Uncategorized
I was making some changes on a web server that necessitated restarting the process, which I did. As per normal, I went and tailed the logs to make sure everything was coming back up all hunky dory.
Now, you all know me. I accept a wide variety of events as being normal.
This… this was not normal.
Won’t you look into my log file?
At least, I don’t normally find messages like this in my system logs.
I was half expecting the next message to be information about where the next group meeting is taking place, and the bank account information to use for the transfer for all of my server’s worldly assets.1
The IP is in a /16 (…) registered to the Chaos Computer Club for 30 days, for use at their annual gathering, the Chaos Communication Congress, which is going on now.
whois 151.217.177.200 % This is the RIPE Database query service. % Information related to '151.217.0.0 - 151.217.255.255' % Abuse contact for '151.217.0.0 - 151.217.255.255' is 'abuse@ccc.de' inetnum: 151.217.0.0 - 151.217.255.255 netname: DE-CCC-20151201 descr: Chaos Computer Club Veranstaltungsgesellschaft mbH remarks: =========================================== remarks: === _________ ____ _____ === remarks: === |___ /___ \ / ___|___ / === remarks: === |_ \ __) | | |_ \ === remarks: === ___) / __/| |___ ___) | === remarks: === |____/_____|\____|____/ === remarks: === === remarks: === 32nd Chaos Communication Congress === remarks: === http://events.ccc.de/congress/2015/ === remarks: === December 27th to 30th, 2015 === remarks: =========================================== remarks: === === remarks: === If you have trouble with users from === remarks: === this netblock, please call our === remarks: === === remarks: === ABUSE HOTLINE: +49 40 2318891984 === remarks: === === remarks: =========================================== country: DE org: ORG-CCCV23-RIPE sponsoring-org: ORG-CCCE3-RIPE admin-c: CCC-RIPE tech-c: CCC-RIPE status: ASSIGNED PI remarks: Temporary assignment remarks: (start date: 2015/12/01, end date: 2015/12/31 remarks: and duration 30 days) mnt-by: CHAOS-MNT mnt-by: RIPE-NCC-END-MNT
I’m not entirely sure whether to construe this as neat, amusing, or disconcerting. All three, perhaps?
Hrm. More accurately, I think *all* web servers are being wooed. 🙂 https://isc.sans.edu/ipinfo.html?ip=151.217.177.200
I got it too!
Heh, I see it too, 21:35 last night 😀