OT: Team AnandTech password request! Fill out Internet Abuse Form for the culprit!

[MongoX]

yeah ! got mine!
i must be special too!

 

[jarsoffart]

Got one on 9/17 6:06 PM with the same IP address.

 

[DeezWho]

I got one too ....

apprently it's a dynamic address on the adelphia netblock so it's prolly some spammer fishing for emails

 

[sciencewhiz]

I got one too, but I only check that account rarely.

 

[Jeff7]

So if someone gets into my TA account, what exactly can they do?
I think I've only logged into the account maybe...well, less than 10 times probably.

 

[YellowRose]

I didn't get one. No one likes me.

 

[winr]

Aww, we love you YellowRose:sun:

 

[ViRGE]

Originally posted by: Jeff7
So if someone gets into my TA account, what exactly can they do?
I think I've only logged into the account maybe...well, less than 10 times probably.

Not much really. They can't change the password, or email address, so they're limited to changing what DC accounts we have on record as being yours.

 

[conjur]

Just got another one this morning...this guy's determined!

 

[Assimilator1]

Me too

 

[conjur]

From lobadobadingdong:


I think I found the ISP of they guy/girl doing this, and sent a request for it to be investigated, if anyone else has tried looking up the ip address of the requester and came to the same conclusion, it might be good for you to contact adelphia.net as well through thier internet abuse form.

edit: yes this is a repost, but I've found a form that we might be able to get this guy kicked from his ISP, and perhaps that will be enough for him to leave the TA server alone.

 

[thorin]

Your Violation Report was received on Sep 23, 2003 at 12:44.

 

[Assimilator1]

What fields did you choose under 'subject type' (security?) & 'problem type' (access?)?

 

[thorin]

I think I did Security and Other (already forgot )

Thorin

 

[TAandy]

Originally posted by: DeezWho
I got one too ....

apprently it's a dynamic address on the adelphia netblock so it's prolly some spammer fishing for emails

I've had two now from the same address, 68.232.35.27.

 

[winr]

I received a second one this morning.

 

[MoFunk]

Me too. got my second one also.

 

[TAandy]

Originally posted by: Assimilator1
What fields did you choose under 'subject type' (security?) & 'problem type' (access?)?

I did Security and Access Attempt

 

[Wiz]

I got another one today, I'm filling out the violation report.

 

[MoFunk]

Filled out the report. Wonder if anything will come of it.

 

[dmcowen674]

It's more than just abuse. Repeated intentional attempts to gain entry to password protected sites is HACKING and is a Criminal Crime.

The local Law Enforcement authorities in connection with the ISP and the subscriber doing this should be contacted.

 

[ViRGE]

Mind you, Dave, that it's highly unlikely that the person responsible for this is trying to hack in to anything. As stated before, the most likely senario(by far) is that it's a spider of some sort, probably an email spider looking for addresses to spam.

 

[Soggysocks]

Still, this is a violation of privacy. Did a little checking, a who-is searchand came up with this:

Query the APNIC Whois DatabaseNeed help?
General search help
Help tracking spam and hacking
To assist you with debugging problems, this whois query was received from IP Address [ 66.218.9.150 ]. Your web client may be behind a web proxy.
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 66.0.0.0 - 66.255.255.255
netname: ARIN-CIDR-BLOCK
descr: Not allocated by APNIC
remarks: ------------------------------------------------------
remarks:
remarks: Important:
remarks:
remarks: Details of networks in this range are not registered
remarks: in the APNIC Whois Database.
remarks:
remarks: Please search the ARIN Whois, which contains
remarks: details of IP addresses allocated in North America,
remarks: parts of the Caribbean, and sub-equatorial Africa:
remarks:
remarks: website: http://www.arin.net/tools/whois_help.html
remarks: command line: whois.arin.net
remarks:
remarks: ------------------------------------------------------
country: AU
admin-c: IANA1-AP
tech-c: IANA1-AP
mnt-by: MAINT-APNIC-AP
mnt-lower: MAINT-APNIC-AP
status: UNSPECIFIED
changed: hm-changed@apnic.net 20030403
source: APNIC
role: Internet Assigned Numbers Authority
address: see http://www.iana.org.
e-mail: nobody@apnic.net
admin-c: IANA1-AP
tech-c: IANA1-AP
nic-hdl: IANA1-AP
remarks: For more information on IANA services
remarks: go to IANA web site at http://www.iana.org.
mnt-by: MAINT-APNIC-AP
changed: nobody@apnic.net 20020530
source: APNIC

Bold: Object type.
Underlined: Primary key(s).
Hyperlinks: Searchable Attributes.




second this:


% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum: 0.0.0.0 - 255.255.255.255
netname: IANA-BLK
descr: The whole IPv4 address space
country: NL
admin-c: IANA1-RIPE
tech-c: IANA1-RIPE
status: ALLOCATED UNSPECIFIED
remarks: The country is really worldwide.
remarks: This address space is assigned at various other places in
remarks: the world and might therefore not be in the RIPE database.
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: RIPE-NCC-HM-MNT
mnt-routes: RIPE-NCC-NONE-MNT
changed: bitbucket@ripe.net 20010529
changed: bitbucket@ripe.net 20020625
source: RIPE
role: Internet Assigned Numbers Authority
address: see http://www.iana.org.
e-mail: bitbucket@ripe.net
admin-c: IANA1-RIPE
tech-c: IANA1-RIPE
nic-hdl: IANA1-RIPE
remarks: For more information on IANA services
remarks: go to IANA web site at http://www.iana.org.
mnt-by: RIPE-NCC-MNT
changed: bitbucket@ripe.net 20010411
source: RIPE
third this:


Search results for: 68.145.160.189

OrgName: Shaw Communications Inc.
OrgID: SHAWC
Address: Suite 800
Address: 630 - 3rd Ave. SW
City: Calgary
StateProv: AB
PostalCode: T2P-4L4
Country: CA
NetRange: 68.144.0.0 - 68.147.255.255
CIDR: 68.144.0.0/14
NetName: SHAW-COMM
NetHandle: NET-68-144-0-0-1
Parent: NET-68-0-0-0-0
NetType: Direct Allocation
NameServer: NS2SO.CG.SHAWCABLE.NET
NameServer: NS1SO.CG.SHAWCABLE.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2002-06-03
Updated: 2003-06-20
OrgAbuseHandle: SHAWA-ARIN
OrgAbuseName: SHAW ABUSE
OrgAbusePhone: +1-403-750-7420
OrgAbuseEmail: internet.abuse@sjrb.ca
OrgTechHandle: ZS178-ARIN
OrgTechName: Shaw High-Speed Internet
OrgTechPhone: +1-403-750-7428
OrgTechEmail: ipadmin@sjrb.ca
# ARIN WHOIS database, last updated 2003-09-22 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
I'm not too good at this stuff...but one of you IT guy's should or might be able to do something with this.

 

[lobadobadingdong]

removed info from my thread so it'll drop.....I didn't see this thread before I posted it, the repost I saw didn't have this much info in it.

 

[Soggysocks]

Thats OK Loba. We all are a bit shook up. I wonder if this is a BBR trick or something?

Or just a disgruntled Anandtechian