64.105.235.252 is trying to hack me - GoFuckYourself.com

HQ · 08-22-2002, 12:54 PM

Whoever is behind this IP, 64.105.235.252, is trying to hack me. What's the best way to look up info on an IP?

HQ · 08-22-2002, 12:54 PM

63.225.201.208 too.

JFPdude · 08-22-2002, 12:55 PM

whois ip.num.ber

pr0 · 08-22-2002, 12:55 PM

He's probably watching you post asking this question & laughing

Gary · 08-22-2002, 12:55 PM

Ya, thats me. sorry dude, i'll stop

JFPdude · 08-22-2002, 12:56 PM

whois 64.105.235.252
Covad Communications (NETBLK-COVAD-IP-1-NET)
3420 Central Expressway
Santa Clara, CA 95051
US

Netname: COVAD-IP-1-NET
Netblock: 64.105.0.0 - 64.105.255.255
Maintainer: CVAD

Domain System inverse mapping provided by:

NS1.COVAD.NET 66.134.199.11
NS2.COVAD.NET 66.134.199.12

HQ · 08-22-2002, 12:56 PM

Quote:

Originally posted by Gary
Ya, thats me. sorry dude, i'll stop

NP, thanks for all that porn you uploaded!

Chris R · 08-22-2002, 12:57 PM

Covad Communications (NETBLK-COVAD-IP-1-NET)
3420 Central Expressway
Santa Clara, CA 95051
US

Netname: COVAD-IP-1-NET
Netblock: 64.105.0.0 - 64.105.255.255
Maintainer: CVAD

Coordinator:
Boggan, Rick (RB1873-ARIN) [email protected]
(408) 616-6766 (FAX) (408) 616-6501

Domain System inverse mapping provided by:

NS1.COVAD.NET 66.134.199.11
NS2.COVAD.NET 66.134.199.12

ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE

for abuse issues, please contact [email protected]
Reassignment information for this block of addresses can
be found at rwhois://rwhois.laserlink.net:4321/

Record last updated on 06-Jun-2002.
Database last updated on 21-Aug-2002 20:01:34 EDT.

quiet · 08-22-2002, 12:57 PM

Server used for this query: [ whois.arin.net ]

Covad Communications (NETBLK-COVAD-IP-1-NET)
3420 Central Expressway
Santa Clara, CA 95051
US

Netname: COVAD-IP-1-NET
Netblock: 64.105.0.0 - 64.105.255.255
Maintainer: CVAD

Coordinator:
Boggan, Rick (RB1873-ARIN) [email protected]
(408) 616-6766 (FAX) (408) 616-6501

Domain System inverse mapping provided by:

NS1.COVAD.NET 66.134.199.11
NS2.COVAD.NET 66.134.199.12

ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE

for abuse issues, please contact [email protected]

JFPdude · 08-22-2002, 12:57 PM

whois 63.225.201.208
U S WEST Communications Services, Inc (NETBLK-USW-INTERACT99)
600 Stinson Blvd NE
Minneapolis, MN 55413
US

Netname: USW-INTERACT99
Netblock: 63.224.0.0 - 63.231.255.255
Maintainer: USW

Coordinator:
U S WEST ISOps (ZU24-ARIN) [email protected]
612-664-4689

Domain System inverse mapping provided by:

NS1.USWEST.NET 204.147.80.5
NS2.DNVR.USWEST.NET 206.196.128.1

Cogitator · 08-22-2002, 12:58 PM

I use www.samspade.org

Click there and take a look

Fletch XXX · 08-22-2002, 12:58 PM

<h3>BaaaZZZZaaam!!!!!</h3>

HQ · 08-22-2002, 12:58 PM

Quote:

Originally posted by JFPdude
whois ip.num.ber

Does not work for me.

No match for "64.105.235.252".

TheFLY · 08-22-2002, 12:58 PM

This topic cracks me up...

Sincerely,

204.53.21.121

Auslander · 08-22-2002, 12:59 PM

Quote:

Originally posted by Cogitator
I use www.samspade.org

Click there and take a look

Spade rocks!

HQ · 08-22-2002, 12:59 PM

Quote:

Originally posted by Cogitator
I use www.samspade.org

Click there and take a look

Kick-ass!

"for abuse issues, please contact [email protected]"

HQ · 08-22-2002, 01:14 PM

And this mother fucker is a hitbot: 212.77.204.34 Crazy what you find in your error logs.

salsbury · 08-22-2002, 02:04 PM

what's he trying to hack you with?

boldy · 08-22-2002, 02:07 PM

Quote:

Originally posted by salsbury
what's he trying to hack you with?

I think they do it just for fun, my servers are under attack 24/7 by some dumbasses in Dubai. my servers are double firewalled ... Checkpoint and Astaro ... good luck Dubiaian

fuckers

-=HOAX=- · 08-22-2002, 02:23 PM

nmap is a good way to snoop around in what he's got going on...

boldy · 08-22-2002, 02:28 PM

Quote:

Originally posted by -=HOAX=-
nmap is a good way to snoop around in what he's got going on...

nmap 4 life ... decoy scanning and shit ...

HQ · 08-22-2002, 04:35 PM

Quote:

Originally posted by salsbury
what's he trying to hack you with?

Just searching for well-known files on my system. I think they were windows too. Barking up the wrong tree there!

-=HOAX=- · 08-22-2002, 05:05 PM

Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/root.exe
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/MSADC/root.exe
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/c/winnt/system32/cmd.exe
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/d/winnt/system32/cmd.exe
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..%5c../winnt/system32/cmd
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/_vti_bin/..%5c../..%5c../..%5c../w
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/_mem_bin/..%5c../..%5c../..%5c../w
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/msadc/..%5c../..%5c../..%5c/..Á^.
[Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..Á^\../winnt/system32/cmd
[Wed Aug 21 12:40:37 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..À¯../winnt/system32/cmd.
[Wed Aug 21 12:40:37 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..Á?../winnt/system32/cmd.
[Wed Aug 21 12:40:43 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..%5c../winnt/system32/cmd
[Wed Aug 21 12:40:43 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..%2f../winnt/system32/cmd

like this...

Libertine · 08-22-2002, 05:11 PM

It's nothing personal. He's probably scanning a few thousand servers to get a few win IIS ones which still have a major security hole.
You can get full control over a few hundred servers in an hour or so that way.

salsbury · 08-22-2002, 05:13 PM

its probably not even a person, we have that shit in our logs all over the place. that's how a particular worm propogates.

of course, the person running the server should be notified, but chances are, at this point, they don't care to fix it. sadly.

HQ · 08-23-2002, 11:05 AM

I wonder what "activate.php" is for? What script is this guy trying to exploit?

08-22-2002, 12:54 PM	#1
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	64.105.235.252 is trying to hack me Whoever is behind this IP, 64.105.235.252, is trying to hack me. What's the best way to look up info on an IP?

08-22-2002, 12:55 PM	#4
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088	He's probably watching you post asking this question & laughing __________________ __________ Loadedca$h - get sum! - Revengebucks - mmm rebills! - webair (gotz sErVrz)

08-22-2002, 12:55 PM	#5
Gary Confirmed User Join Date: Aug 2001 Location: Kimmykims couch Posts: 6,110	Ya, thats me. sorry dude, i'll stop __________________ Up to 35$ per join...!

08-22-2002, 12:57 PM	#9
quiet we'll miss you our friend. RIP Industry Role: Join Date: Sep 2001 Location: Fernie, BC Posts: 25,115	Server used for this query: [ whois.arin.net ] Covad Communications (NETBLK-COVAD-IP-1-NET) 3420 Central Expressway Santa Clara, CA 95051 US Netname: COVAD-IP-1-NET Netblock: 64.105.0.0 - 64.105.255.255 Maintainer: CVAD Coordinator: Boggan, Rick (RB1873-ARIN) [email protected] (408) 616-6766 (FAX) (408) 616-6501 Domain System inverse mapping provided by: NS1.COVAD.NET 66.134.199.11 NS2.COVAD.NET 66.134.199.12 ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE for abuse issues, please contact [email protected] __________________ we'll miss you our friend. RIP

08-22-2002, 12:58 PM	#11
Cogitator Confirmed User Join Date: Feb 2002 Location: Florida Posts: 672	I use www.samspade.org Click there and take a look __________________ - this space intentionally left blank -

08-22-2002, 12:55 PM	#3
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	whois ip.num.ber

08-22-2002, 12:56 PM	#6
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	whois 64.105.235.252 Covad Communications (NETBLK-COVAD-IP-1-NET) 3420 Central Expressway Santa Clara, CA 95051 US Netname: COVAD-IP-1-NET Netblock: 64.105.0.0 - 64.105.255.255 Maintainer: CVAD Domain System inverse mapping provided by: NS1.COVAD.NET 66.134.199.11 NS2.COVAD.NET 66.134.199.12

08-22-2002, 12:57 PM	#8
Chris R Confirmed User Join Date: May 2001 Location: Baltimore, MD USA Posts: 1,151	Covad Communications (NETBLK-COVAD-IP-1-NET) 3420 Central Expressway Santa Clara, CA 95051 US Netname: COVAD-IP-1-NET Netblock: 64.105.0.0 - 64.105.255.255 Maintainer: CVAD Coordinator: Boggan, Rick (RB1873-ARIN) [email protected] (408) 616-6766 (FAX) (408) 616-6501 Domain System inverse mapping provided by: NS1.COVAD.NET 66.134.199.11 NS2.COVAD.NET 66.134.199.12 ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE for abuse issues, please contact [email protected] Reassignment information for this block of addresses can be found at rwhois://rwhois.laserlink.net:4321/ Record last updated on 06-Jun-2002. Database last updated on 21-Aug-2002 20:01:34 EDT.

08-22-2002, 12:58 PM	#12
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	<h3>BaaaZZZZaaam!!!!!</h3> __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

08-22-2002, 12:58 PM	#14
TheFLY So Fucking Banned Join Date: Jan 2001 Location: http://www.thefly.net/ --- Quit your job and live off steady traffic. Posts: 11,856	This topic cracks me up... Sincerely, 204.53.21.121

08-22-2002, 01:14 PM	#17
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	And this mother fucker is a hitbot: 212.77.204.34 Crazy what you find in your error logs.

08-22-2002, 02:04 PM	#18
salsbury Confirmed User Join Date: Feb 2002 Location: Seattle Posts: 1,070	what's he trying to hack you with? __________________

08-22-2002, 02:23 PM	#20
-=HOAX=- Confirmed User Join Date: Dec 2001 Location: CrackYaMental Posts: 4,365	nmap is a good way to snoop around in what he's got going on... __________________ Insert Value Here.

08-22-2002, 05:05 PM	#23
-=HOAX=- Confirmed User Join Date: Dec 2001 Location: CrackYaMental Posts: 4,365	Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/root.exe [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/MSADC/root.exe [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/c/winnt/system32/cmd.exe [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/d/winnt/system32/cmd.exe [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..%5c../winnt/system32/cmd [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/_vti_bin/..%5c../..%5c../..%5c../w [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/_mem_bin/..%5c../..%5c../..%5c../w [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/msadc/..%5c../..%5c../..%5c/..Á^. [Wed Aug 21 12:40:36 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..Á^\../winnt/system32/cmd [Wed Aug 21 12:40:37 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..À¯../winnt/system32/cmd. [Wed Aug 21 12:40:37 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..Á?../winnt/system32/cmd. [Wed Aug 21 12:40:43 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..%5c../winnt/system32/cmd [Wed Aug 21 12:40:43 2002] [error] [client 66.28.236.25] File does not exist: /usr/local/www/data/scripts/..%2f../winnt/system32/cmd like this... __________________ Insert Value Here.

08-22-2002, 05:11 PM	#24
Libertine sex dwarf Join Date: May 2002 Posts: 17,860	It's nothing personal. He's probably scanning a few thousand servers to get a few win IIS ones which still have a major security hole. You can get full control over a few hundred servers in an hour or so that way.

08-22-2002, 05:13 PM	#25
salsbury Confirmed User Join Date: Feb 2002 Location: Seattle Posts: 1,070	its probably not even a person, we have that shit in our logs all over the place. that's how a particular worm propogates. of course, the person running the server should be notified, but chances are, at this point, they don't care to fix it. sadly. __________________

08-23-2002, 11:05 AM	#26
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	I wonder what "activate.php" is for? What script is this guy trying to exploit?