2016-04-12 - Revision history

Kinscoe: Replaced content with "This page has moved to Journal:2016/04/12 2016/04/12 - Tuesday."

2016-05-02T17:19:36Z

Replaced content with "This page has moved to Journal:2016/04/12 2016/04/12 - Tuesday."

← Older revision		Revision as of 17:19, 2 May 2016
Line 1:		Line 1:
	~~==Web of Trust WOT==~~		This page has moved to [[Journal:2016/04/12 2016/04/12 - Tuesday]].
	~~I have been using Web of Trust also known as "WOT" (https://www.mywot.com/) as a plugin for first Firefox and then 8 years ago when I switched to Chrome.~~

	If you are not aware WOT is a free crowd-sourced website reputation and review tool using colored icons to alert you of potential malware delivery or compromised sites before you visit them. It will even prevent you accessing the web site without asking you first if you set it up that way. I find WOT a particularly reliable way of preventing malware intrusions on friends and families systems. It's not perfect method but it goes along way to help keep from spending lots of time fixing others systems.

	Recently I noticed something I have been able to correlate back to WOT. I began noticing login failures to certain private web sites I administer that are sufficiently off the radar or in other words not indexed by means of [http://www.robotstxt.org/ robots.txt] file.

	This particular IP kept showing up in the web server logs shortly after I visited the private sites which require authentication to access. The IP which I recognized as an Amazon Web Services owned IP block is 52.71.155.178. In short it looks like an outbound NAT for a group of AWS instances possibly a VPC. If you reverse DNS lookup the IP address it belongs to [~~https://www.crunchbase.com/organization/kontera#/entity Kontera] inline contextual advertising service. In June 2014 Kontera was acquired by~~ [~~https~~:~~//en.wikipedia.org/wiki/Amobee Amobee].~~

	~~<pre>~~
	~~$ dig +noall +answer -x 52.71.155.178~~
	~~178.155.71.52.in-addr.arpa. 300 IN PTR nat-service.aws.kontera.com.~~
	~~</pre>~~

	What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned that I was compromised in some way. Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin on ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.

	~~So beware if you use WOT it seems to be feeding Kontera in some way.~~

	~~Where do I go from here?~~

	Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.

	~~===Comments===~~
	~~Some comments I found:~~

	~~http:~~//~~whatismyipaddress.com/ip/52.71.155.178~~

	~~Unrelated but interesting none the less. I now use Chrome so I guess I am not vulnerable to this: http://arstechnica.com/security/~~2016/04/~~noscript~~-~~and-other-popular-firefox-add-ons-open-millions-to-new-attack/~~

Kinscoe at 09:05, 30 April 2016

2016-04-30T09:05:31Z

← Older revision		Revision as of 09:05, 30 April 2016
Line 13:		Line 13:
	</pre>		</pre>

	What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned that I was compromised in some way. Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin in ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.		What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned that I was compromised in some way. Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin on ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.

	So beware if you use WOT it seems to be feeding Kontera in some way.		So beware if you use WOT it seems to be feeding Kontera in some way.

Kinscoe at 09:04, 30 April 2016

2016-04-30T09:04:54Z

← Older revision		Revision as of 09:04, 30 April 2016
Line 13:		Line 13:
	</pre>		</pre>

	What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned that I was compromised in some way? Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin in ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.		What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned that I was compromised in some way. Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin in ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.

	So beware if you use WOT it seems to be feeding Kontera in some way.		So beware if you use WOT it seems to be feeding Kontera in some way.

Kinscoe at 09:04, 30 April 2016

2016-04-30T09:04:28Z

← Older revision		Revision as of 09:04, 30 April 2016
Line 13:		Line 13:
	</pre>		</pre>

	What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned was ~~I compromise~~ in some way? Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin in ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.		What is interesting is for a while I could not figure where these requests were coming from. They clearly ignore indexing rules and my robots.txt settings. I was concerned that I was compromised in some way? Was it just my desktop? Thorough the process of elimination I noticed they stopped completely after I disabled the WOT plugin in ALL my computers. My Macbook, desktop and laptops. Even my wife's computer. Only after I did all of that did the requests completely disappear. This just started in March 2016.

	So beware if you use WOT it seems to be feeding Kontera in some way.		So beware if you use WOT it seems to be feeding Kontera in some way.

Kinscoe: /* Comments */

2016-04-13T14:40:18Z

Comments

← Older revision		Revision as of 14:40, 13 April 2016
Line 26:		Line 26:
	http://whatismyipaddress.com/ip/52.71.155.178		http://whatismyipaddress.com/ip/52.71.155.178

	Unrelated but interesting none the less. I now use Chrome so I guess I am not vulnerable to this.		Unrelated but interesting none the less. I now use Chrome so I guess I am not vulnerable to this: http://arstechnica.com/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/

	http://arstechnica.com/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/

Kinscoe: /* Comments */

2016-04-13T14:39:59Z

Comments

← Older revision		Revision as of 14:39, 13 April 2016
Line 26:		Line 26:
	http://whatismyipaddress.com/ip/52.71.155.178		http://whatismyipaddress.com/ip/52.71.155.178

	Unrelated but interesting ~~one~~ the less. I now use Chrome so I guess I am not vulnerable to this.		Unrelated but interesting none the less. I now use Chrome so I guess I am not vulnerable to this.

	http://arstechnica.com/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/		http://arstechnica.com/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/

Kinscoe at 14:39, 13 April 2016

2016-04-13T14:39:42Z

← Older revision		Revision as of 14:39, 13 April 2016
Line 21:		Line 21:
	Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.		Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.

	==Comments==		===Comments===
	Some comments I found:		Some comments I found:

Kinscoe at 14:39, 13 April 2016

2016-04-13T14:39:24Z

← Older revision		Revision as of 14:39, 13 April 2016
Line 1:		Line 1:
			==Web of Trust WOT==
	I have been using Web of Trust also known as "WOT" (https://www.mywot.com/) as a plugin for first Firefox and then 8 years ago when I switched to Chrome.		I have been using Web of Trust also known as "WOT" (https://www.mywot.com/) as a plugin for first Firefox and then 8 years ago when I switched to Chrome.

Line 20:		Line 21:
	Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.		Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.

			==Comments==
	Some comments I found:		Some comments I found:

	http://whatismyipaddress.com/ip/52.71.155.178		http://whatismyipaddress.com/ip/52.71.155.178

			Unrelated but interesting one the less. I now use Chrome so I guess I am not vulnerable to this.

			http://arstechnica.com/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/

Kinscoe at 01:02, 13 April 2016

2016-04-13T01:02:26Z

← Older revision		Revision as of 01:02, 13 April 2016
Line 19:		Line 19:

	Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.		Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.

			Some comments I found:

			http://whatismyipaddress.com/ip/52.71.155.178

Kinscoe at 21:47, 12 April 2016

2016-04-12T21:47:59Z

← Older revision		Revision as of 21:47, 12 April 2016
Line 18:		Line 18:
	Where do I go from here?		Where do I go from here?

	Not sure yet I blocked the IP from my web servers of course as soon as I ~~stared~~ to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.		Not sure yet I blocked the IP from my web servers of course as soon as I started to see this happen. I do like using WOT. Not sure why this started happening. I have not seen any discussion about it yet.