Security

Ask something
Discussion Locked

whats this IP ?

0 helpful
10 replies

by dp 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Question .. whats this ip connected on one of my pc . 81.52.249.55 (http) , 12.129.72.145 (https) and sandpiper29.isc.cw.net ?? i did a whois but i still dont have any idea on what or why its connected on one of my pc , the https is connected , the first one is always on close_wait and i am on an ATT T1 . thanks

Paolo

10 replies

by dmiles

Sounds as though your systems have been hacked,you first need to research software that you can sniff out the hacker then using your anti-virus to to scan for a back door virus.
Consider adding a firewall to protect your system from futher intrusion.

by joseph moore

Ok, I do not think you are hacked, exactly.

When you do a WHOIS against 81.52.249.55, you get the following:

Non-authoritative answer
Recursive queries supported by this server
Query for 55.249.52.81.in-addr.arpa type=255 class=1
52.81.in-addr.arpa SOA (Zone of Authority)
Primary NS: bow.rain.fr
Responsible person: root@bow.rain.fr
serial:2003071809
refresh:3600s (60 minutes)
retry:600s (10 minutes)
expire:2592000s (30 days)
minimum-ttl:86400s (24 hours)

Ok, so this tells you that this IP is in the range that is owned by BOO.RAIN.FR

Ok, then, who is that? Well, I am not sure. You can't do a normal WHOIS against an international domain. So, I went to www.allwhois.com and on there you can search. Basically, some French company ownes that domain.
One interesting thing is if you go to www.rain.fr, you get redirected to France Telecom website.

by joseph moore

Also, the 81.52.249.55 IP address is running a web server. Here is the HTTP header info it provides:

Host: 81.52.249.55

Connection: close

HTTP/1.0 400 Bad Request

Server: AkamaiGHost

Mime-Version: 1.0

Content-Type: text/html

Content-Length: 132

Expires: Wed, 20 Aug 2003 23:56:40 GMT

Date: Wed, 20 Aug 2003 23:56:40 GMT

Connection: close


Invalid URL

Invalid URL

The requested URL "/", is invalid.

by joseph moore

Ok, next IP, 12.129.72.145. It has DIG info for ATTENS.COM, which is ATT MAnaged Services.

THe IP you see is running the AkamaiGhost web server also. It has a SSL cert issued to it that is issued to "a248.3.akamai.net"

And yes, that address is up and also runs this same AkamaiGhost web server. The domain does exist, and is registered to the Akamai Technology in Cambridge, Mass.

by joseph moore

As for the Sandpiper address, you didn't say what that address was connecting to. It could be the same thing, or it could be something different. What port is it connecting on?

by joseph moore

Anyway, my final thoughts are this. The first 2 IP addresses are downloading HTML content, probably via a spyware program on your system. Yes, there are some new virii out there that are setting up zombie spam relay machines, but that does not run on port 80 or 443.
Do you ever get popup web page adds even when you are not actively browsing the Internet?

It is my gut feeling that you have some spyware that is downloading adds from these mirror AkamaiGhost web servers, and displaying it on your system. Not viral, technically, and easy to fix by running Ad-Aware.

As for the Sandpiper address, again there is not enough info for me to hazard a guess.

hope this helps

by jschein

It looks like a linking hijack...

1) Ensure latest version of anti-virus... To be sure, goto housecall.antivirus.com and do their free online virus scan (it's worth it - outside scan to ensure local pc is not infected)

2) goto lavasoftusa.com, download FREE adaware, run the update and scan your pc. Remove any malicious items it finds. Reboot pc.

Should be good to go after that. I noticed the same kind of hijack on a fellow technicians workstation when I travelled. I found it by going to the cmd prompt and typing ipconfig /all .... And found his information was being redirected to and external i.p. and host. Amazed me. Good luck.

by dp

thanks guys , just to give u a rundown ... i have a firewall and symantec av corp ed. with the latest updates and an IDS as well... i am kind of leaning more into that its a spyware or an adware program .. i wrote a vb program thats installed on that pc that connects to an https server on the internet , but the ip;s i mentioned is not where the pc is connecting to (i do see it sometimes)... akamai sounds very familiar ...any other thoughts guys ? One thing i did do was close the vb program i wrote and left it running and i also disconnected the ip's connected , after that i have not seen it connecting again .. i am going to try to start the vb app again and see what happens ...

by jkeav634

Domain Query Results

% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

inetnum: 81.52.248.0 - 81.52.250.127
netname: AKAMAI-FT-US
descr: Akamai Technologies - US machines connected to FT AS5511
country: US
admin-c: NARA1-RIPE
tech-c: NARA1-RIPE
tech-c: NF1714-RIPE
status: ASSIGNED PA
mnt-by: FT-BRX
changed: gestionip.ft@francetelecom.com 20030321
source: RIPE

route: 81.52.240.0/20
descr: France Telecom
descr: Opentransit
origin: AS5511
mnt-by: FT-BRX
changed: gestionip.ft@francetelecom.com 20030214
source: RIPE

role: Network Architecture Role Account
address: Akamai Technologies
address: 500 Technology Square
address: Cambridge, MA 02139
phone: +1-617-250-4768
e-mail: ip-admin@akamai.com
admin-c: NF1714-RIPE
admin-c: JP1944-RIPE
tech-c: NF1714-RIPE
tech-c: JP1944-RIPE
nic-hdl: NARA1-RIPE
notify: ip-admin@akamai.com
changed: ip-admin@akamai.com 20021025
source: RIPE

person: Noam Freedman
address: Akamai Technologies
address: 500 Technology Sq
address: Cambridge, MA 02139
phone: +1 617 250 4768
e-mail: noam@akamai.com
nic-hdl: NF1714-RIPE
notify: noam@akamai.com
changed: noam@akamai.com 20021025
source: RIPE

Registry Information

Country: RIPE
Top Level Domain: RIPE
Whois Server: whois.ripe.net
Registry Web Site: http://www.ripe.net
Registry's Query URL:

This discussion is closed to new replies.