0

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this:

j0h@server:~$ w
 22:06:02 up 18 days,  7:02,  3 users,  load average: 0.71, 0.35, 0.17
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
j0h      tty5                      07Jun14 14days  0.38s  0.33s -bash
j0h      pts/0    :0.0             Fri21   24:08m  0.20s  0.20s /bin/bash
j0h      pts/2    182.53.252.66.kn 22:01    2.00s  0.22s  0.00s w

so then, I saw the 182.53.252.66.kn address and I am wondering, what is that address? That isnt my usual IP. so then, I checked my IP address, and indeed, they do not match. I decided to browse the IP 182.53.252.66 in Firefox for giggles, and got a response from a cheap router,TD854W. enter image description here

so then I decided to check against my webserver, what my IP is, via the access logs, which threw back my normal IP address.

Next, I used dig, nslookup, and whois which shows me a recurring theme that my traffic is headed through a totbb.net ;; ANSWER SECTION: 66.252.53.182.in-addr.arpa. 80 IN PTR node-1dtu.pool-182-53.dynamic.totbb.net.

This all seems suspicious to me. As an East coast denizen, having my traffic go through Bangkok seems peculiar. The TD854W isn’t exactly ISP class hardware. and I'm just totally sketched out at the moment.

Any words of wisdom? Am I just being paranoid? Should I be looking for something else? I have a proprietary ZHONE modem at home, I have no idea how to determine if it has been compromised, and there is no determinable interface I can find. Should I contact my ISP about this?

  • It may be a truncated FQDN. – user42178 Jun 22 '14 at 3:19
  • If you don't want to resolve IP addresses to host names (which will often contain the IP address in reverse order), simply use w -i (with GNU tools) or netstat -n. – dr jimbob Jun 22 '14 at 6:58
2

That's a truncated hostname, and it's actually in reverse IP order. The full hostname is 182.53.252.66.knds.xdsl.dyn.ottcommunications.com. OTT Communications seems to cover from Maine to West Virginia. Maybe they're your ISP, or your ISP resells for them? Does your IP match 66.252.53.182?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.