Pages:
Author

Topic: OMG OMG 51% attack?!?! 88.208.1.24 - page 3. (Read 5108 times)

b!z
legendary
Activity: 1582
Merit: 1010
September 05, 2013, 06:01:28 AM
#29
SHA-256 is broken, sell sell sell

"Pick a number between 0 and 115792089237316195423570985008687907853269984665640564039457584007913129639935."

I pick 42!
newbie
Activity: 9
Merit: 0
September 05, 2013, 05:41:55 AM
#28
SHA-256 is broken, sell sell sell

"Pick a number between 0 and 115792089237316195423570985008687907853269984665640564039457584007913129639935."
b!z
legendary
Activity: 1582
Merit: 1010
September 05, 2013, 05:13:57 AM
#27
SHA-256 is broken, sell sell sell
newbie
Activity: 9
Merit: 0
September 05, 2013, 04:38:46 AM
#26
88.208.1.24 is back (never actually went offline, to my knowledge - but it did appear to stop mining) and just mined a new block. *edit: two blocks 256227, 256229

Discovered open port 3333/tcp on 88.208.33.202
Discovered open port 8333/tcp on 88.208.33.202
Filtered 22 and filtered 8332.

Done. Only those two TCP ports are open on 88.208.33.202.


Anyway... the processing seems diminished, or they just had some awesome luck before... (I agree that the math should be done by someone...)
Still need some solid confirmations on who owns those blocks - if it is indeed https://ghash.io or not. Can someone acquire info that by logging in?
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
September 05, 2013, 04:22:25 AM
#25
I just leave this here: http://blockchain.info/blocks/88.208.33.202

First 88.208.1.24
Then 88.208.33.202

The timing, power, and similar range is suspicious.  The traceroute is completely different, and whois says it is in the Netherlands. ADVANCEDHOSTERS LIMITED Haldex Ltd though, so it's likely the same host.

I've got 32 mins left on the port scan with nmap, but it seems like 88.208.33.202 is better secured - I didn't get an initial response this time saying that 25, 80, 443, etc were open. I just pinged both and they are about the same ping.
newbie
Activity: 9
Merit: 0
September 05, 2013, 04:16:37 AM
#24
I just leave this here: http://blockchain.info/blocks/88.208.33.202

First 88.208.1.24
Then 88.208.33.202

The timing, power, and similar range is suspicious.  The traceroute is completely different, and whois says it is in the Netherlands. ADVANCEDHOSTERS LIMITED Haldex Ltd though, so it's likely the same host.

I've got 32 mins left on the port scan with nmap, but it seems like 88.208.33.202 is better secured - I didn't get an initial response this time saying that 25, 80, 443, etc were open. I just pinged both and they are about the same ping.


the world is about to end,just relax

The price is going to shoot up (or at least be safer than most investments) once the bombs start dropping.

That is, as long as there isn't a well timed attack on the network, or the a complete shutdown of the internet (google services possibly excluded), by "terrorists" cutting fiber optic lines or "Chinese" hackers.
member
Activity: 84
Merit: 10
September 05, 2013, 03:59:39 AM
#23
the world is about to end,just relax
sr. member
Activity: 350
Merit: 250
September 05, 2013, 03:46:50 AM
#22
Where can you see there power and the overall network power?
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
September 05, 2013, 03:22:26 AM
#21
I just leave this here: http://blockchain.info/blocks/88.208.33.202

First 88.208.1.24
Then 88.208.33.202
newbie
Activity: 9
Merit: 0
September 05, 2013, 01:51:07 AM
#20
You sure it's from GHash.io?

Does GHash.io have a public block history? (like BTCGuild https://www.btcguild.com/index.php?page=pool_stats)



To put this into perspective (edited to take into account timezone differences):

From 20:52 to 1:22 (blockchain.info time), 12 blocks were mined by 88.208.1.24, and only 5 blocks by BTCGuild.


http://blockorigin.pfoe.be/blocklist.php
according to this, they have been identified as coming from GHash.io. I'm not familiar with their identification process. I've read that it can be faked.

Unless I see confirmation from a GHash.IO source, I'm skeptical.
BTCGuild currently says they have a Pool Speed of 222,571 GH/s
GHash.io currently says they have a Pool Speed of 140,540 GH/s (daily average or peak, not sure)
full member
Activity: 134
Merit: 100
September 05, 2013, 01:27:33 AM
#19
why is avast pointing to the Frisian islands?..WTF...lol
hero member
Activity: 686
Merit: 504
always the student, never the master.
September 05, 2013, 01:27:13 AM
#18
Jesus christ its not the cia, the blocks are found by https://ghash.io

for some reason that website is blocked by my antivirus
full member
Activity: 139
Merit: 100
September 05, 2013, 01:17:16 AM
#17
Jesus christ its not the cia, the blocks are found by https://ghash.io
newbie
Activity: 9
Merit: 0
September 05, 2013, 01:03:23 AM
#16
First time using nmap was earlier today for a completely different use. I'll try. TCP or what? for 1327.
So far I'm only doing TCP.

Discovered open port 3333/tcp on 88.208.1.24
Discovered open port 3334/tcp on 88.208.1.24
Discovered open port 4369/tcp on 88.208.1.24
Discovered open port 5222/tcp on 88.208.1.24
Discovered open port 5269/tcp on 88.208.1.24
Discovered open port 5280/tcp on 88.208.1.24
Discovered open port 5223/tcp on 88.208.1.24
Discovered open port 7777/tcp on 88.208.1.24
Discovered open port 8332/tcp on 88.208.1.24
Discovered open port 8333/tcp on 88.208.1.24

done TCP scan; 1327 TCP is not open.
hero member
Activity: 686
Merit: 504
always the student, never the master.
September 05, 2013, 12:55:35 AM
#15
I don't know exactly what traceroute is good for...

But the end result, hop 11 and 12, are 149.11.134.22, which is registered in the District of Columbia.

I'm not sure why Avast points to the Netherlands.

I've pinged the IP, it's still up. I'm doing a portscan on it.... not sure how that would be beneficial, but I don't know what to do in a situation like this....

using nmap

Discovered open port 110/tcp on 88.208.1.24
Discovered open port 443/tcp on 88.208.1.24
Discovered open port 25/tcp on 88.208.1.24
Discovered open port 143/tcp on 88.208.1.24
Discovered open port 993/tcp on 88.208.1.24
Discovered open port 80/tcp on 88.208.1.24
Discovered open port 995/tcp on 88.208.1.24
Discovered open port 587/tcp on 88.208.1.24

and still trying the other 60+ thousand TCP ports.

I attempted to use the IP as an SMTP server, but my client rejected me, saying it wasn't in the accepted list of rcpthosts.

Anyway... like I said, this is above my head... I know there are known ranges of US gov IP addresses, but I haven't found any available for free yet.

do a scan on port 1327. if its open then the machine is exploitable. i'm willing to bet its open, because my antivirus blocks the ip address as malicious due to botnet activity
newbie
Activity: 9
Merit: 0
September 05, 2013, 12:49:20 AM
#14
I don't know exactly what traceroute is good for...

But the end result, hop 11 and 12, are 149.11.134.22, which is registered in the District of Columbia, to Cogent Communications.
edit: ok, I reloaded and the end result is again 88.208.1.24, after the 11th hop being 149.11.134.22.

I'm not sure why Avast points to the Netherlands.

I've pinged the IP, it's still up. I'm doing a portscan on it.... not sure how that would be beneficial, but I don't know what to do in a situation like this....

using nmap

Discovered open port 110/tcp on 88.208.1.24
Discovered open port 443/tcp on 88.208.1.24
Discovered open port 25/tcp on 88.208.1.24
Discovered open port 143/tcp on 88.208.1.24
Discovered open port 993/tcp on 88.208.1.24
Discovered open port 80/tcp on 88.208.1.24
Discovered open port 995/tcp on 88.208.1.24
Discovered open port 587/tcp on 88.208.1.24

and still trying the other 60+ thousand TCP ports.

I attempted to use the IP as an SMTP server, but my client rejected me, saying it wasn't in the accepted list of rcpthosts.

Anyway... like I said, this is above my head... I know there are known ranges of US gov IP addresses, but I haven't found any available for free yet.
hero member
Activity: 686
Merit: 504
always the student, never the master.
September 05, 2013, 12:19:46 AM
#13
http://cqcounter.com/traceroute/?query=88.208.1.24

share-bt.net registered with with Advanced Hosters, a shell company owned by a company named Haldex, LTD.

check out the traceroute. they are behind several proxies, some of which have omitted geolocation data.

but look what Avast says:

full member
Activity: 170
Merit: 100
September 05, 2013, 12:17:06 AM
#12
advancedhosters.com

these guys are the IP and have large data centers.

full member
Activity: 170
Merit: 100
September 05, 2013, 12:07:28 AM
#11
i dont like the sound of this    Undecided
newbie
Activity: 28
Merit: 0
September 04, 2013, 11:59:53 PM
#10
It is CIA starting 51% attack.

It is their new data center in Ashburn, VA, near Langley, VA.

http://cqcounter.com/whois/?query=88.208.1.24&map=1#map_geo_location
Pages:
Jump to: