Some strange comments

1. Some strange comments

   #1

   
   
   Feb 1, 2006 22:21
   Link: [1732#11716|text]
   XP: [  +    -   ]   ( 0 ) aidon sucks dick ha ha
   [ Reply ][ Edit ] 10.119.5.181
   

   
   This was posted under "Hey Cool, an ice age". The IP suggest it is posted from somewhere inside the LAN in which Strolen's server is placed.
   
   Suggestions:
   Perhaps another server admin posted it using his own server as a proxy?
   Perhaps someone faked the IP? (10.x.x.x addresses are popular to fake)
   Perhaps someone has hacked the server?
   
   He also posted a question from the same IP. The question was legitimate, so I let it be.

2. Re: Some strange comments

   #2

   The user wildcorn also use a 10.x.x.x address. 10.41.78.104 for instance. He has posted in the linux thread and by scanning his posts I get "open source elitist" vibes. I would not expect this behaviour from him, even though he probably fakes his IP.

3. Re: Some strange comments

   #3

   If you are going to fake your address, are you elite enough to randomize it everytime or stick with a static 'faked' Ip? My experience is usually a static IP. ?

4. Re: Some strange comments

   #4

   Depends on the software you use. I have seen programs promising gold and jewellery, but they seldom deliver. Static IP would be the most common I guess. Personally I never fake my IP, except that I use proxies from time to time.
   
   Could it be that your service provider, the one hosting your server, shows all IPs from clients and servers under their "wing" as an internal LAN address? the 10.0+ range and the 192.168.0+ range is reserved for local area networks, just as 127 is reserved for localhost.
   
   TCP/IP addresses reserved for 'private' networks are:
   
   10.0.0.0       to     10.255.255.255
   172.16.0.0     to     172.31.255.255
   192.168.0.0    to     192.168.255.255
   
   and as of July 2001
   
   169.254.0.0    to     169.254.255.255 rfc
   
    
   
   These are invalid addresses on the internet. Routers don't route them.

5. Re: Some strange comments

   #5

   I was so curious about this that I checked it out further. I sent a pm to wildcorn, and this is what he replied:
   
   

   Sure I'm posting from a machine at A.B.B Switzerland, research department. However, I think your. knowledge of IP is misguiding you. Heres a primer of what I know:
   
   192.*.*.* is an unroutable address, typically used within internal lans.
   Numbers greater than 128 are typically used by class D routers
   numbers greater than 64 are typically used by class C routers
   numbers greater than 32 are used by class B
   numbers greater than 16 are used by class A
   
   A 10.*.*.* address is routable, but it sort of means that the person sending messages through it is right connected to a main internet traffic hub, perhaps a large company or national router. Or something like that. I didn't pay a whole lot of attention to it. I can tell you that A.B.B is a huge multinational corperation, and it has a company proxy with the address of 10.*.*.*
   
   It would assume that the spammer is connecting through a large volume proxy server somewhere.
   
   Cheers,
   Warren Wilkinson

   
   
   I suppose I should not believe everything I read on the net ;) Damn those guys at NThelp and other sites :)
   Now I dunno if the network admin sites I visit are entirely wrong, but the evidence seems to be backing wildcorn on this one. Or... This does not compute.
   
   Strange thing is that RIPE and all those other IP governing agencies have not registered these IP addresses, and their error messages support what I say. Sure wildcorn would get a 10.x.x.x address if he ran an ipconfig, but the external network address is supposed to be different.

6. Re: Some strange comments

   #6

   Barbarian Horde
   Feb 7, 2006 07:15
   [207#985|text]
   [  +    -   ]   ( 0 ) it a life story
   it sucks and its boring
   
   [ Reply ][ Edit ] 10.85.50.78
   
   
   I am pretty sure it is the same lamer. He posted this in Agar's "Man's best friend" after Moon's comment about "The story of my life".
   
   This one is dogging MoonHunter around the site, so I guess the two have communicated in some way in the past. He probably got told to straighten up. No wonder considering the way he spells.
   
   He still posts from a 10.x.x.x address and by this time I am pretty confident that it means he is within the same network as Strolen's server (or spoofing). I have pretty much abandoned wildcorn's theory, as it is usual for most proxies to be located at a 10.x.x.x address. That does not mean the external IP is the same, as a matter of fact it is highly unlikely that a 10.x.x.x address is routed outside LANs. It is against the network theory I have been reading.
   
   Any comments?
   
   My bet is a german or asian script kiddie.
   
   Oh, by the way: As he did last time, he left one semi-useful comment as well. It is a compliment to a Strolenite, so I let it be. Beside, it bumped Agar's post and there is nothing wrong with that.

7. Re: Some strange comments

   #7

   hmmm, don't want to ban him, but we don't like the comments either.....
   

Administrators · All categories · Guildhall