MLDonkey attack

karstmobile · **Posted:** Tue Aug 10, 2004 12:16 pm **Post subject:** MLDonkey attack

Has anyone else been plagued by the corrupt chunk inducing bastards from hell?

-multiple MLDonkey clients sending only a few kbs to corrupt your download
-they attack different versions of the same file, that is they are on a 1cd and a 2cd release
-must use ipfilter to block
-not really MLDonkey clients

Its a known problem. First time its happened to me though. I'd lost over the size of the file due to corruption before getting a working ipfilter.dat.

Anyone know of a program to figure out the ip addresses from the userhash? The newest Neo Mule doesn't display the ip, only server.

graag · **Posted:** Tue Aug 10, 2004 1:18 pm **Post subject:**

Userhash <> IP, UserID = IP (if they have High ID)

spudthedestroyer · **Posted:** Tue Aug 10, 2004 1:21 pm **Post subject:**

userhash is unrelated to ip, you can get ip for id though. There's a program called idtoip or something like that, please post any bad ranges. Although I haven't suffered from it personally, there's a big topic @ fh

edit: but it seems it doesn't show id either

sparhawk · **Posted:** Tue Aug 10, 2004 1:35 pm **Post subject:**

Well they are not actually MLDonkey but just pretend to be.

There is a five page thread on this at the official emule forum:
http://forum.emule-project.net/index.ph ... opic=53778

The other advice appears to be to use a mod that displays the ip numbers of clients and manually add that to the ip filter.

karstmobile · **Posted:** Tue Aug 10, 2004 3:23 pm **Post subject:**

It's only two files right now:

ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD1.avi [700.33 Mb] [Stats]
ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD2.avi [697.98 Mb] [Stats]

The .ogm verison also suffers the same problem. If you want to have some fun and see what I'm talking about, give them a click. :lol:

Been to different forums about it, even the official emule forum. Tried the program you mentioned Spud. Was thinking of changing clients to get an ip but I'll just suffer through it. Thankfully VeryCD is spreading the files. :wink:

One good thing... current ipfilters block 99% of them. Only have a couple show up now and then, but damn at the damage they cause. If this becomes a common thing, it would cripple the network.

If I had a client or program that could tell ip's... I'd post each one I find.

[ Add all 2 links to your ed2k client ]

d0c · **Posted:** Tue Aug 10, 2004 3:37 pm **Post subject:**

so this is the end of the emule....?

Grindhouse · **Posted:** Tue Aug 10, 2004 3:55 pm **Post subject:**

karstmobile wrote:

It's only two files right now:

ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD1.avi [700.33 Mb] [Stats]
ed2k: The.Stepford.Wives.1975.iNT.DVDRip.XviD-PoD.CD2.avi [697.98 Mb] [Stats]

The .ogm verison also suffers the same problem. If you want to have some fun and see what I'm talking about, give them a click. :lol:

Been to different forums about it, even the official emule forum. Tried the program you mentioned Spud. Was thinking of changing clients to get an ip but I'll just suffer through it. Thankfully VeryCD is spreading the files. :wink:

One good thing... current ipfilters block 99% of them. Only have a couple show up now and then, but damn at the damage they cause. If this becomes a common thing, it would cripple the network.

If I had a client or program that could tell ip's... I'd post each one I find.

Do you also have Protowall installed as an extra block?

[ Add all 2 links to your ed2k client ]

spudthedestroyer · **Posted:** Tue Aug 10, 2004 4:09 pm **Post subject:**

d0c wrote:

so this is the end of the emule....?

I've always wondered... are you one of those NWO freaks d0c? :mrgreen:

Always dwindle on the imposibilites/negatives/non-existant theories...

Anyways, these clients register as "new MLdonkey" because their client id isn't recognized. They'll probably just be added to the leech client list and filtered in the next new update of emule, or at least that is the likely course of action.

Currently I think these cover the ip ranges though?

Code:

115.000.000-038.119.255.255,000, fake mldonkey
241.036.000-063.241.036.255,000, fake mldonkey
241.036.000-062.241.036.255,000, fake mldonkey
036.240.000-066.036.255.255,000, fake mldonkey
054.073.000-066.054.255.255,000, fake mldonkey
117.000.000-066.117.255.255,000, fake mldonkey
165.000.000-194.165.255.255,000, fake mldonkey
133.042.000-209.133.042.255,000, fake mldonkey
113.196.0 - 38.113.196.255 , 100 , mldonkey 2-byte corruptions (Performance Systems Inc.)
115.4.0 - 38.115.4.255 , 100 , mldonkey 2-byte corruptions (Performance Systems Inc.)
117.6.0 - 38.117.6.255 , 100 , mldonkey 2-byte corruptions (Performance Systems Inc.)
133.42.0 - 209.133.42.255 , 100 , mldonkey 2-byte corruptions (Abovenet Inc. NY)
54.72.0 - 66.54.72.255 , 100 , mldonkey 2-byte corruptions (NHI Networks, LA)
54.77.0 - 66.54.77.255 , 100 , mldonkey 2-byte corruptions (Abovenet Inc. NY)
36.243.0 - 66.36.243.255 , 100 , mldonkey 2-byte corruptions (HopOne Int. Corp, DC)
234.185.0 - 207.234.185.255 , 100 , mldonkey 2-byte corruptions (CyberGate, Inc. FL)

d0c · **Posted:** Tue Aug 10, 2004 4:17 pm **Post subject:**

lol @spud, i guess i am a little bit.... but dont worry

spudthedestroyer · **Posted:** Tue Aug 10, 2004 4:22 pm **Post subject:**

I don't need to, the NWO people do all the worrying anyone would ever need. Just watched this:
http://www.fileheaven.org/forum/viewtopic.php?t=34153

That dude is freaking wacko!
:-o

d0c · **Posted:** Tue Aug 10, 2004 4:27 pm **Post subject:**

i logged in and i got this --> The topic or post you requested does not exist..... guess i was to late..

spudthedestroyer · **Posted:** Tue Aug 10, 2004 4:32 pm **Post subject:**

or ur banned from fileheaven:

raf111 wrote:

911 The road to tyranny.
Watch it, You won't believe that sh*t!

Ok. here are BT links...

911 in plane site-this documentary is focused on the technical side of the 911 planes and proves what really happened there.
911 the road to tyranny- Real evidence that seem to prove that US government is responsible for the 911 attack, plus few other "great" ideas that government wants to implement in the near future like NWO (New World Order). NWO is wider disscused in the second part from this series called "Police state-total enslavement" but I can't find this link so do a search yourselves.

---

I've noticed that a lot of ppl request a ed2k links, which proves that not too many ppl are familiar with BT. For those interested in BT I recomend the "Azureus" client. This program is great. As long you won't move any file you've downloaded, the "Azureus" will decide for you, which file is needed most at the moment.(don't have a lik, do a search)Oh... and to get what you want go to http://www.suprnova.org

eazbak wrote:

The Road to Tyranny can be downloaded directly from archive.org

The best quality is 244MB WMV... >> click <<

also on direct download there is Masters of Terror... sequel? >> click <<

:love:

@ raf111 : Don't you find Alex a little bit paranoid?

+a lengthy discussion about how funny/bs/truthful the documentry is.

d0c · **Posted:** Tue Aug 10, 2004 4:41 pm **Post subject:**

i am not banned from fh i can read all the other pages except that one.... strange... anyway thanks for the read....

spudthedestroyer · **Posted:** Tue Aug 10, 2004 4:45 pm **Post subject:**

get the direct 244mb WMV, totally paranoid doomsday stuff :lol:

karstmobile · **Posted:** Tue Aug 10, 2004 4:48 pm **Post subject:**

Grindhouse wrote:

Do you also have Protowall installed as an extra block?

Might not be up on my Protowall abilities, but doesn't it suffer from the same limitations as any other "blocker". Don't you have to have the ip range set before it blocks? That's the biggest thing knowing the darn ip's.

@Spud
I'd already added those ip ranges to my downloaded ipfilter.dat. Hopefully you're right about upcoming versions of the mule kicking those clients out.

Anybody try those files?.... :lol:

, come on click them, click them Bob Harris, click them... :lol:

George Tatum · **Posted:** Tue Aug 10, 2004 6:39 pm **Post subject:**

karstmobile wrote:

Grindhouse wrote:

Do you also have Protowall installed as an extra block?

Might not be up on my Protowall abilities, but doesn't it suffer from the same limitations as any other "blocker". Don't you have to have the ip range set before it blocks? That's the biggest thing knowing the darn ip's.

You could always use the Blocklist Manager along with Protowall, u need a pretty beefy PC to run it these days though.

karstmobile · **Posted:** Tue Aug 10, 2004 7:54 pm **Post subject:**

Here's what I've added at the end of my ipfilter.dat, more or less a collection of all that has been reported, and then cleaned up.

Code:

000.000.000 - 038.255.255.255 , 000 , fake mldonkey (Performance Systems)
000.000.000 - 062.255.255.255 , 000 , fake mldonkey (RIPE Network, NL)
240.000.000 - 063.242.255.255 , 000 , fake mldonkey (CERFnet)
019.128.000 - 065.019.191.255 , 000 , fake mldonkey (Hurricane Electric)
036.224.000 - 066.036.255.255 , 000 , fake mldonkey (HopOne Int. Corp, DC)
054.064.000 - 066.054.111.255 , 000 , fake mldonkey (NHI Networks, LA)
117.000.000 - 066.117.031.255 , 000 , fake mldonkey (New Horizon Coll, LA)
015.000.000 - 067.015.111.255 , 000 , fake mldoneky (Everyones Internet Inc., TX)
000.000.000 - 194.255.255.255 , 000 , fake mldonkey (RIPE Network, NL)
087.000.000 - 198.088.255.255 , 000 , fake mldonkey (Verio Inc., CO)
234.128.000 - 207.234.225.255 , 000 , fake mldonkey (CyberGate Inc., FL)
133.000.000 - 209.133.127.255 , 000 , fake mldonkey (Abovenet Inc., NY)

They recommend a restart of the mule after an edit of the ipfilter.dat. So far none since the restart, and plenty blocked.

MLDonkey attack

Who is online