Problematic GWebCaches

ale5000 · #1 (**permalink**) January 10th, 2016

http://cache-doxu.rhcloud.com/
There isn't any host, broken.

http://fascination77.free.fr/cachechu/
Fatal error, completely not working.

http://59.175.238.8:9030/beacon2/gwc.php
It doesn't have a dns, it is strange.
Also the gnutella2 part works while the gnutella part seems to be broken.

http://cache.trillinux.org/g2/bazooka.php
Broken or hacked, it return hosts with negative age.
It return urls but it doesn't accept the submission of them so it return forever already deleted urls (this is what cause GWCs to be queried also when deleted from a lot of time)

Please anyone that know the people hosting them, let them know the problems.
I'm here to help if needed.

Lord of the Rings · #2 (**permalink**) January 10th, 2016

Thanks, I noticed yesterday p2p.findclan.org was empty. I tried adding, some disallowed and some were accepted but nothing resulted.

trillinux.org is the only other one on the above list I'm aware of & I suspect it has been around a long time. I wonder if it is related to this:

Quote:

Originally Posted by Lord of the Rings

... BS host-file bugs: I know I've commented about the BS host caching system before. But just to show how poor it is, two BS ultrapeers: one with uptime of 14 days and other with consistent uptime of 24 to 48 hours consecutively, have average uptimes of 38 mins and 80 mins respectively. Resulting in the best BS hosts at the bottom of the host-file. Obviously a severe bug with BS's host-file management.
There's other bugs also, such as multiple host listings, disregard of the hostiles when adding hosts to the host-file, and adding BS ultrapeers also to the non-BS list. The host-file also seems to obtain out-of-date host data with BS ultrapeers that have not existed for years (this might be due to a rogue BS ultrapeer.)

My original thought a couple years (2013) ago was it being due to a rogue GWC:

Quote:

Originally Posted by Lord of the Rings

... I am still convinced at least one still active GWC (if I can call it active) is giving out-of-date information. Two of my BearShare connection lists (Win 8 + 2000) contain many hosts at top of the list from January but mostly from December and earlier (nearing a year old).

ale5000 · #3 (**permalink**) January 11th, 2016

I don't think it is related because cache.trillinux.org/g2/bazooka.php is Bazooka.
Bazooka only support gnutella2 and only new specs so no BearShare.

ale5000 · #4 (**permalink**) March 30th, 2016

This apparent GWC url "http://udp-host-cache.com/gwc/" with IP "52.49.1.53" that appears sometimes as "Skulls 0.3.2c" and sometimes as "Cachechu 1.6" get inserted inside Cachechu urls list.

The domain udp-host-cache.com is reported by Firefox as malicious.
The IP belong to Amazon Technologies Inc.
The Amazon Cloud can be rented and it is often used by malicious people.

Edit: the site redirect to another url, that when scanned give this: https://www.virustotal.com/it/url/da...is/1459336622/

Edit2: Loading the url now doesn't appears a valid GWebCache, so I wonder how it get inserted; it appears only on Cachechu caches and not in other caches so it possibly use a Cachechu vulnerability or just targetting Cachechu.

Edit3: The domain now point to the IP "195.22.26.248" that belong "ESOTERICA (VIA NET.WORKS Portugal - Tecnologias de Informa,cao, SA)" that resolve to https://www.anubisnetworks.com/
It is really ironic.

Lord of the Rings · #5 (**permalink**) March 30th, 2016

Nice find.

Quote:

Originally Posted by ale5000

... The Amazon Cloud can be rented and it is often used by malicious people.

Agreed. And that includes groups involved against the Gnutella network.

Quote:

Originally Posted by ale5000

... Edit: the site redirect to another url, that when scanned give this: https://www.virustotal.com/it/url/da...is/1459336622/ ... Edit3: The domain now point to the IP "195.22.26.248" that belong "ESOTERICA (VIA NET.WORKS Portugal - Tecnologias de Informa,cao, SA)" that resolve to https://www.anubisnetworks.com/
It is really ironic.

This doesn't surprise me about anti-virus companies either creating their own viruses or similar, in order to drum up business. I won't name the company but many, many years ago a Filipino friend of mine told me how scripty kids were being hired to create viruses.
In years since I've read of similar tricks and alarms sent by such companies in order to increase their business sales.

ale5000 · #6 (**permalink**) May 1st, 2016

Skulls 0.3.3 (or higher) works correctly on rhcloud (OpenShift).
After a lot of guesswork and testing I have finally been able to fix Skulls to works also on that host.

Anyone using it please update to get it working correctly.