What is this?

bob

Member
Joined
Dec 15, 2003
Messages
17
What are these strange servers?

tbnb-105-48.telkomadsl.co.za.llsurfup-https
tbnb-105-48.telkomadsl.co.za.isakmp

Seems to be a linux box, can ssh in on its IP, just drop the llsurfup-https or isakmp.

Thanks
bob[8D]
 

Karnaugh

Banned
Joined
Jul 23, 2003
Messages
1,575
that's someones personal linux box, wtf are you doing scanning those ranges?

<hr noshade size="1">
"Since light travels faster than sound, people appear bright until you hear them speak."

NetLink Research
 

bob

Member
Joined
Dec 15, 2003
Messages
17
I am not, It seems they are scanning me.
It is popping up all the time in my log files.
Source is reported as that address given about.

SO WTF DUDE!
[:(!]
 

Karnaugh

Banned
Joined
Jul 23, 2003
Messages
1,575
so report it to abuse@saix.net ?

probably just someone with a virus, but then the IP changed to someone else.

<hr noshade size="1">
"Since light travels faster than sound, people appear bright until you hear them speak."

NetLink Research
 

antowan

Honorary Master
Joined
Nov 1, 2003
Messages
13,054
Good day fellow techies!

No need to get angry. The addy's you mentioned will not change no matter what the IP might be. We all have those name based addy's plainly because we use Telkom as our service provider. Thus even an IP change won't affect it. [:D]

If that addy is scanning the Telkom ADSL userbase, we should be able to pick it up soon. Anybody who can, please check your logs. Lets see if we can figure out what is going on here. Lets not accuse people of cracking or hacking before we have proof. The most logical explanation is a virus... But let us check it out anyway...

All you Linux and Windows sys admins, lets see what we can come up with...

By the way, check these out: http://www.myadsl.co.za/forum/topic.asp?TOPIC_ID=1931&SearchTerms=tbnb

http://www.myadsl.co.za/forum/topic.asp?TOPIC_ID=1690&SearchTerms=tbnb

Cheers
Ant
 

Greyhound

Member
Joined
Sep 6, 2003
Messages
26
I may be wrong, but aren't those two numbers (105-48) indicative of the last two octets in the IP address? I'm sure it is, as I've seen it on a couple of IRC servers. Thus, I believe the mask would infact change with a change of IP. [8)]
 

antowan

Honorary Master
Joined
Nov 1, 2003
Messages
13,054
Hi there...

Yes, you are right. My mistake.

[^]

Cheers
Ant

He who does not understand the value of war at the right time, cannot comprehend the value of life at any time - Anonymous
 
Top