|
|
Posted by db on 09/26/87 11:29
"anthonyberet" <nospam@me.invalid> wrote in message
news:3rekfrFiuh5rU1@individual.net...
> db wrote:
>> "FeMaster" <FeMaster @ hotmail . com> wrote in message
>> news:D9R3f.6305$nE2.5657@fe03.lga...
>>
>>>"db" <@ .> wrote in message
>>>news:434fcc53$0$29110$ed2619ec@ptn-nntp-reader01.plus.net...
>>>
>>>>If you do a "Whois" on them and always note 0 shared files, slot
>>>>statuses
>>>>like 30 of 50, and they have usernames that don't quite seem right, than
>>>
>>>I'd
>>>
>>>>say they're likely to be Macrovision Corporation (probably running
>>>
>>>something
>>>
>>>>on behalf of media companies).
>>>>
>>>
>>>I know that's what I see... My key files that they Queue up, but always
>>>time-out, are songs by Evanescence... Seems like it only happens for a
>>>short time after I first log-in. After that, it appears to stop
>>>happening... Strange it is!
>>
>>
>> http://www.nodata.plus.com/ap2p/macin_2.png (image)
>> http://www.nodata.plus.com/ap2p/2005-10-11-07_svr_winmx.txt (ip log)
>>
> To elaborate, using the IP from that log:
> http://www.samspade.org/t/lookat?a=209.11.134.170
>
> This appears to be a new strategy from Globix.
> I wonder why their attack only works soon after target login?
Well Globix (Global Internet Exchange) is just the host, Macrovision is the
company operating on that host (as far as I'm aware).
I don't see the 'attack' you mention happen only for a short period after
firing up WinMX here. I've had a client operating for several days
monitoring the activity and the frequency of their attempts appears to be
steady (no sign of abatement that I've noticed so far).
What the purpose of their operation is I don't really know. It may be just
one method of 'interdiction' that they're experimenting with, or maybe it's
logging users sharing those types of files (I doubt it if they don't ever
actually transfer any file data = no content verification), or monitoring
for new (unique checksums) of specific content appearing (like trying to map
where media originates from on the network), or... ect, etc, etc. :p
Navigation:
[Reply to this message]
|