Help Me Please. Unsure if hoax!!

Printable View

March 21st, 2003, 01:00 PM
THEprophetMOSES

Help Me Please. Unsure if hoax!!

Tonight i had a conversation with an unknown person. He/she was saying stuff that i dont know whether to believe. She tracked me down on ICQ, which i have not told anyone my UIN, she also found that i used arbornet which i only joined about a week ago and she had my ip address.

so she knew it was me on icq. one thing that made me doubt is the fact that she said

Quote:

i am... network engineer for your isp.

she said i was with a different isp than i am and why did she not say

Quote:

i am... network engineer for Telstra bigpond or what ever my isp may be.

also the isp that she mentioned, commindico, i was having trouble with one of their users constantly probing my computer, over 1500 attacks in 1 week! i did nothing in return to that and it eventually stopped.

please read it for me and give me your views. im not sure what to think about it.

she is 172232783/maria
i am Aeseroth Galanodel

Quote:

172232783: hey [Offline Message (3/19/2003 [2:44])]
172232783: here? [Offline Message (3/19/2003 [2:44])]
172232783: hello? [Offline Message (3/19/2003 [2:49])]
172232783: hi [Offline Message (3/20/2003 [9:08])]
Aeseroth Galanodel: yes who are you??
172232783: hi
Aeseroth Galanodel: hey
Aeseroth Galanodel: who r u exactly?? and o i know you??
172232783: no, but i know you
Aeseroth Galanodel: yes who are you??
172232783: just a messenger.
Aeseroth Galanodel: messenger form whom?
Aeseroth Galanodel: from*
Aeseroth Galanodel: nah really, WHO ARE YOU??
Aeseroth Galanodel: hello?
Aeseroth Galanodel: yes maria who are u?
maria: 203.220.225.70
maria: why did you attack unixcon
maria: ;)
Aeseroth Galanodel: unixcon??
Aeseroth Galanodel: what the...? im not into the blackhat stuff
maria: heh
maria: strange, seems arbornet and your ISP have been monitoring you for some time now.
Aeseroth Galanodel: what the??
maria: you heard.
Aeseroth Galanodel: nope?
Aeseroth Galanodel: what are you talking about
Aeseroth Galanodel: what the hell is unixcon??
Aeseroth Galanodel: whats the name of my isp
maria: comindico
maria: i have your location
maria: the FBI where interested also.
maria: along with the NHTCU
Aeseroth Galanodel: comindico is not my isp, i had problemsd with a user on comindixco a few months ago flooding me
maria: i suggest you stop attacking businesses.
Aeseroth Galanodel: but i did notthing in return
maria: listen
Aeseroth Galanodel: what
maria: do not lie to me because im a cisco cert CCNP network engineer for your ISP
maria: and packets from the library on the router are logged
Aeseroth Galanodel: my isp is nmot commindico!!!
maria: and i clearly see you talking on here
maria: 203.220.225.70
maria: inetnum: 203.220.0.0 - 203.220.255.255
netname: COMINDICO
descr: COMindico Australia
country: AU
Aeseroth Galanodel: what the hell im with dodo
maria: heh
Aeseroth Galanodel: seriously i have no clue what u are talking about
Aeseroth Galanodel: and as for arvornet i only recently joined about a week ago
Aeseroth Galanodel: arbor*
Aeseroth Galanodel: DoDo is my isp
maria: well this is your first and last warning, if we receieve anymore attacks, im going straight to authorities to have you arrested. i don't care what you say or do because i know you are behind it.
maria: if i so much as see one little packet more than i should im going to be on your ass as fast as you can say no
maria: goodbye.
*** maria signed off at Fri Mar 21 21:21:47 2003.
Aeseroth Galanodel: no really i dont have a clkue what u r talking abouit

i realise in hindsight that i shouldnt have told her my real isp and that that was pretty dumb but i assure you that everything i said in that conversation is true!

i straight away told one of my friends and this is the convo we had

he is Grand Master of the Knights Militant
i am aeseroth galanodel

Quote:

Grand Master of the Knights Militant: Interesting...a hoax perhaps?
Aeseroth Galanodel: i dont know what to think!!
Aeseroth Galanodel: i was registered with arbornet
Grand Master of the Knights Militant: Don't worry about the FBI has no juristiction in Australia
Aeseroth Galanodel: and about 3months ago i was having constant attacks from a machine at commindico
Aeseroth Galanodel: maybe something was going on trhere
Grand Master of the Knights Militant: Some hacker it sounds like has hijakced and used your isp to cover his own tracks
Aeseroth Galanodel: mmm... maybe
Aeseroth Galanodel: soiunds plausiblke
Aeseroth Galanodel: sounds plausible*
Grand Master of the Knights Militant: Just in case it turns out serious make a copy of this conversation, print it off, show your parentals and keep it say somewhere
Aeseroth Galanodel: mmm... i should
Grand Master of the Knights Militant: *say = safe. It may be worth freaking you parents out in the short term to say your ass in the long term
Aeseroth Galanodel: yes i know
Aeseroth Galanodel: thanks a bunch nathan
Grand Master of the Knights Militant: You're welcome. Keep a record of all further conversation with this maria in the future too and try not to keep any personal stuff on where you live on your computer
Aeseroth Galanodel: yeza
Grand Master of the Knights Militant: Can't make the FBI's job too easy now can we?
Grand Master of the Knights Militant: :P
Aeseroth Galanodel: mmm...
Grand Master of the Knights Militant: My money is on some ameteur hacker who has too much time on his hands and traced your address.
Aeseroth Galanodel: ok... brb please doint leave yet... okay
Grand Master of the Knights Militant: As you wish
Aeseroth Galanodel: im bac k
Grand Master of the Knights Militant: All hunky-dorey?
Aeseroth Galanodel: nope i was just setting up the printer
Grand Master of the Knights Militant: Ah, say...it would be levi would it?
Grand Master of the Knights Militant: *wouldn't
Aeseroth Galanodel: i dont think so they used icq to contact me and levi has never used thgat
Aeseroth Galanodel: im goiung to shgow my parents now brb
Aeseroth Galanodel: may be a while
Grand Master of the Knights Militant: Very well. If I am not here when you get back I wish you good luck.
Aeseroth Galanodel: ok mums reading it now
Aeseroth Galanodel: i also asked mundy to take a look

he seemed to think it was a hoax too. i showed my parents the convo anyway they said i should ring my isp and just let them know incase something is happeneing.

so please please please tell me your thoughts on what to do and if possible please email me at [email protected].

thankyou and sorry about the length :)
March 21st, 2003, 01:23 PM
SirDice

Do you run any proxy software on your machine? Are you sure your machine is clean (ie no backdoors)?

If everything is clean and you don't run an open proxy, you're probably not the one 'they' are looking for.

If you do find some backdoor or an open proxy, the attack might have been done through this. That's how your IP may have showed up.
March 21st, 2003, 01:28 PM
THEprophetMOSES

i am running a proxy server.
and i run nod32 av but its outdated and i hav no $$ for updates i was also running black ice IDS on the proxy but when i reformatted i forgot to put it back on. i should do that eh. im pretty sure its back door free but since i have outdated av software i cant be sure. anyone got ways to tes?
March 21st, 2003, 01:37 PM
MrLinus

I'd do some scans on your proxy (nmap/nessus). See what ports are open. Also check services that might be running as well. You might want to download The Cleaner to see if any trojans on are in (I'm assuming it's Win?)

It could be a hoax (I'd find it really odd for someone to use ICQ if they have issues with you.. usually it's email) but at the same time doesn't hurt to be a bit paranoid about the proxy.
March 21st, 2003, 01:55 PM
SirDice

Oh. And on the topic of him/her finding your ISP. That's the easy part. If they know your IP (which they do if you use ICQ) they can use whois to find out what ISP that IP address belongs to.

I have to agree with MsMittens about dealing with these kinds of issues. If someone complained to your ISP about abuse, your ISP usually tries to contact you by email. In rare cases your ISP might use the phone. They rarely (if ever) use ICQ to contact you about this. If your ISP cannot reach you for some reason and they have strong evidence of abuse, they will just disconnect you and wait for you to call them.

I do urge you to check your proxy configuration to make sure you don't run an open proxy.
March 21st, 2003, 02:03 PM
THEprophetMOSES

i am currently scanning the open ports on my proxy and will post the ones i find with a list of the legitamate ones and their uses. but i tried to view her details on icq and it showed her ip as "0.0.0.0" well thats great i thought! what would that mean and why would they do that. and why also would they say i was using commindico when im not.

Oh and another thing, how were they able to trace me to arbornet when i used only fake info about myself. the only real information was my handle"THEprophetMOSES" and what hardware i have.

and she said she traced me to commindico which is an australian isp and i live in autralia but i dont and have never used commindico as my isp!
March 21st, 2003, 02:11 PM
MrLinus

I'd say it's a hoax. If it is a rep of the company they certainly wouldn't hide their true IP address. (which is what the 0 addy is). I think it was a social engineering exercise.
March 21st, 2003, 02:13 PM
THEprophetMOSES

mmm... i guess so. but i think ill let my isp know anyway just incase something happens.

thanks alot and keep sending new suggestions.
March 21st, 2003, 02:17 PM
SirDice

Quote:

Originally posted here by THEprophetMOSES
i am currently scanning the open ports on my proxy and will post the ones i find with a list of the legitamate ones and their uses. but i tried to view her details on icq and it showed her ip as "0.0.0.0" well thats great i thought! what would that mean and why would they do that. and why also would they say i was using commindico when im not.

Your ISP may use some range owned by commindico. It's not uncommon for an ISP to rent IP ranges from bigger ISP's.

Maybe you should check this out:
http://postmaster.info.aol.com/ops.html
March 21st, 2003, 02:19 PM
cgkanchi

I did a quick nslookup on 203.220.225.70, and the results were:

Quote:

Name: dialup-70.225.220.203.acc01-walk-gaw.comindico.com.au
Address: 203.220.225.70

Your IP is owned by comindico. That's why the person thought you were using Comindico. Also, are you going through a proxy at that address or is (was) that your real IP? If it wasn't your real IP, I don't think you have anything to worry about as they don't even know your real IP. Otherwise, I don't knw why it resolves to comindico.
Cheers,
cgkanchi
March 21st, 2003, 02:41 PM
THEprophetMOSES

it was my real ip address, but thanks anyway. mmm... commindico. i got no idea if my isp serves me off to commindico i beleive you that the ip is owned by them but i dont think we go through their proxy.

well i have scanned ports 1-10,000 and this is what ive found
Port Found On: 21
Port Found On: 23
Port Found On: 25
Port Found On: 53
Port Found On: 80
Port Found On: 110
Port Found On: 139
Port Found On: 1080
Port Found On: 1090
Port Found On: 5376
Port Found On: 5888
Port Found On: 6400

the legitimate ports on the proxy are:
80
21
23
1080
1090
i also have pop3 and smtp running whatever ports they are on, i dontr exectly know.
i stopped at 10,000 because it is now about 12:15am and i actually have to get up in the morning and i cant have the internet on all night because my parents will go psycho!
any way thanks and seeyas!
March 21st, 2003, 02:58 PM
cgkanchi

Sounds like you need a good firewall.... (Might I suggest an old 486 running OpenBSD or FreeBSD or LOAF or LRP)
Cheers,
cgkanchi
March 21st, 2003, 04:16 PM
SirDice

Quote:

Originally posted here by THEprophetMOSES
well i have scanned ports 1-10,000 and this is what ive found
Port Found On: 21
Port Found On: 23
Port Found On: 25
Port Found On: 53
Port Found On: 80
Port Found On: 110
Port Found On: 139
Port Found On: 1080
Port Found On: 1090
Port Found On: 5376
Port Found On: 5888
Port Found On: 6400

the legitimate ports on the proxy are:
80
21
23
1080
1090
i also have pop3 and smtp running whatever ports they are on, i dontr exectly know.

SMTP runs on 25 and pop3 on 110. Now this is what I like to call a Christmas tree. All those open ports. You are an accident waiting to happen.

Quote:

Originally posted here by cgkanchi
Sounds like you need a good firewall.... (Might I suggest an old 486 running OpenBSD or FreeBSD or LOAF or LRP)

I agree. Any kind of firewall would do. In short: close all those ports. This is probably the reason why they thought you where hacking them. Someone used you to hide their own traces.
March 21st, 2003, 04:40 PM
meloncholy

I agree. The person who contacted you is obviously not a person of authority. No one will "warn" you over a chat channel. This is a sys admin who stumbled across your ip while they were doing an audit. You can tell the person is not too experienced just by the fact they bragged they were Cisco Certified (like that was supposed to make you shake in your shoes). Most security minded people know that a badguy is usually smart enough to not luanch an attack from his own ISP. You are just a comprimised box being used (which is the case most of the time) If the FBI, or any law enforcement agency was going to do something, there would be no warning. If they actually suspected you of something criminal, they would keep silent, sit back and watch your every movement (spy) and then get a warrent and take your computer to a forensics lab. For this to happen, you would of have to have done something pretty bad. The best thing for you to do is what the other people on this board recommended. Get a firewall. Also, log everything! I'm sure this person that contacted you has been pking around in your computer as well (you have port 139 open, and by guessing how secure free your computer is, they are going through the C$ share where you forgot to password protect.) If you were to catch her, this would be illegal on her part, and if you had proof, you could press charges! Sorry, just a long ramble, but some stuff to think about......
March 21st, 2003, 04:45 PM
Collapse

Do you recognise this name on this (IRC?) server ? It is possible they met you on their, did a whois and have installed a backdoor or something. Scan For Viruses Here and get rid of the backdoor. Then get a good AV (avast is alright) and a firewall that works.
If you don't want to keep the proxy, install Sygate PF or Kerio PF .
March 21st, 2003, 05:20 PM
exodus820

i think it looks like one of these three scenarios:
1)this person thinks that you are that guy that was fukkin wid ur computer a while back (the comindico guy), possibly becuase he is using your computer as a kind of proxy attack point. this way you would take the fall for any of the comindico guy's actions. i've seen it done before. here in the states they passed a bill that would probably have a swat of feds on your arse, considering the sloppiness of this guys actions (seeing as how a mere ccnp figured 'you' out)
2)this person IS the guy that fukked wid your computer, and he/she is just being a cocknocker
3)this is just some retarded ****** wid no life who used some information he found with a tracert and a whois to scare ya. he may have thought your isp was comindico because that is the isp of the little grimlin who was in ur comp just the other day.
March 21st, 2003, 07:55 PM
AciDriveHB

exodus820, I would have made it a little more formal, but I agree. Basically this person is being attacked and thinks you are the person doing it, or it's just someone screwing with you (whether it be the person who might be using your computer as a jump point for attacking other computers or just some random ICQ/IRC/Internet user).

I would highly suggest trying to tighten your security as much as possible, as stated all above. But I would be interested what your ISP might say after you contact them about it. Then again whenever I was out in Sydney Aussie back in the summer (your winter) of '99, I heard about the 400 some trojans roaming around the ISP networks and such, and how the admins were just being total airheads about everything. So you might not get all the help you need there. But then again if you don't get help there, and try all the above, you know you can always come here for a helping hand in figuring this out!
March 22nd, 2003, 01:21 AM
z0mbi3

There is absolutely no way that this person worked for your ISP. Nobody from your ISP would identify themselves as a CCNP, how stupid. Most likely they are the person you were having trouble with just having some fun with you. Ignore them.
March 22nd, 2003, 02:07 AM
MrLinus

Actually, I wouldn't ignore what they did. As was suggested, contacting the ISP and the "parentals" are good options. The more others know, the more aware they will be. Plus it could indicate that someone is attempting to social engineer clients on the ISP, who'd be quite interested in hearing (or they should be at least) of a potential security threat.
March 22nd, 2003, 03:51 AM
THEprophetMOSES

cheers all im just about to write to my isp and let them know. i will also include a link to this thred so they can read it too. ive just installed "blackice IDS" and used "thecleaner" but it didnt find anything. and i think my proxy has built in firewall so ill have to fihure out how to close those ports. if anyones got any info on that for 602 pro lan suite lite can u put it here?
March 22nd, 2003, 05:46 AM
Ouroboros

Frankly, my 'crap detector' is sounding off like mad. Something just doesn't fit with the story.

"Aeseroth Galanodel: im goiung to shgow my parents now brb
Aeseroth Galanodel: may be a while
Grand Master of the Knights Militant: Very well. If I am not here when you get back I wish you good luck.
Aeseroth Galanodel: ok mums reading it now
Aeseroth Galanodel: i also asked mundy to take a look"

TpM - "and i run nod32 av but its outdated and i hav no $$ for updates i was also running black ice IDS on the proxy but when i reformatted i forgot to put it back on. "

TpM - "it was my real ip address, but thanks anyway. mmm... commindico. i got no idea if my isp serves me off to commindico i beleive you that the ip is owned by them but i dont think we go through their proxy.

well i have scanned ports 1-10,000 and this is what ive found
Port Found On: 21
Port Found On: 23
Port Found On: 25
Port Found On: 53
Port Found On: 80
Port Found On: 110
Port Found On: 139
Port Found On: 1080
Port Found On: 1090
Port Found On: 5376
Port Found On: 5888
Port Found On: 6400"

I find this story hard to accept...not to say that it isn't true, but hard to accept nonetheless. It seems to be lacking some key elements that would put the story together.
I hope that TpM isn't just jerking the chain...

Ouroboros
March 22nd, 2003, 08:01 AM
THEprophetMOSES

Well one of the admins from my my isp just rang and discussed it wit me. He says that they do get their ip addresses from comindico, "maria" is probably who she says she is. but even if she is american computer crime laws have no juristiction in aus so they cant do anything about it. he says that because our ips are dynamically provided, she probably was getting attacked by someone using the same ip previously. she probly just thought "mmm... ip adress" and traced it to me while i was using it. "probly just an overzealous sysadmin taking their job a bit too seriously." he told me.

anyway he told me that if she hassles me again i can tell her that if she keeps it up i can go to her employers with a complaint and get her off my back because it is harrassment. so im pretty happy with the result of that thanks alot you guys! also keep the comments coming about the ports i had open and stuff and how to fix it.

cheers all!
March 22nd, 2003, 09:19 AM
slick_shoes

Prophet, i did a little bit of research, and i found something that seems to fit into your scenario pretty snuggly... it is an ICQ trojan called"The Thing" and operates by default on port 6400, one of your open ports. It seems quite plausible that somebody used this trojan to remotely attack somebody, therefor pissing this Maria character off...

For more information on The Thing, goto:
http://www.glocksoft.com/trojan_list/The_Thing.htm

For a complete list of common trojan ports:
http://www.glocksoft.com/trojan_port.htm

You really need to be more careful about your ports! :)
slick_shoes
March 22nd, 2003, 12:33 PM
MrLinus

You know, people might want to stop scanning the IP address. I don't think that TpM gave permission for it and given that his IP changes regularly (wow! a DHCP that works!) you might be scanning someone else. Just out of consideration of the other person. It will be TpM's responsibility to look after his ports and what ones are open/closed.
March 22nd, 2003, 12:42 PM
THEprophetMOSES

yeah thanks msmittens. i just want advice on how to close them, and that trojan info was a help thanks:)
March 22nd, 2003, 12:56 PM
MrLinus

First off, get rid of services you are not running. Remark out of the services file and/or the inetd file. You should be running things off of xinet.d ideally.

2nd, put a firewall up in front of the machine and limit traffic to the ports that need activity.

If you are not sure if a port needs to stay open, go research it on Google.com . Ports like 6000 (XWindows) need only a minor change in a .xserverrc file.

BTW, to lock down Xwindows put into the .xserverrc file the following:

Quote:

X -nolisten tcp :0

If you have cash, I'd highly recommend Real World Linux Security as a good reference book to lock down your system.

Edit: d'oh! You look like you're running Windows! I should have checked. Same applies generally. Although I don't know what you need to shut off the XWindows port on Windows (other service perhaps). With Windows you need to stop services from starting at boot up. Messenger service is definately one to stop. Is it Win2K?
March 23rd, 2003, 07:10 PM
imported_nathanb33

THEprophetMOSES please don't take this the wrong way but may I make a suggestion?

In the future you may want to avoid posting such information as your IP and a list of open ports on your system in a Public Forum. You could really end up inviting a lot of trouble your way. You never know who is looking at this thread. If I were you I might consider editing my posts a bit.

Cheers.
March 24th, 2003, 10:49 AM
THEprophetMOSES

mmm... i should (embarrased smiley) thanks nathan! ill try to remember!

mmm... i should (embarrased smiley) thanks nathan! ill try to remember!

msmittens i am running win98SE wityh 602 prolan suite lite as my proxy. i hav only one other comp running off the proxy. and i now have zone alarm pro 3! YAY!
December 11th, 2003, 02:04 PM
mosborn

SirDice said, "It's not uncommon for an ISP to rent IP ranges from bigger ISP's." Is that why an IP address from one country would be shown by some IP locators to be in another country? For instance, the IP 203.210.221.235 is an ISP from Viet Nam, but IP2Location says that the physical location is Scottsdale, Arizona.

In my job as a fraud investigator for an online payment processor I frequently need to determine the physical location from which orders are placed. I'd like to understand more about how it is that some country's IP addresses sometimes appear to be physically located in another country.

Matthew
December 11th, 2003, 02:53 PM
Tiger Shark

You should probably have started a new thread with this topic rather than burying it at the bottom of an age old thread.....

The best way to determine the physical location of an ip is to tracert it thus:

tracert xxx.xxx.xxx.xxx

and then watch the right side of the screen for the resolved IP's of the routers in between. It is usually quite apparent where the endpoint is close to regardless of where the address whois' to. The following is a tracert to www.yahoo.com with the first few hops removed for my own sanity.... ;)

6 144.232.188.157 20ms 20ms 40ms TTL: 0 (sl-gw21-chi-6-1-1.sprintlink.net ok)
7 144.232.26.235 50ms 20ms 20ms TTL: 0 (sl-bb21-chi-1-0.sprintlink.net ok)
8 144.232.20.82 40ms 20ms 60ms TTL: 0 (sl-st21-chi-15-1.sprintlink.net ok)
9 208.174.226.65 30ms 30ms 30ms TTL: 0 (bpr1-so-4-0-0.chicagoequinix.cw.net ok)
10 208.175.10.237 30ms 40ms 31ms TTL: 0 (dcr2-so-4-3-0.chicago.cw.net ok)
11 206.24.226.99 60ms 50ms 50ms TTL: 0 (dcr1-loopback.washington.cw.net ok)
12 206.24.238.38 50ms 90ms 50ms TTL: 0 (bhr1-pos-10-0.sterling2dc3.cw.net ok)
13 216.109.66.98 61ms 61ms 50ms TTL: 0 (csr12-ve242.sterling2dc3.cw.net ok)
14 216.109.84.166 60ms 50ms 60ms TTL: 0 (No rDNS)
15 216.109.120.150 60ms 50ms 50ms TTL: 0 (vl32.bas1-m.dcn.yahoo.com ok)

You will notice that hops 6-10 are in Chicago, 11 is in Washington, 12 and 13 are in Sterling Virginia. The last hop is a Yahoo router... So, at the absolute minimum we know that Yahoo's web server is somewhere in DC or Northern Va. Some other digging would confirm this for you.

Now there are some riders on this. You will be doing your investigation a long time after the dirty deed too place so the IP Address may now have been picked by someone else. Furthermore, the IP address may have had an open proxy at the time of the order that may or may not be there now - thus the order might have been physically placed from the other side of the world. While I'm sure that in many cases your investigations would lead to a genuine culprit you need to be aware of the other trickery that takes place out there before you use IP address information as a major part of your case.
December 11th, 2003, 03:40 PM
mosborn

Thanks, TigerShark,

I heard from someone else about my adding to such an old thread, too. I will watch out for that if I need to post again.

While I'm still interested in learning more about IP's, traceroute, and so on, I got a reply from IP2Location that was something more simple than I expected. It's also something to keep in mind when using IP tracers: they use user feedback in their data. Someone from Viet Nam claimed to be from Arizona. IP2Location says they are now working on a new approach to reduce wrong results in the database.

Thanks again,
December 11th, 2003, 06:33 PM
souleman

mosborn> not a problem with the old threads as long as there is something relivant to add to it.... its just that a lot of people will ignore the thread when they realize it is 7 months old, so if you have a question its better to just start a new thread and ask it.
December 11th, 2003, 10:42 PM
reaper44

Icq is the easiest thing in the world to use and to find someone suggest you look at some of the (extra tools) available for the linux Licq version,If they are talking to you over icq they are obviously pulling yor chain,The F.B>I would not notify you first lol.She or He (You never know these days)is trying to social engineer you and doing a sh** job at that. make sure your box is tight,and your proxy is truly anonymous by using http://www.stayinvisible.com/index.pl/spy_cop this should give you an idea how tight your box is.
December 11th, 2003, 10:46 PM
slick8790

you obviously dont know how to read, do you reaper? the last couple of posts have been about how someone posted in a thread that is 9 months old . they have obviously solved their problem, or they would have kept posting. regardless, 9 months later, i doubt your information would be at all useful

slick
December 11th, 2003, 10:57 PM
parz

Quote:

Originally posted here by cgkanchi
I did a quick nslookup on 203.220.225.70, and the results were:

Name: dialup-70.225.220.203.acc01-walk-gaw.comindico.com.au
Address: 203.220.225.70

Your IP is owned by comindico. That's why the person thought you were using Comindico. Also, are you going through a proxy at that address or is (was) that your real IP? If it wasn't your real IP, I don't think you have anything to worry about as they don't even know your real IP. Otherwise, I don't knw why it resolves to comindico.
Cheers,
cgkanchi

Looks like he's on dialup - unless thats DSL (doubtful) - in which case, I wouldn't worry too much, since he had a dynamic IP - the only way they can trace him down is to go to his ISP, check through logs, and see who was registered to that IP at that point in time...Sounds like way to much work.