111
Today, on the day of the programmer, we have presented quite an original gift: a user lebnik accused the us one of his posts was hidden in drafts and subjected to change content to "111". Since we are talking about our reputation, we decided to investigate the situation — because to do such would not a moderator of the site and none of the employees of the company.
Most "scary" what to do in such cases, the moderators tolerate the publication in the corresponding hub (in 99% of cases posts are transferred to "PR I" or "I contend"), and in case of violation of the publication rules of the site, it is hiding in drafts, and its author is translated in a mode "Read Only" notification.
One of the charges lebnik in our address touched on yet, and the fact that his requests were ignored by the support team — it was here that we decided to launch an investigation of a conspiracy.
As software for feedback we use Live Agent Quality Unit is an excellent and versatile solution in which many opportunities for the operational solution of the user problem. The first thing searched for on applications all the above mentioned address of the user. Any results — this means that no applications, since absolutely all applications are reviewed and remain in the system. For completeness, we checked the Event Log helpdesk — there are in all three locations, too, was empty.
The problem was found when we checked the "Spam" folder in Google Apps email account (we use Gmail's filters). In addition to numerous spam email (including due to which we moved from the mail address on a web form), there were requests of users. Now they are moved to Inbox and we will respond to every appeal. Many proposals were out of date — re-treatment of the users apparently “passed”.
Of course, it is rather our fault that we didn't start the morning with a check the folder "Spam" in the email with which letters were forwarded to helpdesk. All the indignation about the fact that "the caliper is not responding" — just for this reason, all the extant letters we always reply (surprisingly, most of the addresses in the "Spam" was from the mail on Gmail).
Let's move on. Habré logs are maintained of all changes of the post, below are the change logs record id 149924, entitled "Yandex.Money fraud":
Legend:
user_id — the ID of the user who edited the post (58133 — Lebnik, 3 — one of the moderators Habra (deniskin)).
IP 1209779521 => 72.27.197.65 => Cable and Wireless Jamaica, JM;
IP 2965381334 => 176.192.32.214 => Net By Net, COM;
IP 2960188111 => 176.112.226.207 => ITC Electron Ltd RU;
IP <censored> => the IP of the moderator, UFO is hidden.
so what does all this mean?
1 — user has created a post on "habré" with the Russian ip address (2012-08-20 evening, 176.112.226.207);
2-4 post was edited by author from the same ip address (2012-08-20 evening, 176.112.226.207);
5 — a moderator moved the post to "I resent" (2012-08-21 morning);
The 6-7 post, slightly edited, also from Russia (2012-08-21 morning, 176.192.32.214);
8-9 — post tucked away in draft, its contents are replaced 11 with a Jamaican ip address (2012-09-04, three nights 72.27.197.65);
10-12 — the user edited the post from Russia (2012-09-12 lunch, 176.192.32.214);
13 — the moderator re-moved from the hub post, "Yandex" to "I resent" (2012-09-12 lunch).
We see here two options: either the attacker stole a user of the author password "Habrahabr" (perhaps along with the account password in the system "Yandex.Money" and other services, if you used the same password) and edited the post; or the attacker himself Lebnik, strangely decided to play the drama (we don't claim but can't assume). Below is attached a fragment of the log of nginx requests with a Jamaican IP addresses:
First. We never remove or make vandalic action with the posts of our users.
Second. All cases support will not remain unnoticed — if long time no response, then most likely, your letter just didn't reach us.
Third point. due To the fact that the publication in the hub "I is indignant" basically, generate drama, bickering, fighting and other dirt, we decided to remove it and transfer all the published posts in offtopic hub "Closet". We believe that all personal problems (be it data theft or money SMS fraud or poor quality provision of services) should be addressed to the competent authorities. We are not going to spend more time figuring out of the details and circumstances of a particular drama. Because it comes to our reputation, we were interested to find out the truth in this matter, but in the future we have no desire to justify and to prove that we are white and fluffy — we want, like you, to work, to develop the resource and not to waste time on counterproductive things.
Happy holidays everyone!
Article based on information from habrahabr.ru
Most "scary" what to do in such cases, the moderators tolerate the publication in the corresponding hub (in 99% of cases posts are transferred to "PR I" or "I contend"), and in case of violation of the publication rules of the site, it is hiding in drafts, and its author is translated in a mode "Read Only" notification.
One of the charges lebnik in our address touched on yet, and the fact that his requests were ignored by the support team — it was here that we decided to launch an investigation of a conspiracy.
As software for feedback we use Live Agent Quality Unit is an excellent and versatile solution in which many opportunities for the operational solution of the user problem. The first thing searched for on applications all the above mentioned address of the user. Any results — this means that no applications, since absolutely all applications are reviewed and remain in the system. For completeness, we checked the Event Log helpdesk — there are in all three locations, too, was empty.
The problem was found when we checked the "Spam" folder in Google Apps email account (we use Gmail's filters). In addition to numerous spam email (including due to which we moved from the mail address on a web form), there were requests of users. Now they are moved to Inbox and we will respond to every appeal. Many proposals were out of date — re-treatment of the users apparently “passed”.
Of course, it is rather our fault that we didn't start the morning with a check the folder "Spam" in the email with which letters were forwarded to helpdesk. All the indignation about the fact that "the caliper is not responding" — just for this reason, all the extant letters we always reply (surprisingly, most of the addresses in the "Spam" was from the mail on Gmail).
Let's move on. Habré logs are maintained of all changes of the post, below are the change logs record id 149924, entitled "Yandex.Money fraud":
View history changes post
mysql> select num, user_id, remote_ip, post_id, from_unixtime(time_created), substr(data, 1, 400) from post_revisions where post_id=149924 \G
*************************** 1. row ***************************
num: 1
user_id: 58133
remote_ip: 2960188111
post_id: 149924
from_unixtime(time_created): 2012-08-20 22:42:33
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:50;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";N;s:12:"is_published";s:1:"1";s:11:"tags_string";s:53:"moshennichestvo Yandex-money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36474:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately inform the company Yandex.Money
*************************** 2. row ***************************
num: 2
user_id: 58133
remote_ip: 2960188111
post_id: 149924
from_unixtime(time_created): 2012-08-20 23:02:52
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:50;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";N;s:12:"is_published";s:1:"1";s:11:"tags_string";s:53:"moshennichestvo Yandex-money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36564:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately inform the company Yandex.Money
*************************** 3. row ***************************
num: 3
user_id: 58133
remote_ip: 2960188111
post_id: 149924
from_unixtime(time_created): 2012-08-20 23:03:18
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:50;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";N;s:12:"is_published";s:1:"1";s:11:"tags_string";s:53:"moshennichestvo Yandex-money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36611:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately inform the company Yandex.Money
num: 4
user_id: 58133
remote_ip: 2960188111
post_id: 149924
from_unixtime(time_created): 2012-08-20 23:30:07
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:50;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";N;s:12:"is_published";s:1:"1";s:11:"tags_string";s:53:"moshennichestvo Yandex-money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36613:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately inform the company Yandex.Money
*************************** 5. row ***************************
num: 5
user_id: 3
remote_ip: <censored>
post_id: 149924
from_unixtime(time_created): 2012-08-21 10:40:01
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";s:1:"1";s:11:"tags_string";s:53:"moshennichestvo Yandex-money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36613:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately inform the company Yandex
*************************** 6. row ***************************
num: 6
user_id: 58133
remote_ip: 2965381334
post_id: 149924
from_unixtime(time_created): 2012-08-21 10:54:24
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";s:1:"1";s:11:"tags_string";s:53:"moshennichestvo Yandex-money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:35821:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately inform the company Yandex
*************************** 7. row ***************************
num: 7
user_id: 58133
remote_ip: 2965381334
post_id: 149924
from_unixtime(time_created): 2012-08-22 11:10:27
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";s:1:"1";s:11:"tags_string";s:81:"moshennichestvo, Yandex-money, Yandex money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:35896:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately let
*************************** 8. row ***************************
num: 8
user_id: 58133
remote_ip: 1209779521
post_id: 149924
from_unixtime(time_created): 2012-09-04 03:35:06
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";N;s:11:"tags_string";s:3:"111";s:5:"title";s:2:"11";s:4:"text";s:4:"1111";s:18:"translation_author";N;s:4:"link";N;s:12:"answers_type";N;s:11:"active_till";N;s:20:"podcast_external_url";N;s:11:"podcast_url";N;}
*************************** 9. row ***************************
num: 9
user_id: 58133
remote_ip: 1209779521
post_id: 149924
from_unixtime(time_created): 2012-09-04 03:43:27
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";N;s:11:"tags_string";s:1:"1";s:5:"title";s:2:"11";s:4:"text";s:4:"1111";s:18:"translation_author";N;s:4:"link";N;s:12:"answers_type";N;s:11:"active_till";N;s:20:"podcast_external_url";N;s:11:"podcast_url";N;}
*************************** 10. row ***************************
num: 10
user_id: 58133
remote_ip: 2965381334
post_id: 149924
from_unixtime(time_created): 2012-09-12 10:29:39
substr(data, 1, 400): a:15:{s:4:"hubs";a:2:{i:0;i:591;i:1;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";N;s:11:"tags_string";s:81:"moshennichestvo, Yandex-money, Yandex money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36909:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. With
*************************** 11. row ***************************
num: 11
user_id: 58133
remote_ip: 2965381334
post_id: 149924
from_unixtime(time_created): 2012-09-12 12:02:53
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:23;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";N;s:12:"is_published";s:1:"1";s:11:"tags_string";s:81:"moshennichestvo, Yandex-money, Yandex money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36909:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately report the compan
*************************** 12. row ***************************
num: 12
user_id: 58133
remote_ip: 2965381334
post_id: 149924
from_unixtime(time_created): 2012-09-12 12:34:26
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:23;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";N;s:12:"is_published";s:1:"1";s:11:"tags_string";s:81:"moshennichestvo, Yandex-money, Yandex money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36623:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately report the compan
num: 13
user_id: 3
remote_ip: <censored>
post_id: 149924
from_unixtime(time_created): 2012-09-12 13:16:18
substr(data, 1, 400): a:15:{s:4:"hubs";a:1:{i:0;i:9743;}s:10:"userformat";N;s:13:"is_collective";s:1:"1";s:14:"is_corporative";N;s:10:"is_private";s:1:"1";s:12:"is_published";s:1:"1";s:11:"tags_string";s:81:"moshennichestvo, Yandex-money, Yandex money";s:5:"title";s:52:"Yandex.Money fraud";s:4:"text";s:36623:"<p>the day before Yesterday I stole 25 000 Yandex-money (all I had), and I began to understand. Immediately let
13 rows in set (0.01 sec)
Legend:
user_id — the ID of the user who edited the post (58133 — Lebnik, 3 — one of the moderators Habra (deniskin)).
IP 1209779521 => 72.27.197.65 => Cable and Wireless Jamaica, JM;
IP 2965381334 => 176.192.32.214 => Net By Net, COM;
IP 2960188111 => 176.112.226.207 => ITC Electron Ltd RU;
IP <censored> => the IP of the moderator, UFO is hidden.
so what does all this mean?
1 — user has created a post on "habré" with the Russian ip address (2012-08-20 evening, 176.112.226.207);
2-4 post was edited by author from the same ip address (2012-08-20 evening, 176.112.226.207);
5 — a moderator moved the post to "I resent" (2012-08-21 morning);
The 6-7 post, slightly edited, also from Russia (2012-08-21 morning, 176.192.32.214);
8-9 — post tucked away in draft, its contents are replaced 11 with a Jamaican ip address (2012-09-04, three nights 72.27.197.65);
10-12 — the user edited the post from Russia (2012-09-12 lunch, 176.192.32.214);
13 — the moderator re-moved from the hub post, "Yandex" to "I resent" (2012-09-12 lunch).
We see here two options: either the attacker stole a user of the author password "Habrahabr" (perhaps along with the account password in the system "Yandex.Money" and other services, if you used the same password) and edited the post; or the attacker himself Lebnik, strangely decided to play the drama (we don't claim but can't assume). Below is attached a fragment of the log of nginx requests with a Jamaican IP addresses:
Fragment of log nginx
72.27.197.65 - - [04/Sep/2012:03:26:23 +0400] "GET /login/ HTTP/1.0" 200 4694 "http://habrahabr.ru/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:26:24 +0400] "GET /core/captcha/ HTTP/1.0" 200 9176 "http://habrahabr.ru/login/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:27:10 +0400] "POST /json/auth/login/ HTTP/1.0" 200 54 "http://habrahabr.ru/login/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:27:12 +0400] "GET / HTTP/1.0" 200 78374 "http://habrahabr.ru/login/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:28:13 +0400] "GET /hubs/ HTTP/1.0" 500 0 "http://habrahabr.ru/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:28:18 +0400] "GET / HTTP/1.0" 200 78585 "http://habrahabr.ru/login/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:28:21 +0400] "GET /posts/top/ HTTP/1.0" 500 0 "http://habrahabr.ru/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:28:25 +0400] "GET /posts/top/ HTTP/1.0" 500 0 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:28:37 +0400] "GET /posts/top/ HTTP/1.0" 200 32584 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:29:34 +0400] "GET /login/ HTTP/1.0" 200 4694 "http://habrahabr.ru/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:30:14 +0400] "POST /json/auth/login/ HTTP/1.0" 200 54 "http://habrahabr.ru/login/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:30:15 +0400] "GET / HTTP/1.0" 200 78396 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:30:36 +0400] "GET /hubs/ HTTP/1.0" 200 41766 "http://habrahabr.ru/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:31:04 +0400] "GET /hub/infosecurity/ HTTP/1.0" 200 118476 "http://habrahabr.ru/hubs/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:31:40 +0400] "GET /users/lebnik/ HTTP/1.0" 200 24154 "http://habrahabr.ru/hub/infosecurity/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:32:13 +0400] "GET /post/149924 HTTP/1.0" 301 268 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:32:15 +0400] "GET /post/149924/ HTTP/1.0" 200 1555326 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:34:20 +0400] "GET /topic/edit/149924/ HTTP/1.0" 200 68843 "http://habrahabr.ru/post/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:35:01 +0400] "GET /json/suggest/?type=tags&query=111 HTTP/1.0" 200 127 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:35:06 +0400] "POST /json/topic/?action=save HTTP/1.0" 200 47 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:35:07 +0400] "GET /post/149924/ HTTP/1.0" 200 37522 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:36:17 +0400] "GET /topic/edit/149924/ HTTP/1.0" 200 28929 "http://habrahabr.ru/post/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:36:49 +0400] "POST /json/topic/?action=save HTTP/1.0" 200 172 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:36:53 +0400] "POST /json/topic/?action=save HTTP/1.0" 200 172 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:37:01 +0400] "GET /users/lebnik/ HTTP/1.0" 200 24152 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:37:31 +0400] "GET /users/lebnik/topics/ HTTP/1.0" 200 21681 "http://habrahabr.ru/users/lebnik/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:37:46 +0400] "GET /settings/ HTTP/1.0" 200 49194 "http://habrahabr.ru/users/lebnik/topics/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:37:48 +0400] "GET /uploader/?t=avatar_image&name=avatar HTTP/1.0" 200 1275 "http://habrahabr.ru/settings/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:40:01 +0400] "GET /tracker/ HTTP/1.0" 200 17816 "http://habrahabr.ru/settings/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:40:29 +0400] "GET /post/149924/ HTTP/1.0" 200 37530 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:42:20 +0400] "GET /topic/edit/149924/ HTTP/1.0" 200 28929 "http://habrahabr.ru/post/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:43:02 +0400] "POST /json/topic/?action=save HTTP/1.0" 200 75 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:43:27 +0400] "POST /json/topic/?action=save HTTP/1.0" 200 47 "http://habrahabr.ru/topic/edit/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:43:28 +0400] "GET /post/149924/ HTTP/1.0" 200 37546 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:43:51 +0400] "GET /users/Lebnik/ HTTP/1.0" 200 24152 "http://habrahabr.ru/post/149924/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:44:14 +0400] "GET /sandbox/47259/ HTTP/1.0" 200 21392 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
72.27.197.65 - - [04/Sep/2012:03:45:09 +0400] "GET /logout/Lebnik/431795170/ HTTP/1.0" 301 244 "http://habrahabr.ru/sandbox/47259/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [habrahabr.ru] {Bonnie}
in summary
First. We never remove or make vandalic action with the posts of our users.
Second. All cases support will not remain unnoticed — if long time no response, then most likely, your letter just didn't reach us.
Third point. due To the fact that the publication in the hub "I is indignant" basically, generate drama, bickering, fighting and other dirt, we decided to remove it and transfer all the published posts in offtopic hub "Closet". We believe that all personal problems (be it data theft or money SMS fraud or poor quality provision of services) should be addressed to the competent authorities. We are not going to spend more time figuring out of the details and circumstances of a particular drama. Because it comes to our reputation, we were interested to find out the truth in this matter, but in the future we have no desire to justify and to prove that we are white and fluffy — we want, like you, to work, to develop the resource and not to waste time on counterproductive things.
Happy holidays everyone!
Комментарии
Отправить комментарий