[POOL][Scrypt][Scrypt-N][X11] Profit switching pool - wafflepool.com

[i0nviz]

My cgminer started falling back to a backup pool and no longer connecting to the Waffle EU server. I see in my firewall logs that it tries to connect to 206.223.224.225:3009. Is that address related to Wafflepool and how so? It shows on whois lookup as a residential cable in Montreal, Canada. If I restart the cgminer it connects to Waffle EU normally but the same thing happens after a while.

I saw this as well with the same IP. Myself and a couple other people are trying to track down the problem on #wafflepool
My theory is dns hijacking 

I've set up some network capturing hardware to try and figure out what happens

Yeah my stratum url has changed to the same thing. When I google that IP address I get a result about potcoin on github, but I'm not using that.

https://github.com/potcoin/potcoin-seeder/blob/master/main.cpp
https://github.com/potcoin/potcoin/blob/master/src/net.cpp

[1714239776]

1714239776

[1714239776]

1714239776

[1714239776]

1714239776

[poolwaffle]

Whoever is seeing the DNS issues, can you post what your DNS is, any any lookups and results for our endpoints?  We haven't changed anything in terms of DNS in weeks, and its very disconcerting that multiple people are seeing this.

[Crunchtac]

Whoever is seeing the DNS issues, can you post what your DNS is, any any lookups and results for our endpoints?  We haven't changed anything in terms of DNS in weeks, and its very disconcerting that multiple people are seeing this.

Name:   uswest.wafflepool.com
Address: 192.241.211.125
Name:   useast.wafflepool.com
Address: 162.243.89.19
Name:   eu.wafflepool.com
Address: 95.85.61.208

all VIA ISP DNS (I'd rather not say who)

The next time the problem occurs I'll give you a network capture of it!

[poolwaffle]

Whoever is seeing the DNS issues, can you post what your DNS is, any any lookups and results for our endpoints?  We haven't changed anything in terms of DNS in weeks, and its very disconcerting that multiple people are seeing this.

Name:   uswest.wafflepool.com
Address: 192.241.211.125
Name:   useast.wafflepool.com
Address: 162.243.89.19
Name:   eu.wafflepool.com
Address: 95.85.61.208

all VIA ISP DNS (I'd rather not say who)

The next time the problem occurs I'll give you a network capture of it!

Please do, I've got an email from another person seeing the same thing (disconnect after a while and on reconnect, getting a different pool entirely).  Which is very disconcerting....

[poolwaffle]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

[Cru]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

Same thing here.  Mining 11 days straight and just got this happening to me today.  Hadn't touched my rig in those 11 days.  Using CGMiner 3.7.3 kalroth, also using cgwatcher.

[comeonalready]

Whoever is seeing the DNS issues, can you post what your DNS is, any any lookups and results for our endpoints?  We haven't changed anything in terms of DNS in weeks, and its very disconcerting that multiple people are seeing this.

Name:   uswest.wafflepool.com
Address: 192.241.211.125
Name:   useast.wafflepool.com
Address: 162.243.89.19
Name:   eu.wafflepool.com
Address: 95.85.61.208

all VIA ISP DNS (I'd rather not say who)

The next time the problem occurs I'll give you a network capture of it!

Please do, I've got an email from another person seeing the same thing (disconnect after a while and on reconnect, getting a different pool entirely).  Which is very disconcerting....

pw, I sent you a pm containing some information that I decided not to leave posted publicly, as whoever is responsible for this is likely reading this thread.

[comeonalready]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

Same thing here.  Mining 11 days straight and just got this happening to me today.  Hadn't touched my rig in those 11 days.  Using CGMiner 3.7.3 kalroth, also using cgwatcher.

To everyone seeing this problem, is x.wafflepool.com still showing up as the connected server name in cgminer or other miner software, or is it displaying this unexpected ip address instead?

[Crunchtac]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

I'm using cgminer-3.7.2-kalroth from https://github.com/Kalroth/cgminer-3.7.2-kalroth It should be clean.

The consensus on IRC is that the problem is independent of OS and mining software

Join us on #wafflepool on Freenode if you can

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

Same thing here.  Mining 11 days straight and just got this happening to me today.  Hadn't touched my rig in those 11 days.  Using CGMiner 3.7.3 kalroth, also using cgwatcher.

To everyone seeing this problem, is x.wafflepool.com still showing up as the connected server name in cgminer or other miner software, or is it displaying this unexpected ip address instead?

Displaying the unexpected IP

[comeonalready]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

I'm using cgminer-3.7.2-kalroth from https://github.com/Kalroth/cgminer-3.7.2-kalroth It should be clean.

The consensus on IRC is that the problem is independent of OS and mining software

Join us on #wafflepool on Freenode if you can

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

Same thing here.  Mining 11 days straight and just got this happening to me today.  Hadn't touched my rig in those 11 days.  Using CGMiner 3.7.3 kalroth, also using cgwatcher.

To everyone seeing this problem, is x.wafflepool.com still showing up as the connected server name in cgminer or other miner software, or is it displaying this unexpected ip address instead?

Displaying the unexpected IP

Thank you.  Can more miners please confirm?

There it is poolwaffle.  Make sure you read my pm.

[caution]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

Connected to 206.223.224.225 diff 1.02K

https://bitcointalk.org/index.php?topic=433634.msg5834804#msg5834804

had that last night, using sgminer v4.0.0 BAMT 1.3 on two rigs (been running for over a month) ...was mining on the ghash.io ltc promo, still have a rig mining there without change.

[comeonalready]

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

I'm using cgminer-3.7.2-kalroth from https://github.com/Kalroth/cgminer-3.7.2-kalroth It should be clean.

The consensus on IRC is that the problem is independent of OS and mining software

Join us on #wafflepool on Freenode if you can

Also, anyone seeing the issue, any chance you could post which miner you're using, and where you downloaded it from?

Same thing here.  Mining 11 days straight and just got this happening to me today.  Hadn't touched my rig in those 11 days.  Using CGMiner 3.7.3 kalroth, also using cgwatcher.

To everyone seeing this problem, is x.wafflepool.com still showing up as the connected server name in cgminer or other miner software, or is it displaying this unexpected ip address instead?

Displaying the unexpected IP

And when you restarted (cgminer I assume, please correct if wrong), does it go back to displaying wafflepool.com or the unexpected ip address again?

[lagster]

~coinsolver~

you are very annoying with your shitsolver advetising.

[JHammer]

My Hosted Gridspeed 20 pack stop..  Was mining on Waffle East..   But since its hosted I cant tell why..  Got a Email into them..  I have fail over but its not hashing there either.

My GPU miners here at my house are hashing on waffle West and look ok..

[lagster]

not much better Est BTC/Day/MH/s   0.00517439 vs waffle 0.00497368...will keep them in mind,any others

That is the coin the is being currently mined. It varies...obviously. I have stats saying. ~0.008/Mh/Day.. im not pullin it out my ass

more like 0.005334254 https://bitcointalk.org/index.php?topic=432710.100

0.025604421/72=0.000355617x24=0.008534807/1600=0.000005334x1000=0.005334254

your 0.008534807BTC per day is for 1.6MH/s as per your post and not BTC/Day/MH/s   

come on already, there was almost an agreement on how to call those pennies.

[o_oo_o]

both my miners had switched to 206.223.224.2 - cgminer (bamt) and cudaminer (win7), both rigs using google public dns 8.8.8.8.

Doing lookup on the bad ip:

nslookup 206.223.224.2
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    true.fiberpimp.net
Address:  206.223.224.2



wafflepool now resolves properly:

nslookup useast.wafflepool.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    useast.wafflepool.com
Address:  162.243.89.19

[lagster]

Whoever is seeing the DNS issues, can you post what your DNS is, any any lookups and results for our endpoints?  We haven't changed anything in terms of DNS in weeks, and its very disconcerting that multiple people are seeing this.

Name:   uswest.wafflepool.com
Address: 192.241.211.125
Name:   useast.wafflepool.com
Address: 162.243.89.19
Name:   eu.wafflepool.com
Address: 95.85.61.208

all VIA ISP DNS (I'd rather not say who)

The next time the problem occurs I'll give you a network capture of it!

Please do, I've got an email from another person seeing the same thing (disconnect after a while and on reconnect, getting a different pool entirely).  Which is very disconcerting....

pw, I sent you a pm containing some information that I decided not to leave posted publicly, as whoever is responsible for this is likely reading this thread.

since it is obvious that some one compiled cgminer or sgminer with a worm within, you probably should publicly post it here. and after that we will find the trojan link. omg do you think it is deeper... in wifi router's dns settings ?

[comeonalready]

both my miners had switched to 206.223.224.2 - cgminer (bamt) and cudaminer (win7), both rigs using google public dns 8.8.8.8.

Doing lookup on the bad ip:

nslookup 206.223.224.2
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    true.fiberpimp.net
Address:  206.223.224.2



wafflepool now resolves properly:

nslookup useast.wafflepool.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    useast.wafflepool.com
Address:  162.243.89.19

While that sounds conclusive on the surface, did you ever run "nslookup useast.wafflepool.com" on dns server 8.8.8.8 and receive address 206.223.224.2 as a result?  And wasn't it 206.223.224.225 that we are all talking about?

[lagster]

To everyone who is having their miners redirected to the unexpected ip address...  What type of router equipment are you using on your network?  The brand and model of the unit is not as important as whether it runs its own dns forwarding server.

If you are uncertain, check your computer ip configuration to determine if the dns server it contacts the internal ip address for your router (private lan 192.168.x.x in most cases) other dns servers out on the internet.  If you can post which is the case, that will help in determining the cause of this problem.

miners can change their dns to google's 8.8.8.8 to see if it still works "strange" no?

[JHammer]

What is strange with my Hosted GridSpeed connected to Waffle East is my hash rate shows 0 but my Earned and unconverted keeps growing???  What the heck??


or better stats, you can see here: Better Stats. Please be aware, this site is run 100% by another party and uses our API for data. It is in no way managed or affiliated with us.

Hash Rate: 0.00 kH/s (15min approximated)
Worker   15m Hashrate   15m Stalerate
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx   0.00 kH/s   0.00%

Bitcoins sent to you: 0.00000000
Bitcoins earned (not yet sent): 0.01666397
Bitcoins unconverted (approximate): 0.00374650
click to see coin balances

Recent Payouts
Date   Amount   TxnId

Recent Shifts
ID   Ended   Shares (yours / total)   Blocks Found
15335   OPEN   0 / 44722688   1
15334   2014-03-22 22:30:31   0 / 150658560   2
15333   2014-03-22 22:23:18   0 / 151505920   7
15332   2014-03-22 22:15:22   0 / 151298560   12
15331   2014-03-22 22:09:12   0 / 151126528   5
15330   2014-03-22 22:03:27   0 / 150529536   7
15329   2014-03-22 21:57:37   0 / 150871040   10
15328   2014-03-22 21:51:47   0 / 152092672   21
15327   2014-03-22 21:45:37   0 / 152955392   26
15326   2014-03-22 21:39:22   0 / 151446528   2