Why not register?


Post new topic Reply to topic  [ 17 posts ] 

All times are UTC [ DST ]

Author Message
PostPosted: Tue Aug 10, 2004 12:16 pm  Post subject: MLDonkey attack
Reply with quote
User avatar
Offline

The Devil, Probably
Joined: Thu Jul 03, 2003 9:45 pm
Posts: 2321
Location: The Land Of The Virgin Queen
Has anyone else been plagued by the corrupt chunk inducing bastards from hell?

-multiple MLDonkey clients sending only a few kbs to corrupt your download
-they attack different versions of the same file, that is they are on a 1cd and a 2cd release
-must use ipfilter to block
-not really MLDonkey clients

Its a known problem. First time its happened to me though. I'd lost over the size of the file due to corruption before getting a working ipfilter.dat.

Anyone know of a program to figure out the ip addresses from the userhash? The newest Neo Mule doesn't display the ip, only server.

_________________
Image_____________Now I Wanna Sniff Some Glue..._____________


Top
 Profile  
PostPosted: Tue Aug 10, 2004 1:18 pm  Post subject:
Reply with quote
Offline

Dead But Dreaming
Joined: Tue Jun 03, 2003 4:14 pm
Posts: 270
Location: Tromaville
Userhash <> IP, UserID = IP (if they have High ID)


Top
 Profile  
PostPosted: Tue Aug 10, 2004 1:21 pm  Post subject:
Reply with quote
User avatar
Offline

Site Admin
Joined: Sat Nov 02, 2002 1:35 am
Posts: 19782
Location: En España
userhash is unrelated to ip, you can get ip for id though. There's a program called idtoip or something like that, please post any bad ranges. Although I haven't suffered from it personally, there's a big topic @ fh

edit: but it seems it doesn't show id either :(

_________________
Mouse nipple for the win! Trackpoint or death!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 1:35 pm  Post subject:
Reply with quote
Offline

Blood Sucking Freak
Joined: Thu Aug 05, 2004 10:05 pm
Posts: 190
Well they are not actually MLDonkey but just pretend to be.

There is a five page thread on this at the official emule forum:
http://forum.emule-project.net/index.ph ... opic=53778

The other advice appears to be to use a mod that displays the ip numbers of clients and manually add that to the ip filter.


Top
 Profile  
PostPosted: Tue Aug 10, 2004 3:23 pm  Post subject:
Reply with quote
User avatar
Offline

The Devil, Probably
Joined: Thu Jul 03, 2003 9:45 pm
Posts: 2321
Location: The Land Of The Virgin Queen
It's only two files right now:

ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD1.avi  [700.33 Mb] [Stats]
ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD2.avi  [697.98 Mb] [Stats]

The .ogm verison also suffers the same problem. If you want to have some fun and see what I'm talking about, give them a click. :lol:

Been to different forums about it, even the official emule forum. Tried the program you mentioned Spud. Was thinking of changing clients to get an ip but I'll just suffer through it. Thankfully VeryCD is spreading the files. :wink:

One good thing... current ipfilters block 99% of them. Only have a couple show up now and then, but damn at the damage they cause. If this becomes a common thing, it would cripple the network.

If I had a client or program that could tell ip's... I'd post each one I find.

[ Add all 2 links to your ed2k client ]

_________________
Image_____________Now I Wanna Sniff Some Glue..._____________


Top
 Profile  
PostPosted: Tue Aug 10, 2004 3:37 pm  Post subject:
Reply with quote
User avatar
Offline

The Ancient One
Joined: Thu Feb 13, 2003 6:07 pm
Posts: 4463
Location: The Cellar
so this is the end of the emule....?

_________________
Image
STR - Dead but not forgotten!


Last edited by d0c on Tue Aug 10, 2004 4:21 pm, edited 2 times in total.

Top
 Profile  
PostPosted: Tue Aug 10, 2004 3:55 pm  Post subject:
Reply with quote
User avatar
Offline

In Hell I Burn
Joined: Tue Dec 09, 2003 10:56 pm
Posts: 356
Location: In the basement of an old 42st Grindhouse movie theater.
karstmobile wrote:
It's only two files right now:

ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD1.avi  [700.33 Mb] [Stats]
ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD2.avi  [697.98 Mb] [Stats]

The .ogm verison also suffers the same problem. If you want to have some fun and see what I'm talking about, give them a click. :lol:

Been to different forums about it, even the official emule forum. Tried the program you mentioned Spud. Was thinking of changing clients to get an ip but I'll just suffer through it. Thankfully VeryCD is spreading the files. :wink:

One good thing... current ipfilters block 99% of them. Only have a couple show up now and then, but damn at the damage they cause. If this becomes a common thing, it would cripple the network.

If I had a client or program that could tell ip's... I'd post each one I find.


Do you also have Protowall installed as an extra block?

[ Add all 2 links to your ed2k client ]


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:09 pm  Post subject:
Reply with quote
User avatar
Offline

Site Admin
Joined: Sat Nov 02, 2002 1:35 am
Posts: 19782
Location: En España
d0c wrote:
so this is the end of the emule....?


I've always wondered... are you one of those NWO freaks d0c? :mrgreen:
Always dwindle on the imposibilites/negatives/non-existant theories... :D

Anyways, these clients register as "new MLdonkey" because their client id isn't recognized. They'll probably just be added to the leech client list and filtered in the next new update of emule, or at least that is the likely course of action.

Currently I think these cover the ip ranges though?

Code:
038.115.000.000-038.119.255.255,000, fake mldonkey
063.241.036.000-063.241.036.255,000, fake mldonkey
062.241.036.000-062.241.036.255,000, fake mldonkey
066.036.240.000-066.036.255.255,000, fake mldonkey
066.054.073.000-066.054.255.255,000, fake mldonkey
066.117.000.000-066.117.255.255,000, fake mldonkey
194.165.000.000-194.165.255.255,000, fake mldonkey
209.133.042.000-209.133.042.255,000, fake mldonkey
38.113.196.0 - 38.113.196.255 , 100 , mldonkey 2-byte corruptions (Performance Systems Inc.)
38.115.4.0 - 38.115.4.255 , 100 , mldonkey 2-byte corruptions (Performance Systems Inc.)
38.117.6.0 - 38.117.6.255 , 100 , mldonkey 2-byte corruptions (Performance Systems Inc.)
209.133.42.0 - 209.133.42.255 , 100 , mldonkey 2-byte corruptions (Abovenet Inc. NY)
66.54.72.0 - 66.54.72.255 , 100 , mldonkey 2-byte corruptions (NHI Networks, LA)
66.54.77.0 - 66.54.77.255 , 100 , mldonkey 2-byte corruptions (Abovenet Inc. NY)
66.36.243.0 - 66.36.243.255 , 100 , mldonkey 2-byte corruptions (HopOne Int. Corp, DC)
207.234.185.0 - 207.234.185.255 , 100 , mldonkey 2-byte corruptions (CyberGate, Inc. FL)

_________________
Mouse nipple for the win! Trackpoint or death!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:17 pm  Post subject:
Reply with quote
User avatar
Offline

The Ancient One
Joined: Thu Feb 13, 2003 6:07 pm
Posts: 4463
Location: The Cellar
lol @spud, i guess i am a little bit.... but dont worry :)

_________________
Image
STR - Dead but not forgotten!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:22 pm  Post subject:
Reply with quote
User avatar
Offline

Site Admin
Joined: Sat Nov 02, 2002 1:35 am
Posts: 19782
Location: En España
I don't need to, the NWO people do all the worrying anyone would ever need. Just watched this:
http://www.fileheaven.org/forum/viewtopic.php?t=34153

That dude is freaking wacko!
:-o

_________________
Mouse nipple for the win! Trackpoint or death!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:27 pm  Post subject:
Reply with quote
User avatar
Offline

The Ancient One
Joined: Thu Feb 13, 2003 6:07 pm
Posts: 4463
Location: The Cellar
i logged in and i got this --> The topic or post you requested does not exist..... guess i was to late..

_________________
Image
STR - Dead but not forgotten!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:32 pm  Post subject:
Reply with quote
User avatar
Offline

Site Admin
Joined: Sat Nov 02, 2002 1:35 am
Posts: 19782
Location: En España
or ur banned from fileheaven:
raf111 wrote:
911 The road to tyranny.
Watch it, You won't believe that sh*t!

Ok. here are BT links...

911 in plane site-this documentary is focused on the technical side of the 911 planes and proves what really happened there.
911 the road to tyranny- Real evidence that seem to prove that US government is responsible for the 911 attack, plus few other "great" ideas that government wants to implement in the near future like NWO (New World Order). NWO is wider disscused in the second part from this series called "Police state-total enslavement" but I can't find this link so do a search yourselves.

---

I've noticed that a lot of ppl request a ed2k links, which proves that not too many ppl are familiar with BT. For those interested in BT I recomend the "Azureus" client. This program is great. As long you won't move any file you've downloaded, the "Azureus" will decide for you, which file is needed most at the moment.(don't have a lik, do a search)Oh... and to get what you want go to http://www.suprnova.org

eazbak wrote:
The Road to Tyranny can be downloaded directly from archive.org

The best quality is 244MB WMV... >> click <<

also on direct download there is Masters of Terror... sequel? >> click <<

:love:

@ raf111 : Don't you find Alex a little bit paranoid? :o


+a lengthy discussion about how funny/bs/truthful the documentry is.

_________________
Mouse nipple for the win! Trackpoint or death!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:41 pm  Post subject:
Reply with quote
User avatar
Offline

The Ancient One
Joined: Thu Feb 13, 2003 6:07 pm
Posts: 4463
Location: The Cellar
i am not banned from fh i can read all the other pages except that one.... strange... anyway thanks for the read....

_________________
Image
STR - Dead but not forgotten!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:45 pm  Post subject:
Reply with quote
User avatar
Offline

Site Admin
Joined: Sat Nov 02, 2002 1:35 am
Posts: 19782
Location: En España
get the direct 244mb WMV, totally paranoid doomsday stuff :lol:

_________________
Mouse nipple for the win! Trackpoint or death!


Top
 Profile  
PostPosted: Tue Aug 10, 2004 4:48 pm  Post subject:
Reply with quote
User avatar
Offline

The Devil, Probably
Joined: Thu Jul 03, 2003 9:45 pm
Posts: 2321
Location: The Land Of The Virgin Queen
Grindhouse wrote:
Do you also have Protowall installed as an extra block?


Might not be up on my Protowall abilities, but doesn't it suffer from the same limitations as any other "blocker". Don't you have to have the ip range set before it blocks? That's the biggest thing knowing the darn ip's.

@Spud
I'd already added those ip ranges to my downloaded ipfilter.dat. Hopefully you're right about upcoming versions of the mule kicking those clients out.

Anybody try those files?.... :lol: , come on click them, click them Bob Harris, click them... :lol:

_________________
Image_____________Now I Wanna Sniff Some Glue..._____________


Top
 Profile  
PostPosted: Tue Aug 10, 2004 6:39 pm  Post subject:
Reply with quote
User avatar
Offline

Demon Of The Abyss
Joined: Tue Jan 20, 2004 7:18 pm
Posts: 1426
Location: A padded cell
karstmobile wrote:
Grindhouse wrote:
Do you also have Protowall installed as an extra block?


Might not be up on my Protowall abilities, but doesn't it suffer from the same limitations as any other "blocker". Don't you have to have the ip range set before it blocks? That's the biggest thing knowing the darn ip's.

You could always use the Blocklist Manager along with Protowall, u need a pretty beefy PC to run it these days though.


Top
 Profile  
PostPosted: Tue Aug 10, 2004 7:54 pm  Post subject:
Reply with quote
User avatar
Offline

The Devil, Probably
Joined: Thu Jul 03, 2003 9:45 pm
Posts: 2321
Location: The Land Of The Virgin Queen
Here's what I've added at the end of my ipfilter.dat, more or less a collection of all that has been reported, and then cleaned up.

Code:
038.000.000.000 - 038.255.255.255 , 000 , fake mldonkey (Performance Systems)
062.000.000.000 - 062.255.255.255 , 000 , fake mldonkey (RIPE Network, NL)
063.240.000.000 - 063.242.255.255 , 000 , fake mldonkey (CERFnet)
065.019.128.000 - 065.019.191.255 , 000 , fake mldonkey (Hurricane Electric)
066.036.224.000 - 066.036.255.255 , 000 , fake mldonkey (HopOne Int. Corp, DC)
066.054.064.000 - 066.054.111.255 , 000 , fake mldonkey (NHI Networks, LA)
066.117.000.000 - 066.117.031.255 , 000 , fake mldonkey (New Horizon Coll, LA)
067.015.000.000 - 067.015.111.255 , 000 , fake mldoneky (Everyones Internet Inc., TX)
194.000.000.000 - 194.255.255.255 , 000 , fake mldonkey (RIPE Network, NL)
198.087.000.000 - 198.088.255.255 , 000 , fake mldonkey (Verio Inc., CO)
207.234.128.000 - 207.234.225.255 , 000 , fake mldonkey (CyberGate Inc., FL)
209.133.000.000 - 209.133.127.255 , 000 , fake mldonkey (Abovenet Inc., NY)


They recommend a restart of the mule after an edit of the ipfilter.dat. So far none since the restart, and plenty blocked.

_________________
Image_____________Now I Wanna Sniff Some Glue..._____________


Top
 Profile  
Display posts from previous:  Sort by  

All times are UTC [ DST ]

Post new topic Reply to topic  [ 17 posts ] 


Who is online

Users browsing this forum: No registered users and 20 guests


Moderator: Help Mods

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Frontpage / Forums / Scifi


What's blood for, if not for shedding?