Check Website
Inclusion Status
It is currently Wed Nov 22, 2017 9:09 am

All times are UTC




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: Dear HostNOC - your servers are attacking a friend!
PostPosted: Sat Dec 10, 2011 5:54 am 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6001
Dear HostNOC - your servers are attacking a friend!

Quote:
I am assisting a friend at present, with an issue involving IPs constantly attacking his servers, and noted during one of his recent updates, that alot of them were HostNOC - turns out, there's quite the list of them (ignoring the others from known criminal networks). All are RFI etc, and all are already being blocked by ZBBlock (a script written by my friend Zaphod).

The problem here, is HostNOCs (aka Burst.Net) lack of ability in both detecting malicious traffic originating inside their own network, and the sheer amount of frustration in dealing with their abuse department, both via e-mail, and via phone.

I'm in the midst of determining whether these are dedicated criminal servers, or compromised servers (I'm already aware of several black hat "hosts" that have space within HostNOC/Burst IP space, most of course, being run by kids that frequent hackforums.net and the like), but in the meantime, for those of you that the list of IPs and see what they're doing, the following is the log data for them;


http://hphosts.blogspot.com/2011/12/dea ... cking.html

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Thu Jan 05, 2012 10:56 pm 
Offline
User avatar

Joined: Mon Oct 05, 2009 1:57 pm
Posts: 497
Location: Kent, UK
The attacks were gone over the Christmas period then today they return. Makes me think the attacker has western beliefs.

Code:
Host: 96-9-149-70.static.hostnoc.net
IP: 96.9.149.70
option=com_artist&idgalery=-1%2F%2A%2A%2FuNiOn%2F%2A%2A%2FsEleCt%2F%2A%2A%2F1%2C2%2C3%2C0x33633273366962%2C5%2C6%2C7%2C8%2C9%2F%2A%2A%2FfRoM%2F%2A%2A%2Fjos_users--



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Sat Jan 07, 2012 12:06 am 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6001
Cheers :)

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Sat Feb 11, 2012 9:56 pm 
Offline
User avatar

Joined: Mon Oct 05, 2009 1:57 pm
Posts: 497
Location: Kent, UK
Just to let you know Steven, the Hostnoc attacks are now here and there, maybe one in a week or so, which I can live with as they get blocked anyway :D



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Sat Feb 11, 2012 10:02 pm 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6001
Oks cheers :)

Keep sending me the logs of those attacking your site if possible :)

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Fri Feb 17, 2012 11:47 pm 
Offline
User avatar

Joined: Mon Oct 05, 2009 1:57 pm
Posts: 497
Location: Kent, UK
Sure, will do so when I next see one :)



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Thu Mar 08, 2012 2:19 pm 
Offline
User avatar

Joined: Mon Oct 05, 2009 1:57 pm
Posts: 497
Location: Kent, UK
HostNOC back. Not sure what they are upto with this one!

Code:
Host: 64-191-13-150.static.hostnoc.net
IP: 64.191.13.150
Query: dgd=1
Reconstructed URL: http:// issviews.com /?dgd=1


Then we have these two, Obvious spam intent.

Code:
Host: 184-22-193-137.static.hostnoc.net
IP: 184.22.193.137
Referer: http://mickeyatkins923.blogspace.fr/3599405/greatest-feminine-libido-enhancer/

Host: 184-22-193-135.static.hostnoc.net
IP: 184.22.193.135
Referer: http://samuelstafford.shareblogs.net/the-first-blog-b1/behave-like-youre-dating-once-more-and-return-the-spark-in-your-marriage-b1-p5.htm



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Dear HostNOC - your servers are attacking a friend!
PostPosted: Thu Mar 08, 2012 2:41 pm 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6001
Looks like backlink spam, but I'll take a deeper look, cheers :)

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
hpHosts and hpHosts Online are copyright © Malwarebytes Corp - All Rights Reserved

Powered by phpBB © 2000-2009 phpBB Group