kazaa machine, just not if you want to surf the web on it.)
I&#39;ll be working off-and-on over the next few weeks to verify that the blocked ranges are accurate and relevant.

I can&#39;t promise when a breakthrough occurs, but the limiting factor seems to be my ability to connect ips through their shell companies (the ones listed using various WHOIS functions) back to who&#39;s really pulling the strings.

[BaNe^]

About those ranges you posted....aren&#39;t they too broad?


Example this addres:
MediaForce:65.192.0.0-65.224.255.255 is blocking web sites like www.paypal.com. There are more ranges that block harmless web sites....addresses that get blocked are like www.boomspeed.com, www.ozzfest.com and others like that.

[Switeck]

Originally posted by BaNe^@5 June 2003 - 02:04
About those ranges you posted....aren&#39;t they too broad?

Example this addres:
MediaForce:65.192.0.0-65.224.255.255 is blocking web sites like www.paypal.com. There are more ranges that block harmless web sites....addresses that get blocked are like www.boomspeed.com, www.ozzfest.com and others like that.I KNOW the ranges are too broad, but it&#39;s kinda hard to nail down the ip ranges of corporations we wish to block. :(

Help me then -- could you do some WHOIS and reverse DNS lookups across the whole 65.192.0.0-65.224.255.255 to see if you can find any MediaForce regions in that range?

They&#39;re acting more like hackers than WE are&#33; :o

But like I said, if you have a computer that does little more than run Kazaa/any p2p file sharing program, then those ranges are very good -- as websites don&#39;t usually try to contact you without you requesting them first. :lol:

I&#39;ve managed to whittle things down a bit and am running Peer Guardian while I surf the web to see if I can stumble across conflicting ranges -- but that doesn&#39;t help me find the bad guys... it only helps me find places that (probably) AREN&#39;T the bad guys.

I tested www.paypal.com -- yep, it&#39;s blocked.

www.boomspeed.com didn&#39;t come up at all.

http://www.ozzfest.com/ 216.74.154.120:80 apache-gr2.sonymusic.com:80 WASN&#39;T blocked. (it translated back to apache-gr2.sonymusic.com:80 which I would consider a medium to high-risk link for Kazaa to be making...)

http://www.epicrecords.com/ 198.5.148.12:80 AND 216.74.154.150:80 isn&#39;t blocked, although it probably should be.

[BaNe^]

I noticed that themexp.org is blocked too.....

[Infested Cats]

Checking in again. Anything new?