<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>DDOS &#8211; Virtually Fun</title>
	<atom:link href="https://virtuallyfun.com/category/ddos/feed/" rel="self" type="application/rss+xml" />
	<link>https://virtuallyfun.com</link>
	<description>Fun with Virtualization</description>
	<lastBuildDate>Fri, 31 May 2024 08:19:13 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>
	<item>
		<title>Well it looks like I&#8217;m popular in China again.</title>
		<link>https://virtuallyfun.com/2011/03/12/well-it-looks-like-im-popular-in-china-again/</link>
					<comments>https://virtuallyfun.com/2011/03/12/well-it-looks-like-im-popular-in-china-again/#comments</comments>
		
		<dc:creator><![CDATA[neozeed]]></dc:creator>
		<pubDate>Sun, 13 Mar 2011 00:09:00 +0000</pubDate>
				<category><![CDATA[DDOS]]></category>
		<guid isPermaLink="false">https://virtuallyfun.com/?p=379</guid>

					<description><![CDATA[This time I&#8217;ve had over 1,400 Windows 2000 users with IE 6.0 download the &#8216;full&#8217; binary build of Qemu 0.14.0 119.166.31.202 &#8211; &#8211; [12/Mar/2011:23:53:33 +0000] &#8220;GET /install/qemu-0.14.0.zip HTTP/1.1&#8221; 200 13320793 &#8220;-&#8221; &#8220;Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.0)&#8221; Like this&#8230;. &#8230; <a href="https://virtuallyfun.com/2011/03/12/well-it-looks-like-im-popular-in-china-again/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
										<content:encoded><![CDATA[<div class="separator" style="clear: both; text-align: center;"></div>
<div id="attachment_4762" style="width: 660px" class="wp-caption aligncenter"><a href="https://virtuallyfun.com/wp-content/uploads/2011/03/china-cell-phone-tracking.jpg"><img fetchpriority="high" decoding="async" aria-describedby="caption-attachment-4762" class="size-full wp-image-4762" src="https://virtuallyfun.com/wp-content/uploads/2011/03/china-cell-phone-tracking.jpg" alt="China &amp; Technology" width="650" height="477" /></a><p id="caption-attachment-4762" class="wp-caption-text">China &amp; Technology</p></div>
<p>This time I&#8217;ve had over 1,400 Windows 2000 users with IE 6.0 download the &#8216;full&#8217; binary build of Qemu 0.14.0</p>
<blockquote><p>119.166.31.202 &#8211; &#8211; [12/Mar/2011:23:53:33 +0000] &#8220;GET /install/qemu-0.14.0.zip HTTP/1.1&#8221; 200 13320793 &#8220;-&#8221; &#8220;Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.0)&#8221;</p></blockquote>
<p>Like this&#8230;.</p>
<blockquote><p># cat install-access.log|grep &#8216; MSIE 6.0; Windows NT 5.0&#8217; | wc -l<br />
1403</p></blockquote>
<p>Honestly I don&#8217;t see why they do it, so I&#8217;ve pulled the download. I really don&#8217;t see the appeal of it, and most anyone who cares about Qemu will be using the x86/x86_64 stuff anyways.</p>
]]></content:encoded>
					
					<wfw:commentRss>https://virtuallyfun.com/2011/03/12/well-it-looks-like-im-popular-in-china-again/feed/</wfw:commentRss>
			<slash:comments>2</slash:comments>
		
		
			</item>
		<item>
		<title>DDOS fun&#8230;</title>
		<link>https://virtuallyfun.com/2010/02/13/ddos-fun/</link>
					<comments>https://virtuallyfun.com/2010/02/13/ddos-fun/#comments</comments>
		
		<dc:creator><![CDATA[neozeed]]></dc:creator>
		<pubDate>Sun, 14 Feb 2010 03:12:00 +0000</pubDate>
				<category><![CDATA[China]]></category>
		<category><![CDATA[DDOS]]></category>
		<category><![CDATA[Hong Kong]]></category>
		<guid isPermaLink="false">https://virtuallyfun.com/?p=200</guid>

					<description><![CDATA[Well it seems at some point China has decided they don&#8217;t like me, and they are now DDOS&#8217;ing my server&#8230; Or they have some bot net that is OBSESSED with Windows NT 3.1 servicepack 3 for the i386&#8230; So as &#8230; <a href="https://virtuallyfun.com/2010/02/13/ddos-fun/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
										<content:encoded><![CDATA[<p>Well it seems at some point China has decided they don&#8217;t like me, and they are now DDOS&#8217;ing my server&#8230; Or they have some bot net that is OBSESSED with Windows NT 3.1 servicepack 3 for the i386&#8230;</p>
<p>So as much as I don&#8217;t want to, I&#8217;ll end up blocking China, Taiwan, Hong Kong from my server&#8230;. Oh well.</p>
<p>One can only speculate what on earth they find so interesting.</p>
<p>If anyone is interested, you can find a script <a href="https://web.archive.org/web/20101125052734/http://www.iisfaq.com/Default.aspx?tabid=2804">here</a>, that&#8217;ll add a list of IP addresses into a block list for IIS.</p>
<p>Then it&#8217;s just a matter of downloading a table of IP addresses. I&#8217;m using <a href="https://web.archive.org/web/20130626042003/http://www.ipinfodb.com/">these guys</a> right now&#8230; I just downloaded the csv version, ran it through access, and used that to create some queries for some tables, then ran that data through some minor C program I ended up writing to massage the netmasks into something the script would like. It&#8217;s not &#8220;nice&#8221; but it works. Then afterwards since they keep on downloading the same file, I just extract my IIS logs into access which has the IP address set as a primary key, then I&#8217;m just making /24&#8217;s of each one that does so&#8230;.</p>
<p>Sigh, I don&#8217;t get why they are doing it, but they are getting a whole lot of 403&#8217;s now.</p>
]]></content:encoded>
					
					<wfw:commentRss>https://virtuallyfun.com/2010/02/13/ddos-fun/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
			</item>
	</channel>
</rss>
