OMG OMG 51% attack?!?! 88.208.1.24

[JFrancis]

So, the price of bitcoin crashed like 15% in the last 24 hours, with the adoption of the new unnecessary 0.8.4, the still guarenteed threat of more war in the middle east, and now 88.208.1.24.

http://blockchain.info/blocks/88.208.1.24

This IP, supposedly from Virginia, has more processing power than the world has ever seen before. (speculation)

They discovered 3 blocks in one ten minute period, and another 3 blocks in a 14 minute period.

That makes them capable of a 51% attack.

WHO ARE THEY AND WILL THEY RAPE THE NETWORK?

[_xyz]

...Luck happens 

[Singlebyte]

This is concerning to say the least.


I wonder if these guys have fired up their 25TH Machines?
https://bitcointalk.org/index.php?topic=288045.new;topicseen#new

...Luck happens 

Yea Right....  They are not THAT lucky. 

[JFrancis]

Price is starting to recover.

Any idea what caused the crash?

It wasn't any of the things listed above.

Did a whale move or something?

(Also,88.208.1.24 is still very concerning - to me, it looks like a trial run of a network of datacenters working together to be able to overtake the bitcoin network... and you realize, they don't have to take over forever - just long enough to screwup the chain and crash the BTC price. GO AMERICA! Where's my I love NSA, you love NSA image.......)

[JFrancis]

Something to note:

Ashburn, VA (where the IP originates) is about 25 miles/40km from the CIA headquarters.

[yochdog]

Hmmm

[BCB]

ASIC Farm

[kwaaak]

ghash.io

[BCB]

who's that?

[Nigeria Prince]

It is CIA starting 51% attack.

It is their new data center in Ashburn, VA, near Langley, VA.

http://cqcounter.com/whois/?query=88.208.1.24&map=1#map_geo_location

[blarg]

i dont like the sound of this   

[blarg]

advancedhosters.com

these guys are the IP and have large data centers.

[r3wt]

http://cqcounter.com/traceroute/?query=88.208.1.24

share-bt.net registered with with Advanced Hosters, a shell company owned by a company named Haldex, LTD.

check out the traceroute. they are behind several proxies, some of which have omitted geolocation data.

but look what Avast says:

[JFrancis]

I don't know exactly what traceroute is good for...

But the end result, hop 11 and 12, are 149.11.134.22, which is registered in the District of Columbia, to Cogent Communications.
edit: ok, I reloaded and the end result is again 88.208.1.24, after the 11th hop being 149.11.134.22.

I'm not sure why Avast points to the Netherlands.

I've pinged the IP, it's still up. I'm doing a portscan on it.... not sure how that would be beneficial, but I don't know what to do in a situation like this....

using nmap

Discovered open port 110/tcp on 88.208.1.24
Discovered open port 443/tcp on 88.208.1.24
Discovered open port 25/tcp on 88.208.1.24
Discovered open port 143/tcp on 88.208.1.24
Discovered open port 993/tcp on 88.208.1.24
Discovered open port 80/tcp on 88.208.1.24
Discovered open port 995/tcp on 88.208.1.24
Discovered open port 587/tcp on 88.208.1.24

and still trying the other 60+ thousand TCP ports.

I attempted to use the IP as an SMTP server, but my client rejected me, saying it wasn't in the accepted list of rcpthosts.

Anyway... like I said, this is above my head... I know there are known ranges of US gov IP addresses, but I haven't found any available for free yet.

[r3wt]

I don't know exactly what traceroute is good for...

But the end result, hop 11 and 12, are 149.11.134.22, which is registered in the District of Columbia.

I'm not sure why Avast points to the Netherlands.

I've pinged the IP, it's still up. I'm doing a portscan on it.... not sure how that would be beneficial, but I don't know what to do in a situation like this....

using nmap

Discovered open port 110/tcp on 88.208.1.24
Discovered open port 443/tcp on 88.208.1.24
Discovered open port 25/tcp on 88.208.1.24
Discovered open port 143/tcp on 88.208.1.24
Discovered open port 993/tcp on 88.208.1.24
Discovered open port 80/tcp on 88.208.1.24
Discovered open port 995/tcp on 88.208.1.24
Discovered open port 587/tcp on 88.208.1.24

and still trying the other 60+ thousand TCP ports.

I attempted to use the IP as an SMTP server, but my client rejected me, saying it wasn't in the accepted list of rcpthosts.

Anyway... like I said, this is above my head... I know there are known ranges of US gov IP addresses, but I haven't found any available for free yet.

do a scan on port 1327. if its open then the machine is exploitable. i'm willing to bet its open, because my antivirus blocks the ip address as malicious due to botnet activity

[JFrancis]

First time using nmap was earlier today for a completely different use. I'll try. TCP or what? for 1327.
So far I'm only doing TCP.

Discovered open port 3333/tcp on 88.208.1.24
Discovered open port 3334/tcp on 88.208.1.24
Discovered open port 4369/tcp on 88.208.1.24
Discovered open port 5222/tcp on 88.208.1.24
Discovered open port 5269/tcp on 88.208.1.24
Discovered open port 5280/tcp on 88.208.1.24
Discovered open port 5223/tcp on 88.208.1.24
Discovered open port 7777/tcp on 88.208.1.24
Discovered open port 8332/tcp on 88.208.1.24
Discovered open port 8333/tcp on 88.208.1.24

done TCP scan; 1327 TCP is not open.

[kwaaak]

Jesus christ its not the cia, the blocks are found by https://ghash.io

[r3wt]

Jesus christ its not the cia, the blocks are found by https://ghash.io

for some reason that website is blocked by my antivirus

[melon]

why is avast pointing to the Frisian islands?..WTF...lol

[JFrancis]

You sure it's from GHash.io?

Does GHash.io have a public block history? (like BTCGuild https://www.btcguild.com/index.php?page=pool_stats)



To put this into perspective (edited to take into account timezone differences):

From 20:52 to 1:22 (blockchain.info time), 12 blocks were mined by 88.208.1.24, and only 5 blocks by BTCGuild.


http://blockorigin.pfoe.be/blocklist.php
according to this, they have been identified as coming from GHash.io. I'm not familiar with their identification process. I've read that it can be faked.

Unless I see confirmation from a GHash.IO source, I'm skeptical.
BTCGuild currently says they have a Pool Speed of 222,571 GH/s
GHash.io currently says they have a Pool Speed of 140,540 GH/s (daily average or peak, not sure)