ILoveIM

[Easy_506]

Websense has been unable to block this website now for some time, and I've personally tried blocking individual URLs and IP addresses.

 

Does anyone out there have any other way of blocking this site, because from what i've seen they seem to use rotating IP addresses (ie - each time I find a pupil on there it is a different IP).

 

Any assistance would be very much appreciated!

[Gatt]

I dont use Websense, but with Smoothwall - all we need todo is add the domain part of the URL (eg iloveim.com) which then blocks - WWW, x29, etc

 

What about blocking iloveim in any part of the url?

 

Need someone with websense to clarify how this is done though..

[Easy_506]

Thanks for your response Gatt.

 

Admittedly I haven't spoken to anyone at Websense about this *yet* - just wanted a crack at solving the problem myself.

 

I blocked the URL (and any part of it as you suggested) several months ago, but the kids still seem to be getting through via an IP address that seems to change with each visit.

 

As I said, keeping up with these IP addresses is a job unto itself, so at the moment i'm not spending too much time on it.

[rob_f]

Rather than blocking on URL/IP address we put in some rules to catch any clone of ILoveIM. Not sure how effective it is as I don't know too many of the IPs to test, but Zoom7000 requested this so would be interested if he has some feedback.

[Richie1972]

You could also look at blocking groups of IP Addresses - they may well have just a block of addresses they use.

Alternatively you could use keyword filtering in Websense so that the site is blocked if the word iloveim appears anywhere on it

[elloyd69]

We are currently trying to block IP addresses but having no luck with PCE, squid or our blacklist. County aren't sure............any ideas??

[Batman]

I've been wrestling with this one for months and have decided that it's a war that never ends. The only thing you can do is try to get the good kids to grass on the bad kids and block the different URLs as you find out

[elloyd69]

Yeah thats what I'm currently doing.....glad I only work in a middle school with 450 kids, this must be a nighmare in a high school!! Thank.

[tom_newton]

Can you guys post some of the problem URLs? Just want to check our effectiveness against the latest attempts... can't see us missing any though.

[Batman]

I'll see what I can dig up... although it's difficult because the filtering system has now blocked this page. Typical!

[elloyd69]

It's the youtube IP 208.65.135.238 that I'm having a problem with. Thankfully we've managed to block it for kids but not staff on PCE. It won't block IPs but thankfully the vieos don't seem to play anyway. Thankfully edugeek isn't filtered!!

[Dom_]

216.32.66.235

216.32.68.173

209.67.215.235

209.67.215.236

72.232.233.108

72.232.120.243

72.232.120.244

216.32.90.28

216.32.90.29

72.232.16.75

72.232.16.76

216.32.90.27

72.232.63.35

72.232.63.36

72.232.204.187

72.232.204.188

72.232.204.189

72.232.63.37

216.32.67.213

209.67.215.237

72.232.16.77

72.232.216.21

72.232.233.107

72.232.233.109

72.232.120.246

72.232.120.245

216.32.94.115

216.32.94.116

216.32.94.117

72.232.207.3

72.232.207.4

72.232.207.5

216.32.68.189

216.32.68.187

72.36.196.235

72.36.196.236

72.36.196.237

72.232.25.179

72.232.25.180

72.232.25.181

72.232.167.131

72.232.167.132

72.232.167.133

72.232.63.99

216.32.68.188

72.232.63.100

72.232.63.101

72.232.63.102

216.32.67.211

216.32.67.212

216.32.68.171

216.32.68.172

[elloyd69]

Thanks, I've now managed to filter IPs which is great so the list will be really useful.

[sahmeepee]

After putting all those IPs up it might be an idea to move this thread to "Security" for the sake of those schools who haven't blocked them all.

 

Our council filtering blocks all direct access to IP addresses. For the most part that's OK, but unfortunately it wipes out google cache in the process. From what I can tell their regex is a little too loose so it blocks any address starting with a number which can cause occasional problems.

 

Looking at that list I would be tempted to block the entirety of 72. , 209. and 216.

[Batman]

DON'T DO IT!!! If we block all those addresses we may be unleashing a monster

 

I admit that the turn of phrase used in the previous sentence was largely an excuse to use the troll emoticon. However...

 

Ever since we started getting problems with "ILoveIM", there is a thought that has been going through my head. If there are so many ip addresses for ILoveIM, then this must surely be an attempt (albeit unofficial as far as I can make out) by ILoveIM to help their users get around filtering systems like the ones we are all using. Obvious so far.

 

With this in mind, I wondered if it might also be the case that as they introduce new ip addresses ILoveIM stop using older ones and having tried a few of the addresses posted here, I am led to conclude that this is true as most of them just time out (no ping, no web pages), whereas I can get a ping and a webpage from the site's main ip 72.232.200.122.

 

So I would urge against blocking the whole list as in the future these ip addresses may belong to legitimate websites. See if they work first... If they don't there's no need to block them. I think blocking whole ip ranges may be an even worse idea!