ILoveIM

[Easy_506]

Websense has been unable to block this website now for some time, and I've personally tried blocking individual URLs and IP addresses.

Does anyone out there have any other way of blocking this site, because from what i've seen they seem to use rotating IP addresses (ie - each time I find a pupil on there it is a different IP).

Any assistance would be very much appreciated!

[Gatt]

I dont use Websense, but with Smoothwall - all we need todo is add the domain part of the URL (eg iloveim.com) which then blocks - WWW, x29, etc

What about blocking iloveim in any part of the url?

Need someone with websense to clarify how this is done though..

[Easy_506]

Thanks for your response Gatt.

Admittedly I haven't spoken to anyone at Websense about this *yet* - just wanted a crack at solving the problem myself.

I blocked the URL (and any part of it as you suggested) several months ago, but the kids still seem to be getting through via an IP address that seems to change with each visit.

As I said, keeping up with these IP addresses is a job unto itself, so at the moment i'm not spending too much time on it.

[rob_f]

Rather than blocking on URL/IP address we put in some rules to catch any clone of ILoveIM. Not sure how effective it is as I don't know too many of the IPs to test, but Zoom7000 requested this so would be interested if he has some feedback.

[Richie1972]

You could also look at blocking groups of IP Addresses - they may well have just a block of addresses they use.
Alternatively you could use keyword filtering in Websense so that the site is blocked if the word iloveim appears anywhere on it

[elloyd69]

We are currently trying to block IP addresses but having no luck with PCE, squid or our blacklist. County aren't sure............any ideas??

[Batman]

I've been wrestling with this one for months and have decided that it's a war that never ends. The only thing you can do is try to get the good kids to grass on the bad kids and block the different URLs as you find out

[elloyd69]

Yeah thats what I'm currently doing.....glad I only work in a middle school with 450 kids, this must be a nighmare in a high school!! Thank.

[tom_newton]

Can you guys post some of the problem URLs? Just want to check our effectiveness against the latest attempts... can't see us missing any though.

[Batman]

I'll see what I can dig up... although it's difficult because the filtering system has now blocked this page. Typical!

[elloyd69]

It's the youtube IP 208.65.135.238 that I'm having a problem with. Thankfully we've managed to block it for kids but not staff on PCE. It won't block IPs but thankfully the vieos don't seem to play anyway. Thankfully edugeek isn't filtered!!

[Dom_]

216.32.66.235
216.32.68.173
209.67.215.235
209.67.215.236
72.232.233.108
72.232.120.243
72.232.120.244
216.32.90.28
216.32.90.29
72.232.16.75
72.232.16.76
216.32.90.27
72.232.63.35
72.232.63.36
72.232.204.187
72.232.204.188
72.232.204.189
72.232.63.37
216.32.67.213
209.67.215.237
72.232.16.77
72.232.216.21
72.232.233.107
72.232.233.109
72.232.120.246
72.232.120.245
216.32.94.115
216.32.94.116
216.32.94.117
72.232.207.3
72.232.207.4
72.232.207.5
216.32.68.189
216.32.68.187
72.36.196.235
72.36.196.236
72.36.196.237
72.232.25.179
72.232.25.180
72.232.25.181
72.232.167.131
72.232.167.132
72.232.167.133
72.232.63.99
216.32.68.188
72.232.63.100
72.232.63.101
72.232.63.102
216.32.67.211
216.32.67.212
216.32.68.171
216.32.68.172

[elloyd69]

Thanks, I've now managed to filter IPs which is great so the list will be really useful.

[sahmeepee]

After putting all those IPs up it might be an idea to move this thread to "Security" for the sake of those schools who haven't blocked them all.

Our council filtering blocks all direct access to IP addresses. For the most part that's OK, but unfortunately it wipes out google cache in the process. From what I can tell their regex is a little too loose so it blocks any address starting with a number which can cause occasional problems.

Looking at that list I would be tempted to block the entirety of 72. , 209. and 216.

[Batman]

DON'T DO IT!!! If we block all those addresses we may be unleashing a monster

I admit that the turn of phrase used in the previous sentence was largely an excuse to use the troll emoticon. However...

Ever since we started getting problems with "ILoveIM", there is a thought that has been going through my head. If there are so many ip addresses for ILoveIM, then this must surely be an attempt (albeit unofficial as far as I can make out) by ILoveIM to help their users get around filtering systems like the ones we are all using. Obvious so far.

With this in mind, I wondered if it might also be the case that as they introduce new ip addresses ILoveIM stop using older ones and having tried a few of the addresses posted here, I am led to conclude that this is true as most of them just time out (no ping, no web pages), whereas I can get a ping and a webpage from the site's main ip 72.232.200.122.

So I would urge against blocking the whole list as in the future these ip addresses may belong to legitimate websites. See if they work first... If they don't there's no need to block them. I think blocking whole ip ranges may be an even worse idea!