Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Apparently they did more. On 8th Feb, I had these two IP addresses checking out my who.is page.

64.246.165.10

216.145.14.142

I was certainly only curious, because it was a unpublished website with deny-all for all robots., so tried a reverse-ip using Who.is; To my surprise, the who.is page for the above two I.P. didn't load, thought it was maybe my connection, but then, when I used Whois.net to end up with the same result, I knew something was going on.

It was only after I googled the I.P address I found some dutch reverse I.P sites that said it was from comcast servers. Though I have nothing worth hiding, and it was just a testing ground for me, this was apparently not nice. I only got to know about the hack yesterday.

Perhaps they bulk collected data, using comcast servers?



Those IPs have nothing to do with Comcast; they're not owned, hosted by or routed through Comcast. They both resolve to whois.sc -- a whois lookup site; indexing whois records is what they do.

    # nslookup 64.246.165.10
    10.165.246.64.in-addr.arpa      name = www.whois.sc.

    # nslookup 216.145.14.142
    142.14.145.216.in-addr.arpa     name = www.whois.sc.


How do you find who's being doing a whois on you?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: