Clan x86

General Forums => General Discussion => Topic started by: MyndFyre on February 21, 2006, 12:27:53 PM

Title: Anyone else think this is suspicious?
Post by: MyndFyre on February 21, 2006, 12:27:53 PM
Yeah.....  Just strikes me as not quite right.
Title: Re: Anyone else think this is suspicious?
Post by: AntiVirus on February 21, 2006, 01:35:54 PM
I don't get it. :(
Title: Re: Anyone else think this is suspicious?
Post by: Quik on February 21, 2006, 01:39:00 PM
Quote from: MyndFyrex86] link=topic=4931.msg56545#msg56545 date=1140542873]
Yeah.....  Just strikes me as not quite right.

What time was it when you took that image? Also, keep in mind that it counts "guests" in that number, I believe.
Title: Re: Anyone else think this is suspicious?
Post by: ZeroX on February 21, 2006, 02:05:46 PM
What image are you talking about?
Title: Re: Anyone else think this is suspicious?
Post by: Ergot on February 21, 2006, 02:42:06 PM
I brought this up with Sidoh.
33 Guests, 8 Users               Users active in past 15 minutes:
Ergot, ink, Warrior[x86], Sidoh, Joe, Lord[nK], Quik, mc0       
                                                  Most Online Today: 45.        Most Online Ever: 45 (Today at 10:13:47 PM)
Title: Re: Anyone else think this is suspicious?
Post by: Blaze on February 21, 2006, 03:43:24 PM
DDOS OMFG!
Title: Re: Anyone else think this is suspicious?
Post by: MyndFyre on February 21, 2006, 05:19:15 PM
Quote from: ZeroX on February 21, 2006, 02:05:46 PM
What image are you talking about?

An attachment.  I wonder if guests aren't allowed to view them.

Cmon though, this was earlier today.  33 guests at midnight on a Monday?  It had to be a database error.
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 21, 2006, 06:18:35 PM
Quote from: MyndFyrex86] link=topic=4931.msg56562#msg56562 date=1140560355]
An attachment.  I wonder if guests aren't allowed to view them.
Perhaps you can make sure they can?  You're the expert :)

Quote from: MyndFyrex86] link=topic=4931.msg56562#msg56562 date=1140560355]
Cmon though, this was earlier today.  33 guests at midnight on a Monday?  It had to be a database error.
Or somebody sat there reloading or something.  :)
Title: Re: Anyone else think this is suspicious?
Post by: Newby on February 21, 2006, 06:23:29 PM
Haha, I noticed attachments were disabled globally except to x86 members. I didn't question it. :P
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 21, 2006, 06:56:05 PM
Quote from: Newby on February 21, 2006, 06:23:29 PM
Haha, I noticed attachments were disabled globally except to x86 members. I didn't question it. :P

Well, it's my bandwidth and I have no problem with anybody posting/seeing attachments.  Until it gets abused. 
Title: Re: Anyone else think this is suspicious?
Post by: Sidoh on February 21, 2006, 08:14:15 PM
Maybe someone posted a link to the forums on a popular place on the internet? :)
Title: Re: Anyone else think this is suspicious?
Post by: Nate on February 21, 2006, 08:24:30 PM
Silly Sidoh this is a popular place.  As a matter of fact, its where all the cool kids hang out.
Title: Re: Anyone else think this is suspicious?
Post by: Sidoh on February 21, 2006, 08:25:38 PM
Quote from: Nate on February 21, 2006, 08:24:30 PM
Silly Sidoh this is a popular place.  As a matter of fact, its where all the cool kids hang out.

Haha, I meant one that has hundereds or thousands of people online at any given time, like a game forum.
Title: Re: Anyone else think this is suspicious?
Post by: Ergot on February 21, 2006, 08:31:49 PM
Quote from: Sidoh on February 21, 2006, 08:25:38 PM
Quote from: Nate on February 21, 2006, 08:24:30 PM
Silly Sidoh this is a popular place.  As a matter of fact, its where all the cool kids hang out.

Haha, I meant one that has hundereds or thousands of people online at any given time, like a game forum.
I wonder how it would handle slashdot :S!
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 21, 2006, 09:20:27 PM
Quote from: Ergot on February 21, 2006, 08:31:49 PM
Quote from: Sidoh on February 21, 2006, 08:25:38 PM
Quote from: Nate on February 21, 2006, 08:24:30 PM
Silly Sidoh this is a popular place.  As a matter of fact, its where all the cool kids hang out.

Haha, I meant one that has hundereds or thousands of people online at any given time, like a game forum.
I wonder how it would handle slashdot :S!

Poorly. 
Title: Re: Anyone else think this is suspicious?
Post by: Quik on February 21, 2006, 10:37:05 PM
Quote from: iago on February 21, 2006, 06:56:05 PM
Quote from: Newby on February 21, 2006, 06:23:29 PM
Haha, I noticed attachments were disabled globally except to x86 members. I didn't question it. :P

Well, it's my bandwidth and I have no problem with anybody posting/seeing attachments.  Until it gets abused. 

I set it so that anyone can see attachments, however only x86 members and above can post. Only the logical thing in my mind.
Title: Re: Anyone else think this is suspicious?
Post by: GameSnake on February 21, 2006, 10:37:19 PM
Atleast we look more l33t now.
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 24, 2006, 11:58:32 AM
By the way, here is the list of unique referers to x86labs.org:

+----------------------------------+-------------+
| data                             | count(data) |
+----------------------------------+-------------+
| http://127.0.0.1:4664            |           1 |
| http://127.0.0.1:8000            |           2 |
| http://192.168.0.3               |           1 |
| http://63.208.226.25             |           3 |
| http://69.49.230.9:8080          |           1 |
| http://72.9.254.71:2082          |           1 |
| http://aero-net1.com             |           1 |
| http://aimexpress.aim.com        |           2 |
| http://armyz.net                 |           3 |
| http://blueli.fatcow.com         |           2 |
| http://ca.search.yahoo.com       |           1 |
| http://cqcounter.com             |           3 |
| http://dark-wire.net             |          16 |
| http://dota-allstars.com         |           4 |
| http://editprofile.myspace.com   |          29 |
| http://ergot.no-ip.org           |           1 |
| http://forum.netnuke.net         |           6 |
| http://forum.valhallalegends.com |         149 |
| http://freshmeat.net             |          17 |
| http://hk.search.yahoo.com       |           2 |
| http://iconsurf.com              |           3 |
| http://keyurd.com                |           7 |
| http://localhost:5801            |           1 |
| http://localhost:8080            |           1 |
| http://logon.berzerkerjbls.com   |           1 |
| http://macteens.com              |           6 |
| http://mail.google.com           |          19 |
| http://mail.marcusfamily.info    |           1 |
| http://myspace.com               |         265 |
| http://newbyproductions.net      |           1 |
| http://profile.myspace.com       |         857 |
| http://romi.uni.cc               |           4 |
| http://search.msn.co.jp          |           4 |
| http://search.msn.co.uk          |           2 |
| http://search.msn.com            |          18 |
| http://search.msn.com.br         |           4 |
| http://search.yahoo.com          |          13 |
| http://sidoh.no-ip.org           |           4 |
| http://sidoh.no-ip.org:4664      |           1 |
| http://sidoh.org                 |          17 |
| http://us.f326.mail.yahoo.com    |           1 |
| http://us.f521.mail.yahoo.com    |           2 |
| http://www..x86abs.org           |           1 |
| http://www.advancedcontent.net   |          14 |
| http://www.answers.com           |           1 |
| http://www.ask.com               |           1 |
| http://www.avantbrowser.com ->   |           2 |
| http://www.bitching.org          |           1 |
| http://www.burmies.com           |           1 |
| http://www.clantt.com            |           6 |
| http://www.dark-wire.net         |           4 |
| http://www.ebypass.org           |          13 |
| http://www.edevs.org             |           2 |
| http://www.google.at             |           1 |
| http://www.google.be             |           1 |
| http://www.google.ca             |           6 |
| http://www.google.co.il          |           1 |
| http://www.google.co.uk          |           4 |
| http://www.google.com            |          68 |
| http://www.google.com.au         |           1 |
| http://www.google.com.pk         |           1 |
| http://www.google.com.vn         |           1 |
| http://www.google.de             |           5 |
| http://www.google.es             |           3 |
| http://www.google.lt             |           1 |
| http://www.google.nl             |           1 |
| http://www.google.pl             |           2 |
| http://www.googlB#r$ü}ƒú.%KÂCý$ºfþ§ÿ ãL­©<>j0þ
±–Æ^Œ"...]‰7#ûÆ4Ë|'ŧ!½äØ0—l
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 24, 2006, 11:59:46 AM
By the way, here is the list of unique referers to x86labs.org:

+----------------------------------+-------------+
| data                             | count(data) |
+----------------------------------+-------------+
| http://127.0.0.1:4664            |           1 |
| http://127.0.0.1:8000            |           2 |
| http://192.168.0.3               |           1 |
| http://63.208.226.25             |           3 |
| http://69.49.230.9:8080          |           1 |
| http://72.9.254.71:2082          |           1 |
| http://aero-net1.com             |           1 |
| http://aimexpress.aim.com        |           2 |
| http://armyz.net                 |           3 |
| http://blueli.fatcow.com         |           2 |
| http://ca.search.yahoo.com       |           1 |
| http://cqcounter.com             |        \[-ïð¦??J¶4óÝDŽÌÚŒ‡ùç¥ì•—oê#Eœ‹ÁD7™¬??õ­3›s®¬í>¸qÓ£n¿IAxÍÊ3(DèeÝzL0R‰©   I6ª£ZCåˆ"¾k°½@,C'ìNÄ¥A.Í¡tÄV]팪K±'Ô¶¨rËOŠiΠ  R{ÙÊΘâ
Ÿ*öÏìÇ´:6Åu¤]Ue?`B?9«³þ™7™Éü?j;:®1²(ð#4îÝLTœòñùfjón÷sKé<e""ϪåÈ d¤í¢
?íû[ò‹`
ž+1 *¸,Ũ¶ØmÛ0–|-sÛh·púû¿5R} ZÎHMº%?5}bÍ%H:g|î?dn?¡~ÌŒÝ2°²E£tB¢CŽáúËå{Ä£g+?ý;3G?,,²îætëÖNq"8û0ˆŽQ¹Þ¶â6JÂåVÊ•ÇÌy´-áCžIˆšcæåG Þ0Þ£|½...œgh*Z´Š.Âx$¼ÌžƒZ¹~èvjþšónÀ¨,•ýÂù·
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 24, 2006, 12:03:44 PM
Third try's the charm, apparently.  I'm going to leave the broken posts here for evidence or something. :)

By the way, here is the list of unique referers to x86labs.org:

+----------------------------------+-------------+
| data                             | count(data) |
+----------------------------------+-------------+
| http://127.0.0.1:4664            |           1 |
| http://127.0.0.1:8000            |           2 |
| http://192.168.0.3               |           1 |
| http://63.208.226.25             |           3 |
| http://69.49.230.9:8080          |           1 |
| http://72.9.254.71:2082          |           1 |
| http://aero-net1.com             |           1 |
| http://aimexpress.aim.com        |           2 |
| http://armyz.net                 |           3 |
| http://blueli.fatcow.com         |           2 |
| http://ca.search.yahoo.com       |           1 |
| http://cqcounter.com             |           3 |
| http://dark-wire.net             |          16 |
| http://dota-allstars.com         |           4 |
| http://editprofile.myspace.com   |          29 |
| http://ergot.no-ip.org           |           1 |
| http://forum.netnuke.net         |           6 |
| http://forum.valhallalegends.com |         149 |
| http://freshmeat.net             |          17 |
| http://hk.search.yahoo.com       |           2 |
| http://iconsurf.com              |           3 |
| http://keyurd.com                |           7 |
| http://localhost:5801            |           1 |
| http://localhost:8080            |           1 |
| http://logon.berzerkerjbls.com   |           1 |
| http://macteens.com              |           6 |
| http://mail.google.com           |          19 |
| http://mail.marcusfamily.info    |           1 |
| http://myspace.com               |         265 |
| http://newbyproductions.net      |           1 |
| http://profile.myspace.com       |         857 |
| http://romi.uni.cc               |           4 |
| http://search.msn.co.jp          |           4 |
| http://search.msn.co.uk          |           2 |
| http://search.msn.com            |          18 |
| http://search.msn.com.br         |           4 |
| http://search.yahoo.com          |          13 |
| http://sidoh.no-ip.org           |           4 |
| http://sidoh.no-ip.org:4664      |           1 |
| http://sidoh.org                 |          17 |
| http://us.f326.mail.yahoo.com    |           1 |
| http://us.f521.mail.yahoo.com    |           2 |
| http://www..x86abs.org           |           1 |
| http://www.advancedcontent.net   |          14 |
| http://www.answers.com           |           1 |
| http://www.ask.com               |           1 |
| http://www.avantbrowser.com ->   |           2 |
| http://www.bitching.org          |           1 |
| http://www.burmies.com           |           1 |
| http://www.clantt.com            |           6 |
| http://www.dark-wire.net         |           4 |
| http://www.ebypass.org           |          13 |
| http://www.edevs.org             |           2 |
| http://www.google.at             |           1 |
| http://www.google.be             |           1 |
| http://www.google.ca             |           6 |
| http://www.google.co.il          |           1 |
| http://www.google.co.uk          |           4 |
| http://www.google.com            |          68 |
| http://www.google.com.au         |           1 |
| http://www.google.com.pk         |           1 |
| http://www.google.com.vn         |           1 |
| http://www.google.de             |           5 |
| http://www.google.es             |           3 |
| http://www.google.lt             |           1 |
| http://www.google.nl             |           1 |
| http://www.google.pl             |           2 |
| http://www.google.pt             |           1 |
| http://www.google.se             |           1 |
| http://www.hive.net              |           1 |
| http://www.keyurd.com            |           9 |
| http://www.ktmem.com             |           2 |
| http://www.last.fm               |          14 |
| http://www.lifelesspeople.com    |           1 |
| http://www.liquid-server.org     |           3 |
| http://www.magicanimals.net      |           1 |
| http://www.mvtracker.com         |          17 |
| http://www.myspace.com           |         116 |
| http://www.netcraft.com          |           6 |
| http://www.newbyproductions.net  |           2 |
| http://www.pantera.com           |           1 |
| http://www.salv.net              |           9 |
| http://www.search.com            |           3 |
| http://www.sidoh.org             |           9 |
| http://www.sitemeter.com         |           2 |
| http://www.skyos.org             |           4 |
| http://www.spidervisit.com ->    |           1 |
| http://www.stealthbot.net        |         309 |
| http://www.tech-forums.net       |           2 |
| http://www.whois.sc              |          21 |
+----------------------------------+-------------+
90 rows in set (0.30 sec)


The myspace stuff is all caused by a single miscreant who's linking to an image here:
http://myspace.com/ianm1337 -> http://www.x86labs.org/~ian/etc/bands1.jpg
http://myspace.com/ianm1337 -> http://www.x86labs.org/~ian/etc/bands2.jpg

Unfortunately, Apache's "referer" log doesn't keep track of datestamps; however, I'd say by the stats here, we didn't get slashdotted :P

By the way, while I was add it, I pulled up the Google search records that led people here:
Quotepicotux pt2100
"Picotux 100 module" price
"Wow theme manager"
"all asm commands"
"auto reconnect" "no-ip"
"clan x86"
"do nothing diet"
"wesnoth clan"
"you no longer need to bare the weight of your crown
1.13e BNLS
5 poppin 6 droppin I aint stopping all you%E2%80%99ll hear is exits lockin then you%E2%80%99ll hear guns coppin
Scr33n0rL33t
W%C3%BF%C3%A7%C3%A8%C3%AE%C3%BF%C3%BF%C3%BFcmd
[x86] clan
bnet axe tw0p4ck
bnetaxe
bnls for 1.13e
building blocks of life x86 newby
clan [x86] newby "Towelie[x86]"
clan x86
clan x86 iago
d2gs zeroforce
edit.xex
hellishlurtz
hexencode vbscript
javaop invite
kernubbin
lyrics "aint no such thing as halfway crooks"
mriya battle.net
picotux 112
sidoh[x86]
sidoh[x86] chris
slackware  root exploit "10.1 0 "
towelie x86
trojan lobot worm
unfilterword
www.geneforge
www.geneforge 2
x86 clan
x86 clan newby
x86 place
x86labs
x86labs forums
x86labs irc
x86labs rpg
yiourkas

I love how several of them were looking for Sidoh, Newby, iago, towelie, and screenor.  Also, geneforge stuff.. I knew Newby was going to get us in trouble! 

Title: Re: Anyone else think this is suspicious?
Post by: Sidoh on February 24, 2006, 01:04:50 PM
Haha, cool!

What's up with the broken posts?  :o
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 24, 2006, 01:14:43 PM
Quote from: Sidoh on February 24, 2006, 01:04:50 PM
What's up with the broken posts?  :o
I have no idea!  I'm just glad that Firefox is smart enough to keep form information when I press "back", I'm pretty sure on IE I would have lost all that data :)
Title: Re: Anyone else think this is suspicious?
Post by: Ergot on February 24, 2006, 02:47:29 PM
Interesting what people are searching for when they land here :O
Title: Re: Anyone else think this is suspicious?
Post by: Sidoh on February 24, 2006, 04:11:54 PM
Quote from: iago on February 24, 2006, 01:14:43 PM
I have no idea!  I'm just glad that Firefox is smart enough to keep form information when I press "back", I'm pretty sure on IE I would have lost all that data :)

Weird!  Hehe, yeah.  I think so too.  That's one of the main reasons I like Firefox over IE.  It implements features that save your data! ;D
Title: Re: Anyone else think this is suspicious?
Post by: MyndFyre on February 24, 2006, 04:25:13 PM
Quote from: Sidoh on February 24, 2006, 04:11:54 PM
Quote from: iago on February 24, 2006, 01:14:43 PM
I have no idea!  I'm just glad that Firefox is smart enough to keep form information when I press "back", I'm pretty sure on IE I would have lost all that data :)

Weird!  Hehe, yeah.  I think so too.  That's one of the main reasons I like Firefox over IE.  It implements features that save your data! ;D

IE does it when you press "back" or "forward" as long as you don't click on links in between.
Title: Re: Anyone else think this is suspicious?
Post by: Quik on February 24, 2006, 04:49:50 PM
Quote from: iago on February 24, 2006, 12:03:44 PM
...
"do nothing diet"
...
"you no longer need to bare the weight of your crown
...
5 poppin 6 droppin I aint stopping all you%E2%80%99ll hear is exits lockin then you%E2%80%99ll hear guns coppin
...
W%C3%BF%C3%A7%C3%A8%C3%AE%C3%BF%C3%BF%C3%BFcmd
...
hellishlurtz
...
kernubbin
...
slackware  root exploit "10.1 0 "
...
lyrics "aint no such thing as halfway crooks"
...
yiourkas

Ok, wtf? I can understand maybe kernubbin is said once maybe on these forums (who searches for that?) and the slack exploit maybe isn't a great thing (I blame tmp ;p), but wtf is with those others?
Title: Re: Anyone else think this is suspicious?
Post by: iago on February 24, 2006, 05:49:50 PM
Quote from: MyndFyrex86] link=topic=4931.msg57009#msg57009 date=1140816313]
Quote from: Sidoh on February 24, 2006, 04:11:54 PM
Quote from: iago on February 24, 2006, 01:14:43 PM
I have no idea!  I'm just glad that Firefox is smart enough to keep form information when I press "back", I'm pretty sure on IE I would have lost all that data :)

Weird!  Hehe, yeah.  I think so too.  That's one of the main reasons I like Firefox over IE.  It implements features that save your data! ;D

IE does it when you press "back" or "forward" as long as you don't click on links in between.

I'm sure I've lost data doing that on IE, but I could be wrong.  I have no way of testing it, so *shrug*

Quote from: Quik on February 24, 2006, 04:49:50 PM
Quote from: iago on February 24, 2006, 12:03:44 PM
...
"do nothing diet"
...
"you no longer need to bare the weight of your crown
...
5 poppin 6 droppin I aint stopping all you%E2%80%99ll hear is exits lockin then you%E2%80%99ll hear guns coppin
...
W%C3%BF%C3%A7%C3%A8%C3%AE%C3%BF%C3%BF%C3%BFcmd
...
hellishlurtz
...
kernubbin
...
slackware  root exploit "10.1 0 "
...
lyrics "aint no such thing as halfway crooks"
...
yiourkas

Ok, wtf? I can understand maybe kernubbin is said once maybe on these forums (who searches for that?) and the slack exploit maybe isn't a great thing (I blame tmp ;p), but wtf is with those others?
I guess SOMEBODY must have said them here.  :)
Title: Re: Anyone else think this is suspicious?
Post by: rabbit on February 25, 2006, 06:35:44 AM
http://www.google.com/search?hl=en&lr=&q=yiourkas+site%3Ax86labs.org&btnG=Search