Very Weird Log

Discussion of EFnet's IRCDs (hybrid, ratbox, csircd)

Moderators: Website/Forum Admins, Software/IRCD Moderators

-wassup-
Posts: 103
Joined: Wed Aug 13, 2003 8:25 pm
Location: Middle East

Very Weird Log

Postby -wassup- » Fri Aug 22, 2003 11:20 am

okay this is waht i have had in my log file for about 12 days and i have no clue what is it :S
[2003/08/09 11.12] datagram received from unknown nameserver 207.218.192.26
[2003/08/09 11.15] datagram received from unknown nameserver 207.218.192.78
[2003/08/09 11.15] datagram received from unknown nameserver 207.218.192.26
[2003/08/09 11.24] datagram received from unknown nameserver 207.218.192.79
[2003/08/09 11.25] datagram received from unknown nameserver 207.218.192.26
[2003/08/09 11.26] datagram received from unknown nameserver 207.218.192.11
[2003/08/09 11.27] datagram received from unknown nameserver 207.218.192.73
[2003/08/09 11.28] datagram received from unknown nameserver 207.218.192.26
[2003/08/09 11.28] datagram received from unknown nameserver 207.218.192.27
[2003/08/09 11.29] datagram received from unknown nameserver 207.218.192.63

its been coming from 207.218.192.*. its from an ISP called ev1.net. could anyone enlighten me on what this could be?
Hwy
Posts: 66
Joined: Wed Jul 16, 2003 12:27 pm

Postby Hwy » Fri Aug 22, 2003 12:04 pm

I've seen things like that when people tried to exploit the old DNS spoofing bugs. This MIGHT be the same thing, I'm not sure offhand
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Postby munky » Fri Aug 22, 2003 12:42 pm

IIRC, ev1.net is a known spamhouse (or houses some spam hosts). google knows what i'm talking about.

it may be they are attempting to datamine your nameserver (get a list of all subdomains), and see if they can find any hosts with mail or finger or somesuch open, which they could possibly use to get usernames to spam.

of course, this is just a guess. i would try the arin contact and see what they say.
In God we trust,
Everyone else must have an X.509 certificate.
seiki

Re: Very Weird Log

Postby seiki » Sat Aug 23, 2003 2:28 pm

ev1.net is better known as rackshack.net, a fairly ghetto bargain-basement colocation facility.

-seiki
-wassup-
Posts: 103
Joined: Wed Aug 13, 2003 8:25 pm
Location: Middle East

Postby -wassup- » Sat Aug 23, 2003 6:43 pm

lol, and their internet sucks tbh....but why would such a thing appear in ircd.log of all things?
kaydiddy
Posts: 5
Joined: Thu Jan 08, 2004 5:18 am

heh

Postby kaydiddy » Thu Jan 08, 2004 11:54 am

Actually, ev1.net is known as the up and coming, quite large parent company of Rackshack.net, a ghetto basement *dedicated server* facility. They are not some hole in the wall, even though Rackshack basically is. EV1.Net sponsored major College Football bowl games this year.
User avatar
corrupt
Site Admin
Posts: 81
Joined: Wed Jul 02, 2003 1:08 pm
Location: Danville, KY
Contact:

Postby corrupt » Thu Jan 08, 2004 4:52 pm

That does not change the fact that they are still a known spamhouse.
Josh Baird
[corrupt]@EFNet
O: irc.choopa.net
kaydiddy
Posts: 5
Joined: Thu Jan 08, 2004 5:18 am

that which I see clearly, I see through the eyes of others

Postby kaydiddy » Fri Jan 09, 2004 6:56 am

Am I to presume you're a threat? Apparently you're not aware of the current state of the internet. Spam is everywhere. I say no more, troll.
User avatar
corrupt
Site Admin
Posts: 81
Joined: Wed Jul 02, 2003 1:08 pm
Location: Danville, KY
Contact:

Postby corrupt » Fri Jan 09, 2004 7:42 am

A troll? Hardly. Do us all a favor and remove your self from these forums before my trigger happy finger does the job for you.

Thanks.
Josh Baird

[corrupt]@EFNet

O: irc.choopa.net
prefect
Posts: 76
Joined: Mon Jul 14, 2003 6:25 pm
Location: Oslo

Re: that which I see clearly, I see through the eyes of othe

Postby prefect » Fri Jan 09, 2004 11:07 am

kaydiddy wrote:Am I to presume you're a threat? Apparently you're not aware of the current state of the internet. Spam is everywhere. I say no more, troll.


what
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Re: that which I see clearly, I see through the eyes of othe

Postby munky » Fri Jan 09, 2004 1:33 pm

prefect wrote:what


read kaydiddy's other thread in IRCD, who obviously seems to think he's smarter than everyone else, and everyone else is trying to demean him or threaten him.

as for ev1 being a spamhouse: search google for 'ev1.net spam', check the results from wired.com, spamcop.net, dshield.org, and mynetwatchman.com, among others. there are plenty of complaints about ev1 being a spamhouse. whether it's a colo facility or a "*dedicated server*" facility is besides the point, you still get your choice of OS on a machine that you have admin/root on.
In God we trust,

Everyone else must have an X.509 certificate.

Return to “IRCD”

Who is online

Users browsing this forum: No registered users and 2 guests