Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following.

I'm noticing taffic from our network to the following IP address: 8.26.202.125 . I see from http://robtex.com that this IP address belongs to a CDN provider (Level 3 Communications) and that the IP seems to be used a lot for porn stuff, via rncdn1.com sub-domains among others (see http://www.robtex.com/ip/8.26.202.125.html#ip).

Thinking that I had infected machines in our network (one of the source was a Windows server, and our sysadmins are not addicted to porn!), I fired up Wireshark to find out the contents of the packets. The packets contained what seem to be valid Windows Update requests:

    HEAD /v9/windowsupdate/redir/muv4wuredir.cab?1204161927 HTTP/1.1\r\n
    GET /v9/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab?1204161927
    HTTP/1.1\r\n
    GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\n
    .
    .
    .

I know that these can be good-looking requests that are in fact "bad stuff hidden", but I'm wondering: could this be valid traffic and it's just Microsoft using this CDN for its updates? I find it weird that Microsoft would use a CDN that is also used to serve porn stuff. But then again, we've seen stranger things :-)

Thank you.

share|improve this question
Keep in mind that Microsoft allows anyone willing to pay to use it's CDN services. windowsazure.com/en-us/home/features/cdn – Billy ONeal Apr 18 '12 at 17:46
You're right Billy. I was actually talking about the opposite: Microsoft using another CDN (Level 3 Communications) for the distribution of its Windows Updates, with this CDN also being used to deliver porn stuff :-) – pat Apr 19 '12 at 12:35

1 Answer

up vote 2 down vote

According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners.

As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more interesting report, YouPorn alone takes up 2% of the Internet's traffic. To Level 3 Microsoft are, relatively speaking, small fry.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.