[CRTech] Christian Radio Tech [MSG 79170]
[Thread Prev] [-- Thread Index --] [Thread Next] [Date Prev] [-- Date Index --] [Date Next]
Re: hacking continued
To: CRTech <crtech@crtech.org>
Subject: Re: hacking continued
From: Terry Cowan <tcowan@knlr.com>
Date: Tue, 14 Mar 2017 09:11:32 -0700
In-reply-to: <CA+0ZtTbaKdN5=+5Az7+QMLY2bJSmn-5ZpVyAHTA5TQ+xg=-uDg@mail.gmail.com>
References: <812f36bb-e2cc-bf85-ba40-df7d81d2e32b@knlr.com> <CA+0ZtTbaKdN5=+5Az7+QMLY2bJSmn-5ZpVyAHTA5TQ+xg=-uDg@mail.gmail.com>
User-agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0

I have checked several in Who is and they have come back as known hackers

Terry


89.248.167.131 was found in our database!

This IP was reported 300 times. See below for details.

ISP Novogara LTD
Hostname mason.census.shodan.io
Organization Quasi Networks
Connection Type Cable/DSL
Country  Netherlands
City Unknown
On 03/14/17 08:45, Matthew Chambers wrote:
I'd be wondering if there is any pattern to where those IP addresses belong to?

Matthew A. Chambers, NR0Q



On Tue, Mar 14, 2017 at 10:43 AM, Terry Cowan <tcowan@knlr.com> wrote:

Several weeks ago we found "tone" on some of our programs.  Apparently our AMBOS receiver was hacked and the tone generator turned on.  True the receiver was port forwarded without protection.  So I created a program and redirected that port to it to see if we were being hacked.  Here is the log of the "hacking". 

Terry Cowan

KNLR/KNLX

03/04/17 22:27:14 89.248.167.131
03/05/17 14:40:31 177.140.27.47
03/05/17 14:40:31 177.140.27.47
03/10/17 08:52:24 94.102.49.190
03/13/17 08:11:57 189.34.242.231
03/13/17 08:11:58 189.34.242.231
03/14/17 04:07:58 86.110.119.19





Follow-Ups: Re: hacking continued
(Matthew Chambers <mchambers@showmeham.info>, 14 Mar 2017 16:14:42 -0000)
References: hacking continued
(Terry Cowan <tcowan@knlr.com>, 14 Mar 2017 15:43:11 -0000)
Re: hacking continued
(Matthew Chambers <mchambers@showmeham.info>, 14 Mar 2017 15:45:06 -0000)
Prev by date: Re: hacking continued
(Shane Toven, 14 Mar 2017 15:47:05 -0000)
Next by date: Re: hacking continued
(Matthew Chambers, 14 Mar 2017 16:14:42 -0000)
Prev by thread: Re: hacking continued
(Shane Toven, 14 Mar 2017 15:47:05 -0000)
Next by thread: Re: hacking continued
(Matthew Chambers, 14 Mar 2017 16:14:42 -0000)
CRTech.org