Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

ISTOP.com hacking my web server, Ralph Doncaster (consulting) threatened he would make sure my sites did not work and he is!

1 view
Skip to first unread message

DaveyBoy

unread,
Aug 16, 2002, 6:06:13 PM8/16/02
to
Please give me info how to stop this hacker:

My current ISP (www.igs.net) is trying to block out attacks from
ISTOP.com network (my former ISP) owned by Ralph Doncaster of
Doncaster Consulting Inc. in Ottawa (servicing Toronto too), but they
say I need to go higher up the ladder to block it better or to stop
him, I have no idea who to help me. Until then, this guy is wasting
bandwidth and ruining peoples lives, so I need to have these attacks
blocked and recorded, just monitor him for a while, see that person is
misusing his ISP.

I need ISTOP.com's backbone filtered for his attacks, maybe redirected
back to his computer. Something known as "source crunch"? Has to be
more than simple IP blocking as he "spoofs" (fakes) IP addresses (see
attached evidence files from my firewall called blackice). I also want
charges laid on Ralph as he has been harassing me and my members now
for months!

I HAVE REPORT OF MAJOR ABUSE and criminal activity plus harassment
(civil matter) by user cpu1693.adsl.bellglobal.com (aka:
jsoehner.dsl.istop.com, dci.doncaster.on.ca, and ip195.istop.com)
which is an ISP that BellNexxia (is what ralph doncaster claims is his
source, but I beleive it is a lie to lead me astray, COGENT i have
been told to contact?) provides service for to www.istop.com

My former ISP (www.istop.com cut of my my internet service for my
hiv/aids websites http://www.hivaidssearch.com/menu.htm 2 weeks ago.
Ralph Doncaster of Doncaster Consulting Inc (
http://www.easternontario.bbb.org/companyreport.asp?Lang=Eng&Id=14353
) and owner of ISP istop.com breached this contract 3 weeks ago as
AIDS and gays conflict with Ralph's religion. As of Aug 7th I had no
service from ISTOP, by Aug 8th my service with IGS.net was in effect,
yet this is when these attacks started! I complained to the better
business bearue and sent him a cease and desist letter to stay away
from network now that I am not on his servoice any more. He told me
via a telephone conversation that he will make sure my sites will not
stay up long, my assistanat is a witness to this speker phone
conversation. I since then have suffered many attacks causing denial
of service attacks ( http://grc.com/dos/grcdos.htm DDOS info )

Please help me, I have hundreds of HIV+ people counting on my service
working, some are very depressed people who have suggested suicide as
I am or my sites are not arround to support them. I am very worried
that Ralph Doncaster will cause a death!

I need some more evidence and actions as I am taking this case before
a local judge (Provincial Court) near the end of august as not much
has been done so far, I myself want to just give up all hope of trying
to be succefuls, I don't want to be stuck on disability all my life!

Here's some samples of my evidence files, all ICMP floods from him
have been blocked by my new awesome ISP IGS.net! Notive that
cpu1693.adsl.bellglobal.com has so many different IP addresses!

2002-07-13 14:02:24 Trace route 216.187.106.194
dci.doncaster.on.ca 52654
2002-07-15 11:30:15 SNMP port probe 66.199.181.146
jsoehner.dsl.istop.com 1299
2002-07-26 01:54:30 HTTP port probe 68.5.149.166
jsoehner.dsl.istop.com 4529
2002-07-27 19:12:31 SMTP relay attempt 172.156.96.136
ip195.istop.com 1175
2002-07-31 22:16:40 HTTP port probe 216.239.46.3
dci.doncaster.on.ca 28753
2002-07-31 22:17:51 HTTP port probe 66.196.73.21
dci.doncaster.on.ca 48007
2002-08-01 01:44:29 HTTP port probe 64.12.97.8
cpu1693.adsl.bellglobal.com 52057
2002-08-01 01:45:26 HTTP port probe 66.196.65.23
cpu1693.adsl.bellglobal.com 32926
2002-08-01 01:45:29 HTTP port probe 172.192.154.17
cpu1693.adsl.bellglobal.com 1786
2002-08-01 01:45:31 HTTP port probe 64.12.97.8
cpu1693.adsl.bellglobal.com 8238
2002-08-01 01:45:46 HTTP port probe 66.196.65.23
cpu1693.adsl.bellglobal.com 32926
2002-08-01 01:45:52 HTTP port probe 66.196.72.66
cpu1693.adsl.bellglobal.com 32933
2002-08-01 01:53:42 HTTP port probe 216.239.46.172
cpu1693.adsl.bellglobal.com 21970
2002-08-01 01:54:05 HTTP port probe 64.12.97.8
cpu1693.adsl.bellglobal.com 41807
2002-08-01 01:54:17 HTTP port probe 24.220.223.232
cpu1693.adsl.bellglobal.com 1683
Even today ISTOP trys to hack me! Aug 15th, 2002
2002-08-15 15:49:22 HTTP port probe 206.47.27.174
cpu1693.adsl.bellglobal.com 3778
2002-08-15 15:52:18 UDP port probe 206.47.27.174
cpu1693.adsl.bellglobal.com 137
2002-08-15 15:52:18 Telnet port probe 66.11.168.194
dci.doncaster.on.ca 2347
2002-08-15 15:53:31 UDP port probe 206.47.27.174
cpu1693.adsl.bellglobal.com

ISTOP sux! http://www.kickme.to/istop/

Ralph

unread,
Aug 16, 2002, 6:50:46 PM8/16/02
to

DaveyBoy wrote in message

>Ralph Doncaster of Doncaster Consulting Inc (
>http://www.easternontario.bbb.org/companyreport.asp?Lang=Eng&Id=14353
>) and owner of ISP istop.com breached this contract 3 weeks ago as
>AIDS and gays conflict with Ralph's religion.

That's quite imaginative. I've posted here before stating that people who
believe in God are illogical. What religion does that make me?


>Here's some samples of my evidence files, all ICMP floods from him
>have been blocked by my new awesome ISP IGS.net! Notive that
>cpu1693.adsl.bellglobal.com has so many different IP addresses!


Daveyboy has provided all the evidence anyone needs to see that he's a
deranged person who doesn't know a thing about IP networking. For starters
anyone with a clue knows that cpu1693.adsl.bellglobal.com has only one IP -
206.47.27.174.

As well, I have over 8000 IPs assigned to me, so just because one of my
customers goes to your www.hiv-aids-poz.com web site doesn't mean there has
been a hack attempt. However you might find an RCMP member dumb enough to
believe you, but if I do get sued, I'll just counter sue for malicious
procecution.

> 2002-07-27 19:12:31 SMTP relay attempt 172.156.96.136
>ip195.istop.com 1175

Name: AC9C6088.ipt.aol.com
Address: 172.156.96.136

> 2002-07-31 22:16:40 HTTP port probe 216.239.46.3
>dci.doncaster.on.ca 28753

Name: crawl1.googlebot.com
Address: 216.239.46.3

And so forth...

The reality is that Dave Brown has tried to attack 206.47.27.174 from his
Rogers Cable connection
Name: CPE00e02931406b.cpe.net.cable.rogers.com
Address: 24.103.189.178
I logged over 500 ftp connect attempts before I blocked him.

-Ralph

yeah-...@igs.net

unread,
Aug 16, 2002, 6:59:43 PM8/16/02
to
troll

(and posted anonymously, via Google groups, no less!)

Malcolm Ferguson

unread,
Aug 16, 2002, 7:01:21 PM8/16/02
to
DaveyBoy wrote:
>
> Please give me info how to stop this hacker:

LOL! What a substance-less rant. Do you have any *real* proof to back
up you accusations? Nothing that you've demonstrated backs up your
claim of "hacking" that you mentioned in the subject. I think the term
that you mean to use is "cracking", anyway.

>
> I HAVE REPORT OF MAJOR ABUSE and criminal activity plus harassment
> (civil matter) by user cpu1693.adsl.bellglobal.com (aka:
> jsoehner.dsl.istop.com, dci.doncaster.on.ca, and ip195.istop.com)

~# host cpu1693.adsl.bellglobal.com
cpu1693.adsl.bellglobal.com A 206.47.27.174
~# host jsoehner.dsl.istop.com
jsoehner.dsl.istop.com A 66.199.181.146
~# host dci.doncaster.on.ca
dci.doncaster.on.ca A 66.11.168.194
~# host ip195.istop.com
ip195.istop.com A 66.11.168.195
~# host -x 206.47.27.174 66.199.181.146 66.11.168.194 66.11.168.195
Name: cpu1693.adsl.bellglobal.com
Address: 206.47.27.174

Name: jsoehner.dsl.istop.com
Address: 66.199.181.146

Name: dci.doncaster.on.ca
Address: 66.11.168.194

Name: ip195.istop.com
Address: 66.11.168.195


>
> Here's some samples of my evidence files, all ICMP floods from him
> have been blocked by my new awesome ISP IGS.net! Notive that
> cpu1693.adsl.bellglobal.com has so many different IP addresses!
>

> <snip - log>

You're kidding me right? These weren't ICMP floods. SNMP, HTTP,
Telnet, etc != ICMP. Secondly, they're so spread out over a long period
of time, it certainly couldn't be described as a flood or distributed
denial of service attack, as you claimed.

If you've got a grievance, you're going to have to do much better than
that.

Malc

Malcolm Ferguson

unread,
Aug 16, 2002, 7:03:23 PM8/16/02
to
Ralph wrote:
>
> The reality is that Dave Brown has tried to attack 206.47.27.174 from his
> Rogers Cable connection
> Name: CPE00e02931406b.cpe.net.cable.rogers.com
> Address: 24.103.189.178
> I logged over 500 ftp connect attempts before I blocked him.
>

LOL! Talk about the pot calling the kettle black.

I guess based on what I said to him... proof? ;)

Malc

Ralph

unread,
Aug 16, 2002, 7:28:36 PM8/16/02
to

Malcolm Ferguson wrote in message <3D5D84BB...@yahoo.com>...


Sure, no problem. http://ns.istop.com/~ralph/attack.txt

We've also received several abusive and crazy email from Dave at the office
that we've saved. Despite Dave's libelous remarks, I'm keeping to the high
road and will keep the emails private. If I eventually file a libel suit or
if he files suit against me, I'll submit the emails to the court as
evidence. At that point they are publicly available and I would post copies
online as well.

-Ralph

Darrell Larose

unread,
Aug 16, 2002, 9:24:56 PM8/16/02
to
> DaveyBoy wrote:
>
> Please give me info how to stop this hacker:
>
Show us some proof, I have evidence you are lying:

Your post via Google was from Rogers, which you claim you hate and they
terminated your account?
Message-ID: <72fde5e1.0208...@posting.google.com>
NNTP-Posting-Host: 24.103.58.209 (aka:
CPE3439373938343130.cpe.net.cable.rogers.com)
Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit

hmmm you hate Rogers, but you are posting from them? So how is IGS your ISP?

Your website http://www.hivaidssearch.com
08/16/02 21:22:06 ping www.hivaidssearch.com
Ping www.hivaidssearch.com (216.148.213.150) ...

IP Block owned by:
Service Metrics (NETBLK-ATTENS-004718-000132) ATTENS-004718-000132
216.148.213.184 - 216.148.213.191
whois -h whois.arin.net !netblk-attens-004718-000132 ...

Service Metrics (NETBLK-ATTENS-004718-000132)
4900 Nautilus Ct., Ste. 200
Boulder, CO 80301
US

Netname: ATTENS-004718-000132
Netblock: 216.148.213.184 - 216.148.213.191

Coordinator:
AT&T Enhanced Network Services (CERF-HM-ARIN) not...@attens.com
(858) 812-5000

So IGS isn't hosting the pages. You're using Rogers as your ISP, and Service
Metrics (Attens) as your webhost.


Bowman

unread,
Aug 16, 2002, 11:38:00 PM8/16/02
to
As much as the crappy service at Istop annoys me enough to warrant a
change in my ISP, this entire post is nothing more than a lame smear
campaign. If you really hate Istop and/or Ralph that much, then post
truthful comments that you can back up.

However, poor service, for example, isn't a reason to tread on those
waters. Ralph is absolutely right when he says he can file a suit
against you for libel. You don't seem to realize that exposure on a
medium such as this can make or break a business. Thats enough
grounds for you to be paying your old buddy Ralph a good chunk of
change.

Grow up kid.

TeGGeR®

unread,
Aug 17, 2002, 12:11:48 AM8/17/02
to
yeah-...@igs.net wrote:
> troll
>
> (and posted anonymously, via Google groups, no less!)
>

But in the message headers, his IP address is given as 24.103.58.209. A
Rogers customer.

--TeGGeR

Alexander Fong

unread,
Aug 17, 2002, 3:33:27 AM8/17/02
to

Yep, so much for "anonymous", eh?

Oh, and Rogers IPs are mostly static, aren't they?

--

**********************************************************************
Alexander Fong ap_fong (put @ here, .. = .) alcor..concordia..ca
----------------------------------------------------------------------
Sex is better than logic. You can't PROVE it, but it is!
**********************************************************************

Darrell Larose

unread,
Aug 17, 2002, 7:40:13 AM8/17/02
to

"Alexander Fong" <ap_...@takethis.off.alcor.ffo.sihtekat.concordia.caoff>
wrote in message
news:Pine.OSF.4.44.020817...@alcor.concordia.ca...

On Sat, 17 Aug 2002, [ISO-8859-1] TeGGeRŽ wrote:

> yeah-...@igs.net wrote:
> > troll
> > (and posted anonymously, via Google groups, no less!)
> But in the message headers, his IP address is given as 24.103.58.209. A
> Rogers customer.

Yep, so much for "anonymous", eh?

Oh, and Rogers IPs are mostly static, aren't they?

Rogers IPs are dynamic under DHCP, however my "dynamic" IP hasn't changed
since March 2001. The IP resolves back to a MAC address of:
CPE3439373938343130.cpe.net.cable.rogers.com, AFAIK the CPE* MAC address
doesn't change unless the modem changes


Freak Cell

unread,
Aug 17, 2002, 11:42:41 AM8/17/02
to

"Darrell Larose" <cot...@rogers.com> wrote in message
news:IBh79.12540$sa1....@news01.bloor.is.net.cable.rogers.com...

> Your website http://www.hivaidssearch.com
> 08/16/02 21:22:06 ping www.hivaidssearch.com
> Ping www.hivaidssearch.com (216.148.213.150) ...

When I try to load that page I get a ton of quick up/down transfers but it
doesn't load at all...ever. Looked at the source and it seems to be as plain
vanilla as possible. Anyone with more knowledge or means to analyse this care to
take a look and see if there is any weirdness going on?

FC


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002


Brad Clarke

unread,
Aug 17, 2002, 12:45:07 PM8/17/02
to
On Sat, 17 Aug 2002 11:40:13 GMT, "Darrell Larose" <cot...@rogers.com>
wrote:

>>AFAIK the CPE* MAC address doesn't change unless the modem changes

The CPE* address is actually the MAC address of the network card (or
cloned MAC address on a router) attached to the modem.

If you're running an NT based OS or using Linux, do an 'nslookup' of
your IP address. The CPE address should contain the same characters as
your MAC address, unless you've got a DOCSIS modem.

Brad

TeGGeR®

unread,
Aug 17, 2002, 12:48:48 PM8/17/02
to
Freak Cell wrote:
> "Darrell Larose" <cot...@rogers.com> wrote in message
> news:IBh79.12540$sa1....@news01.bloor.is.net.cable.rogers.com...
>
>
>>Your website http://www.hivaidssearch.com
>>08/16/02 21:22:06 ping www.hivaidssearch.com
>>Ping www.hivaidssearch.com (216.148.213.150) ...
>
>
> When I try to load that page I get a ton of quick up/down transfers but it
> doesn't load at all...ever. Looked at the source and it seems to be as plain
> vanilla as possible. Anyone with more knowledge or means to analyse this care to
> take a look and see if there is any weirdness going on?

=====================================

Here's the source code for that page:
--TeGGeR


> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Frameset//EN"
> "http://www.w3.org/TR/html4/frameset.dtd">
>
> <html>
>
> <head>
> <title>please help me run my own web server for my HIV/AIDS Network</title>
> <meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> <meta name="forwarder" content="abc.dnsix.att">
> <meta name="description" content="The HIV/AIDS Search Engine will be back soon, please give us until August 14th to relocate files... ISTOP.com has breached their contract with me, what ISP does this?">
> <meta name="keywords" content="hiv, aids, help, support, donate, funding, sponsors, charity, chat, information">
> </head>
>
> <frameset rows="100%,*">
> <frame frameborder="0" name="MYTOPFRAME" src="http://poz.dyn.ca/poz/search/" noresize="noresize">
> <noframes>
>
> <body>
> please help me run my own web server for my HIV/AIDS Network<br>
> The HIV/AIDS Search Engine will be back soon, please give us until August 14th to relocate files... ISTOP.com has breached their contract with me, what ISP does this?<br>
> hiv, aids, help, support, donate, funding, sponsors, charity, chat, information<br>
> <br>
> <a href="http://poz.dyn.ca/poz/search/">Enter Here</a><hr>
> | Domain Name Registration and Domain Name Forwarding by <a href="http://www.MyDomain.com">MyDomain.com - Register your domain name.</a>
>
> </body>
> </noframes>
> </frameset>
> </html>

Vivien Milat

unread,
Aug 17, 2002, 1:07:48 PM8/17/02
to
In article <xCq79.13457$sa1....@news01.bloor.is.net.cable.rogers.com>,
cot...@rogers.com says...

> Rogers IPs are dynamic under DHCP, however my "dynamic" IP hasn't changed
> since March 2001. The IP resolves back to a MAC address of:
> CPE3439373938343130.cpe.net.cable.rogers.com, AFAIK the CPE* MAC address
> doesn't change unless the modem changes

Rogers IPs are DYNAMICALLY-ASSIGNED via DHCP. It is a myth that DHCP
implies dynamic IPs; eg, my machine on my internal network have always
gotten the same IPs from DHCP (yay for hardcoding their MACs...).

DHCP is your friend. DHCP is even more your friend if you're the network
admin.

Vivien

--
Vivien Milat
viv...@NOSPAM.vivienm.org - viv...@NOSPAM.bigfoot.com - ICQ 4445675
Vivien's World - http://www.vivienm.org/

Remove NOSPAM. before replying by email. Please do not reply both by
email and in the newsgroup.

Malcolm Ferguson

unread,
Aug 17, 2002, 2:04:21 PM8/17/02
to
Vivien Milat wrote:
>
> It is a myth that DHCP implies dynamic IPs;

Our machines at work are constantly getting new IPs. Especially people
who have laptops. If you have a low number of machines on a network,
it's perfectly feasible that they'll get the same IP everytime,
particularly if the machines are static. Presumably the configuration
of the DHCP server must also be considered. I find the turn-over of IPs
at work quite annoying at times, as we quite often demonstrate things to
each other via pcAnywhere or VNC - name resolution quite often doesn't
work for me, so I'm constantly having to reconfigure the connection
properties for these client apps.

Malc

No SPAM

unread,
Aug 17, 2002, 2:51:48 PM8/17/02
to
DHCP servers have Lease length, in our office, I've set our to 30 days. We
allways get the same ip, and it's easier to track who did what on the
interenet.

Ask your network person to lengthen the lease times.

Popeye

unread,
Aug 18, 2002, 2:47:12 PM8/18/02
to
This is some crazy shit. The guy that had the web page with Ralph's picture
on it with the quote, "I don't give a rats ass" was pushing it, but this guy
is seriously in the slander/defamation of character league. I mean if you
hate the ISTOP service or what this guy stands for, then just leave, it's
the smart thing to do.


Matt Byrd

unread,
Aug 18, 2002, 5:59:20 PM8/18/02
to
sup...@hiv-aids-poz.com (DaveyBoy) whines in message
news:<72fde5e1.0208...@posting.google.com>...

> Please give me info how to stop this hacker:
>
>
> I need some more evidence and actions as I am taking this case before
> a local judge (Provincial Court) near the end of august as not much
> has been done so far, I myself want to just give up all hope of trying
> to be succefuls, I don't want to be stuck on disability all my life!
>
Take it to court, the Judge may cite you for bringing a frivolous and
vexatious actions to court. You have zero evidence of anything...

> Here's some samples of my evidence files, all ICMP floods from him
> have been blocked by my new awesome ISP IGS.net!

so called evidence deleted.

In you battle of wits, you are short of ammunition

DaveyBoy

unread,
Aug 18, 2002, 8:24:49 PM8/18/02
to
I am sorry, the different IP addresses for host name
dci.doncaster.on.ca cpu1693.adsl.bellglobal.com was incorrect, I had
messed up the sorting using MS Excel on my work copy of the evidence
file.

His computer would still come on, then within a minute or 2, DDOS
attaacks would start, this pattern went on for 8 days! So I was being
attacked! I will start to contact the media and MPs if it persists.

Sorry to falsely state I had proof of Ralph Doncaster's spoofing, only
my ISP has suggestive evidence. These IPs are infected trojan
computers used for attacking me with a master trojan client/operator.

I have made many complaints to major ISPs and ARIN. The attacks seem
to have slowed and I think my new ISP may be blocking more.

Not really much one can do in this situation, no one really cares. I
will be learning how to do these mass attacks back to defend myself,
doesn't seem to be illegal here in Canada to ruin someones business
this way (but in USA is federal offense)!

Marc Bissonnette

unread,
Aug 18, 2002, 9:12:13 PM8/18/02
to
sup...@hiv-aids-poz.com (DaveyBoy) wrote in
news:72fde5e1.02081...@posting.google.com:

Umm, have you done a reverse DNS lookup on any of the above? Most of them
seem to resolve to Google's crawler or AOL proxy servers. Where are you
getting dci.doncaster.on.ca (or any of the other names?) I can see maybe
4 of the IP's above that resolve to the names you've attached to them,
but the rest would appear to be completely incorrect.

--
-----------------------------
Marc Bissonnette
Internalysis - Intelligence in Internet Communications
http://www.internalysis.com

Looking for an ISP? http://www.canadianisp.com

Malcolm Ferguson

unread,
Aug 18, 2002, 9:12:15 PM8/18/02
to
DaveyBoy wrote:
>
> I am sorry, the different IP addresses for host name
> dci.doncaster.on.ca cpu1693.adsl.bellglobal.com was incorrect, I had
> messed up the sorting using MS Excel on my work copy of the evidence
> file.

Sorting? Or creating?


> His computer would still come on, then within a minute or 2, DDOS
> attaacks would start, this pattern went on for 8 days! So I was being
> attacked! I will start to contact the media and MPs if it persists.

If you did experience a Distributed Denial of Service attack as you
claim, what do you have that the drone computers were controlled by your
accused? So far you've only made unsubstantiated claims that amount to
no more than libel.


> Not really much one can do in this situation, no one really cares. I
> will be learning how to do these mass attacks back to defend myself,
> doesn't seem to be illegal here in Canada to ruin someones business
> this way (but in USA is federal offense)!

I don't believe the law here allows any kind of vigilantism. But
please, go ahead. I'm sure the resulting visit by the RCMP will give us
peace-and-quiet, and some respite from you.

Malc

Derek Tam

unread,
Aug 18, 2002, 9:39:01 PM8/18/02
to
In article <Xns926ED7E3D7CEBdr...@206.172.150.13>,

Marc Bissonnette <dra...@internalysis.com> wrote:
>
>Umm, have you done a reverse DNS lookup on any of the above? Most of them
>seem to resolve to Google's crawler or AOL proxy servers. Where are you

My goodness! HTTP requests from a web crawler or proxy server?
That's unheard of!

Derek

--
Derek Tam Skwid? <http://www.derekweb.com/>

Subterranean Wonderland <http://www.derekweb.com/ime/>
Deals on Gas In Ottawa? <http://OttawaGasPrices.com/>

Marc Bissonnette

unread,
Aug 18, 2002, 11:18:15 PM8/18/02
to
usene...@blackhole.derekweb.com (Derek Tam) wrote in
news:3d604c35$1...@news.eol.ca:

> In article <Xns926ED7E3D7CEBdr...@206.172.150.13>,
> Marc Bissonnette <dra...@internalysis.com> wrote:
>>
>>Umm, have you done a reverse DNS lookup on any of the above? Most of
>>them seem to resolve to Google's crawler or AOL proxy servers. Where
>>are you
>
> My goodness! HTTP requests from a web crawler or proxy server?
> That's unheard of!

I know - that's what had me so concerned for this fellow's security:
*OBVIOUSLY* if requrests are coming from a crawler AND a proxy server,
that *must* mean there is conspiracy afoot!

<Twilight Zone>Noo noo NOO NOO noo noo NOO NOO</Twilight Zone>

Ralph

unread,
Aug 19, 2002, 12:48:57 AM8/19/02
to

DaveyBoy wrote in message
<72fde5e1.02081...@posting.google.com>...

>I am sorry, the different IP addresses for host name
>dci.doncaster.on.ca cpu1693.adsl.bellglobal.com was incorrect, I had
>messed up the sorting using MS Excel on my work copy of the evidence
>file.
>
>His computer would still come on, then within a minute or 2, DDOS
>attaacks would start, this pattern went on for 8 days! So I was being
>attacked! I will start to contact the media and MPs if it persists.


I honestly hope you contact the media. They'll talk to you and see how
little you know about networking and security. They'll talk to me and see
how much I know, and how easily I can debunk your "proof". Then they'll see
you for the disgruntled former customer that you really are. It will be
good for my business.

-Ralph

TeGGeR®

unread,
Aug 19, 2002, 6:06:54 AM8/19/02
to
Malcolm Ferguson wrote:
> DaveyBoy wrote:
>
>>I am sorry, the different IP addresses for host name
>>dci.doncaster.on.ca cpu1693.adsl.bellglobal.com was incorrect, I had
>>messed up the sorting using MS Excel on my work copy of the evidence
>>file.
>
>
> Sorting? Or creating?


Listen to his tires squeal as he backtracks hastily! What a dummy.

--TeGGeR

Noah Sumner

unread,
Aug 19, 2002, 7:48:22 AM8/19/02
to

Well Ralph you do have that one wrong. See just think like the media
(who also no nothing and also share no concern for fact:-)

Headline 1: Stupid users creates false allegations... (Not very
intresting)

Headline 2: Owner of ISP attacks site, hits HIV infected persons.
(Maybe intresting)

Therefore if he contacts the media you have no guarantee of winning.
For that they would require a love of the truth. That they don't
guarantee however.

Ralph

unread,
Aug 19, 2002, 11:52:59 AM8/19/02
to

Noah Sumner wrote in message ...

Although I agree that the media does not have much interest in fact, they do
understand libel. I think the best spin they could legally put on it is
"HIV site attacked, ISP owner suspected". And as they say about marketing,
no news is bad news. ;-)

-Ralph

Popeye

unread,
Aug 19, 2002, 4:21:28 PM8/19/02
to

"> no news is bad news. ;-)
>
> -Ralph

I hate to burst your bubble cheech, but you're not a rocker caught in bed
with a porn star, or a model/actor with his name sprayed all over the
tabloids becuase of an alcohol/drug problem. When you deal in entertainment,
I'm sure that a lot of people have restarted their careers because they did
something crazy.
However, people treate business and bad press in a different light. Business
and bad press creates an idea of shady characters fucking with the public.
Whether it's true or not, it's not something you want play around with.


Walter Dnes

unread,
Aug 20, 2002, 6:39:37 AM8/20/02
to
On 16 Aug 2002 15:06:13 -0700, DaveyBoy, <sup...@hiv-aids-poz.com> wrote:

> conversation. I since then have suffered many attacks causing denial
> of service attacks ( http://grc.com/dos/grcdos.htm DDOS info )

Relying on grc.com as an "authority" for *ANYTHING* is a laugh.

> Here's some samples of my evidence files, all ICMP floods from him

> have been blocked by my new awesome ISP IGS.net! Notive that
> cpu1693.adsl.bellglobal.com has so many different IP addresses!

[...deletia...]

Let's get this straight...
- you are running a public web site
- your "personal firewall" reports any webbrowser or indexer
contacting port 80 as an "HTTP port probe" ??? Sheesh !!!

I suggest you cut your losses, apologize, and learn a bit about
TCP/IP before you embarress yourself some more. And if you insist about
screaming to every ISP you ever get a packet from, you're going to be
very disappointed. Here's a summary of packets blocked by my Netgear
router past couple of days. *EVERYBODY ON THE NET* gets this garbage.
And, unlike you, I'm not running *ANY* servers, so they're more likely
to be attacks than anything coming to your site.

Date Port# count
====================================
Aug 18 00021 Incident count = 6
Aug 18 00022 Incident count = 4
Aug 18 00080 Incident count = 15
Aug 18 00119 Incident count = 10
Aug 18 00137 Incident count = 5
Aug 18 01433 Incident count = 8
Aug 19 00021 Incident count = 3
Aug 19 00022 Incident count = 1
Aug 19 00025 Incident count = 3
Aug 19 00080 Incident count = 4
Aug 19 00111 Incident count = 2
Aug 19 01433 Incident count = 13
Aug 19 17300 Incident count = 1

And oh yeah, this post of yours is archived on a lot of people's
computers, and most likely Google too. If you go to court, this posting
can be used to make you look totally incompetent. Quit while you're
ahead.

AIDS is a terrible thing to live, and die, with. You do not help your
cause by making absolutely ridiculous postings like this.

--
Walter Dnes <walt...@waltdnes.org>
I'm not repeating myself; I'm an X Window user, I'm an ex-Windows user
Palladium ain't done till linux won't run

0 new messages