Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
we disable reverse name lookup for performance reasons. but you can use http://arin.net to look up a specific one...

I get this on my server all the time - someone popping the box with virus code (some people never learn...)
 
Mudbug said:
we disable reverse name lookup for performance reasons. but you can use http://arin.net to look up a specific one...

I get this on my server all the time - someone popping the box with virus code (some people never learn...)

Forgot about that...thanks for the reminder.

Here's the lowdown-

rgName: EarthLink Network, Inc.
OrgID: ERTH
Address: 1375 PEACHTREE ST, LEVEL A
City: ATLANTA
StateProv: GA
PostalCode: 30309
Country: US

NetRange: 207.217.0.0 - 207.217.255.255
CIDR: 207.217.0.0/16
NetName: EARTHLINK-CIDR
NetHandle: NET-207-217-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.EARTHLINK.NET
NameServer: DNS2.EARTHLINK.NET
NameServer: DNS3.EARTHLINK.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1996-10-04
Updated: 2001-10-09

TechHandle: DAE4-ARIN
TechName: Domain Administrator, Administrator
TechPhone: +1-404-815-0770
TechEmail: arinpoc@corp.earthlink.net

OrgAbuseHandle: ABUSE60-ARIN
OrgAbuseName: ABUSE TEAM
OrgAbusePhone: +1-404-815-0770
OrgAbuseEmail: abuse@abuse.earthlink.net

OrgTechHandle: ELNK-ORG-ARIN
OrgTechName: EarthLink, Inc.
OrgTechPhone: +1-404-815-0770
OrgTechEmail: arin_tech@lists.corp.earthlink.net
 
that just means someone was using Earthlink...
they're kinda big (like a needle in a haystack).

doesn't Dr.Q use earthlink? Surely he wouldn't have tried hacking in to change his status...
 
Mudbug said:
Man, you just don't give up, do you? What - do you think reminding everyone of the rules automatically will get you in with magical moderator powers? It takes a bit more than that, I'm afraid...

Yeah, you gotta kiss something. :D
 
OK, this is getting weird.

I just heard from a couple of people that Doctor Q has been PMing people for days as if he was a real moderator and claiming that he edited posts. He can't be editing posts unless he's got real moderator status. And he can't have that.
 
Rower_CPU said:
He can't be editing posts unless he's got real moderator status.

maybe he thinks he'll "earn" a promotion by pretending he got it already? :rolleyes:

if he was a real mod, he'd have the status by now...not a fake avatar stating so...

I'm surprised arn hasn't stepped in yet...
 
[28/Mar/2004:13:10:59 -0500] "GET
https://forums.macrumors.com/modcp/?u=12149 HTTP/1.1" 203 498

[28/Mar/2004:13:42:26 -0500] "GET
https://forums.macrumors.com/modcp/?u=12149 HTTP/1.1" 203 498

...a bunch more like the above...

[28/Mar/2004:15:14:30 -0500] "GET
https://forums.macrumors.com/modcp/u=12149 HTTP/1.1" 202 72544

"forums.macrumors.com/modcp" is the moderator control panel.
And notice the user number: 12149. That's Doctor Q.

All of theses probes got 203s, but the last one (2 hours later) got a 202.
 
>Rower_CPU

Those links require log-in.

Are you going to share your password or do a screen capture?

---

It's always a letdown when somebody says "hey look at this link" and points you to a registration required link.
attachment.php
 
Sun Baked said:
>Rower_CPU

Those links require log-in.

Are you going to share your password or do a screen capture?

---

It's always a letdown when somebody says "hey look at this link" and points you to a registration required link.
attachment.php

It just auto-URLed the log
 
Sun Baked said:
>Rower_CPU

Those links require log-in.

Are you going to share your password or do a screen capture?

---

It's always a letdown when somebody says "hey look at this link" and points you to a registration required link.
attachment.php

Sorry, wasn't posting for general consumption. Just pointing out to other mods where people were trying to get in.

This is a real head scratcher...
 
Sun Baked said:
There's more...
attachment.php


Run, hide ... he's got a license to kill.

Hey, that's a pretty cool emoticon there. Emphasises the point much more effectively than :eek: . Hehe.
Neat prank. I fell for it. :eek: :p
 
I was locked out for a bit earlier today..kept getting errors, busy and database errors


weirdness...

D
 
Sun Baked said:
Oh god, please don't bring up "that" thread again. :eek:

I'm sorry, but I'm unaware of "that" thread. If it makes you that uncomfortable, eyelikeart must have started it. :D
 
Rower_CPU said:
All of theses probes got 203s, but the last one (2 hours later) got a 202.

Those are the HTTP status codes.
203 = Non-Authoritative Information
202 = Accepted
That's how he got into the system, but what would that let him do?
 
Mudbug said:
Those are the HTTP status codes.
203 = Non-Authoritative Information
202 = Accepted
That's how he got into the system, but what would that let him do?

Well, if he got past the PHP gate, he could be into the database. Will
MYSQL accept commands through the script interface? Not sure.
 
For what this threads title is, boy are there some serious breaches in decorum going on
 
Rower_CPU said:
How the hell did he get back in?!? :confused: :mad:

now see...this is why I always stick to the easy stuff... :rolleyes:

poop, booze, photography, etc... :D

I don't know what to make of all this...where's arn when we need him?
 
whocares said:
This could be Arn's idea of an April fool...

I wonder how long it took Dr. Q to convice him?

I don't think it is. Usually we all know what's going on before someone becomes a mod...in fact, he always asks us what we think first. :confused:

I'm going to close this thread down until we can figure out what's going on. There's no need for it to go on in the public any further.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.