Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
| Message-ID | <4E5BE1EA.7030006@SPAM.comp-arch.net> (permalink) |
|---|---|
| Date | 2011-08-29 12:00 -0700 |
| From | "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> |
| Organization | comp-arch.net |
| Newsgroups | comp.arch |
| Subject | Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked |
| References | <4E5AFE48.6050400@SPAM.comp-arch.net> <G%D6q.3306$qy6.648@newsfe07.iad> <4E5BB757.3020009@SPAM.comp-arch.net> <oiP6q.1932$sX1.1300@newsfe06.iad> |
On 8/29/2011 9:40 AM, EricP wrote: > Andy "Krazy" Glew wrote: >> On 8/28/2011 8:49 PM, EricP wrote: >>> Andy "Krazy" Glew wrote: >>>> >>>> But I also found another website, waboba.info, that seems to be a >>>> clone of comp-arch.net. >>> >>> Hmmm... did a nslookup on waboba.info and got IP 69.163.174.83 >>> which is the same as semipublic.comp-arch.net >>> >>> Looked that up and it reports as semipublic.comp-arch.net >>> located in the California, city BREA. >>> http://ip-address-lookup-v4.com/lookup.php?ip=69.163.174.83 >>> >>> Eric >> >> Interesting. >> >> I had already done the whois. >> >> But I had not thought to do the nslookup. >> >> (I suppose the times that I could see differences between my site and >> the other site may have just been caching effects.) >> >> Now, why would somebody direct THEIR site to MY comp-arch.net site? >> What's the advantage in that? >> >> The suspicious part of me suspects prepping for something nefarious. >> >> (Of course, it might always be a DNS takeover, resulting in MY site >> being directed to HIS. ... No, doesn't seem to be, since that is the >> only site that I pay for a "unique IP" on (Dreamhost doesn't do static >> IPs), and that is what Dreamhost, accessed across HTTPS, reports. I >> suppose it is possible that they have taken over Dreamhost. ) > > I figured someone did a typo entering the IP address for > waboba.info and accidentally pointed their name at your server. > I suppoose an email to biuro@tootu.pl or their host > dns@home.pl would resolve it. > > Translating their website http://tootu.pl > > A Waboba appears to be toy like a frisbee or something. > "The only ball that bounces off the water" > http://translate.google.ca/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=pl&tl=en&u=tootu.pl&act=url > > > Their hosting site is: > http://translate.google.ca/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=pl&tl=en&u=home.pl&act=url > > > Eric I was beginning to think that this was innocuous "Never ascribe to malice what can be attributed to stupidity/accident". However, worrying about malice is good - because fixing malice is urgent, whereas fixing an accidental error is less urgent. --- I find it interesting that DNS does not have a mechanism to ensure that domains and IP addresses are consistent. E.g. a digital signature/hash including both, made with a private key corresponding to a public key posted in whois.
Back to comp.arch | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-28 19:49 -0700
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked EricP <ThatWouldBeTelling@thevillage.com> - 2011-08-28 23:32 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked EricP <ThatWouldBeTelling@thevillage.com> - 2011-08-28 23:49 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 08:59 -0700
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked EricP <ThatWouldBeTelling@thevillage.com> - 2011-08-29 12:40 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 12:00 -0700
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 12:00 -0700
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked George Neuner <gneuner2@comcast.net> - 2011-08-29 21:31 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-29 22:12 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-30 09:38 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-30 10:51 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Terje Mathisen <"terje.mathisen at tmsw.no"> - 2011-08-30 13:53 +0200
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-30 06:59 -0700
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-30 10:23 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked kenney@cix.compulink.co.uk - 2011-08-31 08:04 -0500
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-31 10:26 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked nmm1@cam.ac.uk - 2011-08-31 18:58 +0100
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked nmm1@cam.ac.uk - 2011-08-30 14:58 +0100
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Terje Mathisen <"terje.mathisen at tmsw.no"> - 2011-08-31 10:25 +0200
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-31 10:01 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked Anne & Lynn Wheeler <lynn@garlic.com> - 2011-08-31 12:15 -0400
Re: Somewhat off-topic: comp-arch.net cloned, possibly hacked "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-08-29 08:59 -0700
csiph-web