How do I find the UpStream provider of a Hosting company? - GoFuckYourself.com

pornguy · 09-30-2011, 05:43 AM

Need to find the upstream providers. Lots of hosts wont do anything about the piracy so might as well try the upstream..

Anyone??

AdultKing · 09-30-2011, 06:01 AM

In the case of cloudflare hosted sites, it's pretty difficult.

pornguy · 09-30-2011, 06:09 AM

Got to be a way and I dont think the pirate sites are using that yet. They want min hosting to get the job done.

AdultKing · 09-30-2011, 06:17 AM

Quote:

Originally Posted by pornguy

Got to be a way and I dont think the pirate sites are using that yet. They want min hosting to get the job done.

http://www.intporn.com/forums/ seems to be using cloudflare.

Quote:

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5 <<>> intporn.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 930
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;intporn.com. IN A

;; ANSWER SECTION:
intporn.com. 30 IN A 85.17.174.200
intporn.com. 30 IN A 85.17.174.246

;; AUTHORITY SECTION:
intporn.com. 151791 IN NS ken.ns.cloudflare.com.
intporn.com. 151791 IN NS dawn.ns.cloudflare.com.

pornguy · 09-30-2011, 06:23 AM

How did you get that info. where can I find it.

AdultKing · 09-30-2011, 06:26 AM

if you have shell access to a *nix box just do a whois on the domain, then do a dig on all relevant domain names, ip's etc, then you can traceroute and keep working out what's what.

eg: dig intporn.com

will give you

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5 <<>> intporn.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 930
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;intporn.com. IN A

;; ANSWER SECTION:
intporn.com. 30 IN A 85.17.174.200
intporn.com. 30 IN A 85.17.174.246

;; AUTHORITY SECTION:
intporn.com. 151791 IN NS ken.ns.cloudflare.com.
intporn.com. 151791 IN NS dawn.ns.cloudflare.com.

then

whois 85.17.174.246

gives you

inetnum: 85.17.174.0 - 85.17.174.255
netname: LEASEWEB
descr: LeaseWeb
descr: P.O. Box 93054
descr: 1090BB AMSTERDAM
descr: Netherlands
descr: www.leaseweb.com
remarks: Please send email to "[email protected]" for complaints
remarks: regarding portscans, DoS attacks and spam.
remarks: INFRA-AW
country: NL
admin-c: LSW1-RIPE
tech-c: LSW1-RIPE
status: ASSIGNED PA
mnt-by: OCOM-MNT
source: RIPE # Filtered

person: RIP Mean
address: P.O. Box 93054
address: 1090BB AMSTERDAM
address: Netherlands
phone: +31 20 3162880
fax-no: +31 20 3162890
abuse-mailbox: [email protected]
nic-hdl: LSW1-RIPE
mnt-by: OCOM-MNT
source: RIPE # Filtered

% Information related to '85.17.0.0/16AS16265'

route: 85.17.0.0/16
descr: LEASEWEB
origin: AS16265
remarks: LeaseWeb
mnt-by: OCOM-MNT
source: RIPE # Filtered

looking at the TTL on the A records and the long TTL on the NS records they could be doing some kind of redirect to cloudflare from leaseweb, I'm not sure if Cloudflare is associated with Leaseweb. All looks a bit odd to me.

pornguy · 09-30-2011, 06:27 AM

OK thanks

Bladewire · 09-30-2011, 06:29 AM

Quote:

Originally Posted by pornguy

How did you get that info. where can I find it.

I like to use robtex for detailed info.

Here is a graph of the upstream info for intporn.com and here is some shared hosting info for them.

Zverka · 09-30-2011, 06:29 AM

http://whois.domaintools.com/intporn.com

tab Server Stats / IP address

http://whois.domaintools.com/85.17.174.200

So upstream is Leaseweb ;)

pornguy · 09-30-2011, 07:10 AM

thanks guys. I will put this to good use.

09-30-2011, 05:43 AM	#1
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	How do I find the UpStream provider of a Hosting company? Need to find the upstream providers. Lots of hosts wont do anything about the piracy so might as well try the upstream.. Anyone?? __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

09-30-2011, 06:09 AM	#3
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	Got to be a way and I dont think the pirate sites are using that yet. They want min hosting to get the job done. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

09-30-2011, 06:23 AM	#5
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	How did you get that info. where can I find it. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

09-30-2011, 06:26 AM	#6
AdultKing Raise Your Weapon Industry Role: Join Date: Jun 2003 Location: Outback Australia Posts: 15,601	if you have shell access to a nix box just do a whois on the domain, then do a dig on all relevant domain names, ip's etc, then you can traceroute and keep working out what's what. eg: dig intporn.com will give you ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5 <<>> intporn.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 930 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0 ;; QUESTION SECTION: ;intporn.com. IN A ;; ANSWER SECTION: intporn.com. 30 IN A 85.17.174.200 intporn.com. 30 IN A 85.17.174.246 ;; AUTHORITY SECTION: intporn.com. 151791 IN NS ken.ns.cloudflare.com. intporn.com. 151791 IN NS dawn.ns.cloudflare.com. then whois 85.17.174.246 gives you inetnum: 85.17.174.0 - 85.17.174.255 netname: LEASEWEB descr: LeaseWeb descr: P.O. Box 93054 descr: 1090BB AMSTERDAM descr: Netherlands descr: www.leaseweb.com remarks: Please send email to "[email protected]" for complaints remarks: regarding portscans, DoS attacks and spam. remarks: INFRA-AW country: NL admin-c: LSW1-RIPE tech-c: LSW1-RIPE status: ASSIGNED PA mnt-by: OCOM-MNT source: RIPE # Filtered person: RIP Mean address: P.O. Box 93054 address: 1090BB AMSTERDAM address: Netherlands phone: +31 20 3162880 fax-no: +31 20 3162890 abuse-mailbox: [email protected] nic-hdl: LSW1-RIPE mnt-by: OCOM-MNT source: RIPE # Filtered % Information related to '85.17.0.0/16AS16265' route: 85.17.0.0/16 descr: LEASEWEB origin: AS16265 remarks: LeaseWeb mnt-by: OCOM-MNT source: RIPE # Filtered looking at the TTL on the A records and the long TTL on the NS records they could be doing some kind of redirect to cloudflare from leaseweb, I'm not sure if Cloudflare is associated with Leaseweb. All looks a bit odd to me. Last edited by AdultKing; 09-30-2011 at 06:30 AM..*

09-30-2011, 06:27 AM	#7
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	OK thanks __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

09-30-2011, 06:01 AM	#2
AdultKing Raise Your Weapon Industry Role: Join Date: Jun 2003 Location: Outback Australia Posts: 15,601	In the case of cloudflare hosted sites, it's pretty difficult.

09-30-2011, 06:29 AM	#9
Zverka Confirmed User Join Date: Jun 2005 Location: EU Posts: 278	http://whois.domaintools.com/intporn.com tab Server Stats / IP address http://whois.domaintools.com/85.17.174.200 So upstream is Leaseweb ;) __________________

09-30-2011, 07:10 AM	#10
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	thanks guys. I will put this to good use. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!