You are viewing a single comment's thread.

view the rest of the comments →

bolus ago

Still want to see how you tied this to waltham...I'm trying, but missing something. When you get a chance, can you share the evidence on archive.org, or sli.mg?

Archive of the /24 registry, for example, goes to Delaware. Hidden by cachenet:

http://archive.is/OIgtQ

And the arin registration for the ip of the last hop off a tracert to them shows "trans-media" and passes through an att-cable address :

104-160-16-2.cable.attcabletv.com

http://archive.is/kSwyC

Which isn't telling of anything in particular, but i wouldn't expect dyncorp to run out of an apparent consumer-grade connection.

Still looking, though, this is interesting stuff.

Ha!

And the geo location of the last hop before your attackers subnet is in Dublin.

Funny business.

RebelSkum ago

Waltham was what appeared in Google Analytics as the traffic source for that page during the initial attack, but is now listed as (not set): http://imgur.com/a/kCvbs

All "users" with avg time of 0 were attempts on the page. Tell me what you think of those locations.

bolus ago

dunno about those locations - i would instantly suspect a botnet (whether corporate "professional" or underground "hacker") and a coordinated ddos.

the link i posted is really relevant - http://archive.is/OIgtQ - it shows that the /24 block of your first IP addy listed (162.212.171.0/24) is associated with a company called CachedNet. it appears to be the kind of company which a professional botnet could hide behind. (i'll follow up with some info about them...need to dig to be sure...but spamhaus thinks it's leased out to spammers: http://archive.is/rzKYp not ruling out dyn, but definitely blurring the lines of ownership)

then, i ran a tracert to your 162.212.171.37, and it looked like this: https://i.sli.mg/ST4JEg.gif

i use a site called mxtoolbox. it's an amazing resource for ip based information.

see the second to last hop? 104.160.16.2 resolves as an att cable modem node. this indicates that the .37 address is somewhere in a consumer-grade network, not a real corporate network.

I know, I KNOW that based on the stories/reports/info posted about Dyn's history that they are involved in the pizzagate/pedocracy story...but my gut tells me that the spamming/ddos you're experiencing is made to look like Dyn, and not really from them. (now we're stuck in the princess bride conundrum. you can't trust the IP in front of me, and you clearly cannot trust the IP in front of Dyn...)

safe assumption: both bad.

hth, keep Dyn on the list, but they're not alone.

RebelSkum ago

You sir, might be able to help with this: https://docs.google.com/spreadsheets/d/1g8-VfzrdVemShGVS2QbCoShVgUABn2AYFC6TLVlf0Sk/edit?usp=sharing

Started digging into CachedNet LLC more too, and I did find that a Kristian Hokka has an address at [email protected]

Also found this interesting link regarding them being involved with an inaccessible VPN: https://www.privateinternetaccess.com/forum/discussion/18802/new-zealand-vpn-not-working . It was listed as "New Zealand" but was found to be the same folks from Wilmington, DE.

bolus ago

Oh, and this needs to be stressed. Do not launch any portscans or assault of any kind on any of the cachednet ip addresses.

1) each individual node is housed in compromised networks, you'll only really affect one or two people (innocent bystanders? ) at a time.

2) you know they're expecting it and will be logging inbound traffic. Malicious honey pots, potential legal issues for anyone involved.

Just like our older refutation of violence post, it should be published that we refuse to engage in any type of cyber warfare activity. Ddos spammers, we are not.

RebelSkum ago

mos def

Definitely not work poking the beast outside of legal means. Keep it white hat, folks.

DarkMath ago

I'm curious as well how you tied this attack to Waltham MA. That's real important. Did you take a screen shot when it first happened? Without that this Waltham evidence can't be trusted. Sorry.

bolus ago

well, it's showing delaware because that's where the LLC is located. if you trace out all of the nodes, they're global. (which is why they're seeing the same thing in NZ) i found hokka too, he's in finland or denmark, or one of those stupid nordic states, relatively untouchable. i'm sure they use a dynamic dns registration...it's 101% likely that the .37 address you see hitting you is an infected computer/dvr/modem/router just hanging out in some unsuspectiong doofus' home, and they can't understand why their internet is going so slow tonight.

i'd love to help with your spreadsheet, but i'm not sure i trust you and google docs from unknown sources are a great way to spread malware. (hope you understand)

can you give me a screenshot of what you're looking at through some other means? static document, or maybe even just describe what you've got on your hands? (msg me if you are worried about doxxing, or black out the really sensitive bits)