Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: nsp: ipv6

Where are all those Teredo servers coming from?

 

 

nsp ipv6 RSS feed   Index | Next | Previous | View Threaded


evyncke at cisco

Jul 1, 2012, 11:53 AM

Post #1 of 3 (484 views)
Permalink
Where are all those Teredo servers coming from?

As you may know, I am running a pseudo BitTorrent client to collect IPv6 addresses (http://www.vyncke.org/ipv6status/p2p.php) but this WE when running the collecting program, I was amazed by the number of Teredo servers (there are usually just 4 or 5 all based in Microsoft). This WE I saw dozens of them, most of those 'new' servers are used only by one single client... and they are located everywhere !

Any idea? A new feature of Windows? Or of a bittorrent peer (to obfuscate the P2P traffic? Wrongly configured Windows machines? )

See below a copy of a couple of Teredo servers:
2001:0:142e:1f*:0:12f0:92b7:6c* = 20.46.31.* (client: 109.72.147.*)
2001:0:1a94:63*:0:2aac:92b7:6c* = 26.148.99.* (client: 109.72.147.*)
2001:0:1b76:ce*:0:1834:a30f:25* = 27.118.206.* (client: 92.240.218.*)
2001:0:26b1:6d*:0:375c:92b7:66* = 38.177.109.* (client: 109.72.147.*)
2001:0:2859:73*:0:46b7:92b7:6d* = 40.89.115.* (client: 109.72.146.*)
2001:0:2c03:c7*:0:1d6a:92b7:6d* = 44.3.199.* (client: 109.72.146.*)

Any piece of information will be welcome of course

-puzzled-éric


jeroen at unfix

Jul 2, 2012, 12:11 AM

Post #2 of 3 (438 views)
Permalink
Re: Where are all those Teredo servers coming from? [In reply to]

On 2012-07-01 20:53, Eric Vyncke (evyncke) wrote:
[..]
> Any piece of information will be welcome of course

% Information related to '109.72.146.0 - 109.72.147.255'

inetnum: 109.72.146.0 - 109.72.147.255
netname: piratepay-net
descr: Internet Content LLC
country: UA

That can be interesting at least ;)

Greets,
Jeroen


brandon at bogons

Jul 2, 2012, 12:33 AM

Post #3 of 3 (436 views)
Permalink
Re: Where are all those Teredo servers coming from? [In reply to]

On Mon Jul 02, 2012 at 09:11:36AM +0200, Jeroen Massar wrote:
> > Any piece of information will be welcome of course
>
> % Information related to '109.72.146.0 - 109.72.147.255'
>
> inetnum: 109.72.146.0 - 109.72.147.255
> netname: piratepay-net
> descr: Internet Content LLC
> country: UA
>
> That can be interesting at least ;)

They probably thought a ready made MITM vector was
too good an opportunity to miss. Pirate cloud.

brandon

nsp ipv6 RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.