Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch > #3243

Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked

Show key headers only | View raw

On 8/29/2011 9:40 AM, EricP wrote:
> Andy "Krazy" Glew wrote:
>> On 8/28/2011 8:49 PM, EricP wrote:
>>> Andy "Krazy" Glew wrote:
>>>>
>>>> But I also found another website, waboba.info, that seems to be a
>>>> clone of comp-arch.net.
>>>
>>> Hmmm... did a nslookup on waboba.info and got IP 69.163.174.83
>>> which is the same as semipublic.comp-arch.net
>>>
>>> Looked that up and it reports as semipublic.comp-arch.net
>>> located in the California, city BREA.
>>> http://ip-address-lookup-v4.com/lookup.php?ip=69.163.174.83
>>>
>>> Eric
>>
>> Interesting.
>>
>> I had already done the whois.
>>
>> But I had not thought to do the nslookup.
>>
>> (I suppose the times that I could see differences between my site and
>> the other site may have just been caching effects.)
>>
>> Now, why would somebody direct THEIR site to MY comp-arch.net site?
>> What's the advantage in that?
>>
>> The suspicious part of me suspects prepping for something nefarious.
>>
>> (Of course, it might always be a DNS takeover, resulting in MY site
>> being directed to HIS. ... No, doesn't seem to be, since that is the
>> only site that I pay for a "unique IP" on (Dreamhost doesn't do static
>> IPs), and that is what Dreamhost, accessed across HTTPS, reports. I
>> suppose it is possible that they have taken over Dreamhost. )
>
> I figured someone did a typo entering the IP address for
> waboba.info and accidentally pointed their name at your server.
> I suppoose an email to biuro@tootu.pl or their host
> dns@home.pl would resolve it.
>
> Translating their website http://tootu.pl
>
> A Waboba appears to be toy like a frisbee or something.
> "The only ball that bounces off the water"
> http://translate.google.ca/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=pl&tl=en&u=tootu.pl&act=url
>
>
> Their hosting site is:
> http://translate.google.ca/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=pl&tl=en&u=home.pl&act=url
>
>
> Eric

I was beginning to think that this was innocuous "Never ascribe to 
malice what can be attributed to stupidity/accident".

However, worrying about malice is good - because fixing malice is 
urgent, whereas fixing an accidental error is less urgent.

---

I find it interesting that DNS does not have a mechanism to ensure that 
domains and P addresses are not consistent.   E.g. a digital 
signatute/hash including both, made with a private key corresponding to 
a public key posted in whois.

Back to comp.arch | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-28 19:49 -0700
  Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked EricP <ThatWouldBeTelling@thevillage.com> - 2011-08-28 23:32 -0400
  Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked EricP <ThatWouldBeTelling@thevillage.com> - 2011-08-28 23:49 -0400
    Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 08:59 -0700
      Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked EricP <ThatWouldBeTelling@thevillage.com> - 2011-08-29 12:40 -0400
        Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 12:00 -0700
        Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 12:00 -0700
          Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked George Neuner <gneuner2@comcast.net> - 2011-08-29 21:31 -0400
          Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-29 22:12 -0400
            Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-30 09:38 -0400
            Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-30 10:51 -0400
          Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Terje Mathisen <"terje.mathisen at tmsw.no"> - 2011-08-30 13:53 +0200
            Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-30 06:59 -0700
              Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-30 10:23 -0400
                Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked kenney@cix.compulink.co.uk - 2011-08-31 08:04 -0500
                Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-31 10:26 -0400
                Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked nmm1@cam.ac.uk - 2011-08-31 18:58 +0100
              Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked nmm1@cam.ac.uk - 2011-08-30 14:58 +0100
              Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Terje Mathisen <"terje.mathisen at tmsw.no"> - 2011-08-31 10:25 +0200
                Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-31 10:01 -0400
                Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-31 12:15 -0400
    Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 08:59 -0700

csiph-web