2006-11-18 Woozle tech log - Revision history

Woozle: tech logs -> tech notes; hypertwins -> hypertwins network

2007-04-17T00:53:30Z

tech logs -> tech notes; hypertwins -> hypertwins network

← Older revision		Revision as of 00:53, 17 April 2007
Line 1:		Line 1:
	==Suspicious redirect==		==Suspicious redirect==
	[[category:tech ~~logs~~]][[category:hypertwins]]I noticed that when I tried to load this URL:		[[category:tech notes]][[category:hypertwins network]]I noticed that when I tried to load this URL:

	http://www.theage.com.au/news/world/spy-says-alqaeda-tricked-us-into-war/2006/11/17/1163266782059.html		http://www.theage.com.au/news/world/spy-says-alqaeda-tricked-us-into-war/2006/11/17/1163266782059.html

Woozle: /* traceroute */ googling

2006-11-18T16:42:47Z

traceroute: googling

← Older revision		Revision as of 16:42, 18 November 2006
Line 86:		Line 86:
	:13 vl1.car02.dllstx2.theplanet.com (12.96.160.12) 45.374 ms 134.767 ms 162.767 ms		:13 vl1.car02.dllstx2.theplanet.com (12.96.160.12) 45.374 ms 134.767 ms 162.767 ms
	:14 96.f6.ead8.static.theplanet.com (216.234.246.150) 55.133 ms 43.531 ms 43.024 ms		:14 96.f6.ead8.static.theplanet.com (216.234.246.150) 55.133 ms 43.531 ms 43.024 ms
			===Googling===
			A quick [[google:216.234.246.150\|search]] finds a lot of pages mentioning this IP address.
			* It seems to be a DNS server used by the Windows worm [http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=40491 Win32.Buchon.B]
			* A number of other domains (e.g. foo.com) resolve to that IP, so it may be a web server configured for [[name-based hosting]]; apparently, any unrecognized domain gets redirected to 0.0.0.0

Woozle: /* Suspicious redirect */ tracert

2006-11-18T14:46:38Z

Suspicious redirect: tracert

@@ Line 44: / Line 44: @@
 |}
 Who the freep is 216.234.246.150, and why am I getting redirected to them?? It's apparently someone who gets their hosting through ThePlanet:
+===whois===
 '''woozle@gonzo''':~$ whois 216.234.246.150
@@ Line 69: / Line 69: @@
   RegDate:    1999-08-31
   Updated:    2000-10-10

Woozle at 14:43, 18 November 2006

2006-11-18T14:43:54Z

New page

==Suspicious redirect==
[[category:tech logs]][[category:hypertwins]]I noticed that when I tried to load this URL:

http://www.theage.com.au/news/world/spy-says-alqaeda-tricked-us-into-war/2006/11/17/1163266782059.html

I got redirected to http://0.0.0.0, regardless of the exact path or whether there was a www. in the domain.

So I did some tests, and found that it was only on one computer. Then I did a wget on each computer, to compare the results:
{|
|-
| valign=top |
'''woozle@rizzo''':~$ wget http://theage.com.au
--09:30:01-- http://theage.com.au/
=> `index.html'
Resolving theage.com.au... 203.26.51.42
Connecting to theage.com.au|203.26.51.42|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.theage.com.au/ [following]
--09:30:01-- http://www.theage.com.au/
=> `index.html'
Resolving www.theage.com.au... {{hilite|203.26.51.42}}
Reusing existing connection to theage.com.au:80.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
...
09:30:03 (100.89 KB/s) - `index.html' saved [134981]
| valign=top |
'''woozle@gonzo''':~$ wget http://theage.com.au
--09:34:02-- http://theage.com.au/
=> `index.html'
Resolving theage.com.au... 203.26.51.42
Connecting to theage.com.au|203.26.51.42|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.theage.com.au/ [following]
--09:34:02-- http://www.theage.com.au/
=> `index.html'
Resolving www.theage.com.au... {{hilite|216.234.246.150}}
Connecting to www.theage.com.au|216.234.246.150|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://0.0.0.0/ [following]
--09:34:02-- http://0.0.0.0/
=> `index.html'
Connecting to 0.0.0.0:80... failed: Connection refused.
|}
Who the freep is 216.234.246.150, and why am I getting redirected to them?? It's apparently someone who gets their hosting through ThePlanet:

'''woozle@gonzo''':~$ whois 216.234.246.150

OrgName: ThePlanet.com Internet Services, Inc.
OrgID: TPCM
Address: 1333 North Stemmons Freeway
Address: Suite 110
City: Dallas
StateProv: TX
PostalCode: 75207
Country: US

ReferralServer: rwhois://rwhois.theplanet.com:4321

NetRange: 216.234.224.0 - 216.234.255.255
CIDR: 216.234.224.0/19
NetName: THEPLANET-BLK-1
NetHandle: NET-216-234-224-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.THEPLANET.COM
NameServer: NS2.THEPLANET.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1999-08-31
Updated: 2000-10-10