WARNING: DNS fuckery is in progress

I posted about this two days ago but I didn't have many details and, besides, nobody cared.

>>13539045 >>13539087 >>13539344 >>13539407 >>13539417

This is serious. The situation is stable right now but there is clearly a plan to open a can of worms on the anons here. DNS servers worldwide are being seeded with invalid IP addresses for "8kun.top". Apparently, this is being done through an exploit and some servers may be immune. Use this link to monitor the situation:

https://dnspropagation.net/A/8kun.top

Refresh the page a few times and look through it to see if some servers are showing just one IP address for this site. There should be a set of 8. The bad DNS lookups appear randomly. This is happening with my own ISP and also with Google DNS. I am still trying to determine if Cloudflare or OpenDNS are vulnerable.

Now, the key to this is what is called the TTL which means "Time To Live". It is normally 60 seconds for this site. This means that, if your DNS server gets hit with an invalid IP address then you need only wait 60 seconds for your DNS cache to refresh and get a new address. This is why there are no howls of grief. People simply assume that a random glitch occurred because it goes away quickly. Note that this may not necessarily be true for everybody. Though the TTL is supposed to be 60 seconds, some DNS servers (meaning the one supplied by your ISP) may ignore this value. I don't know this but you should keep it in mind if the site seems to go down for a long period.

There are two critical subdomains involved: "8kun.top" and "media.8kun.top". If "8kun.top" fails, auto-updates will fail and the catalog will fail. If "media.8kun.top" fails, images and other media will not load. The two will RARELY fail at the same time. This is another reason why it may look like just a temporary glitch. The frequency of occurrence is around once every two hours though YMMV.

I have seen only one problem report: >>13554086

why did I just get an error message for 8kun from facebook?

I have verified that this can happen. Some of the invalid IP addresses are owned by Facebook and I have found two which are live. None of the others are live. Here is a list of addresses which resolve with a reverse DNS lookup:

31.13.66.1 - edge-secure-shv-01-iad3.facebook.com

31.13.68.22 - edge-extern-shv-03-xsp1.facebook.com (live)

31.13.85.8 - edge-star-shv-01-gru2.facebook.com (live)

31.13.95.37 - whatsapp-chatd-msgr-mini-edge-shv-02-cgk1.facebook.com

64.13.232.149 - acmkoieeee.gs02.gridserver.com

74.86.226.234 - ea.e2.564a.ip4.static.sl-reverse.com

108.160.172.208 - experiment.v.dropbox.com

These IP addresses do not resolve:

31.13.66.23, 31.13.90.19, 69.63.176.59, 69.63.187.12, 69.171.244.12,

103.252.115.53, 104.244.43.57, 104.244.46.85, 104.244.46.211, 108.160.163.116,

108.160.165.211, 108.160.170.51, 185.45.7.189

There could be hundreds of addresses being circulated. I am no expert on DNS or Internet security so I have no conclusion to make about the distribution. I will note that a cursory examination suggests to me that the addresses are all under the control of possibly just one Internet authority. Look here:

https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks

This is what we need to be prepared for

If the exploit which is being used to seed bad IP addresses can also be used to modify the TTL then we could be in for a world of hurt. Simply extending the TTL to an hour or so could take down the site for many anons and reduce the traffic considerably. The site operators and Vanwanet would not even know what happened because the exploit only targets the anons. This would work like a valve. Open the valve to let the traffic through and then close it for any desired period of time. There would be little or nothing that Vanwanet could do. However, savvy anons know exactly what to do because we've been through this before. Change your DNS server to one which does not seem to be affected. Or change your "hosts" file. These are the currently valid IP addresses for the site:

sys.8kun.top: 185.165.190.88

8kun.top, media.8kun.top, nerv.8kun.top, softserve.8kun.top:

94.103.81.80, 94.103.82.74, 94.103.94.73, 109.234.38.4

193.178.169.19, 193.178.169.117, 195.2.92.96, 195.2.93.193

I leave it to other anons to provide the instructions for hardening your system. I will update as needed.

WWG1WGA

>>13555604

Read my post again carefully. This is an exploit being perpetrated by a bad actor.

>>13555638

We should brace ourselves for a false flag or whatever very soon.

>please keep us updated even if you get very few replies

Right now, 90% of the anons are scratching their heads

>>13555687

That's the weird thing. That IP address MIGHT work (I tried it once) but there is no guarantee. It is not a valid address for "8kun.top".

>>13555705

Yeah, I don't pretend to understand it either. Worth trying in a pinch but that is all.

>>13555736

I'm with you, anon. Fire and brimstone. Just let it rip. I don't care if I die (well, maybe just a little).

>>13555746

There is also a lumber shortage in the U.S. A recent video suggests that they are stockpiling to push up the price,

Much fuckery going on.

Reminds me of the oil "shortage" in 1976 (not sure of the year). I was in the cleaning business and I heard from a salesman that 3M was stockpiling garbage bags while claiming that there was a garbage bag shortage due to the "oil crisis". Bunch of criminals.

>>13555768

U.S. soldiers are (or were) guarding the poppy fields in Afghanistan.

>>13555771

Hard to tell. Could be just good ol' greed.

>>13555773

>god was busy talking to lots of people in genesis especially promising them a alot, kek !!

Oh? You mean like Trump and Q? Kek.

>>13555778

You think "price fixing" is just a "conspiracy theory"? Kek.

>>13555781

>>chek em double trips chek'ed, quite impressive,

Wow. And I keep not noticing that shit.

>imagine how bad things would be if we were still in ignorance

Yeah. Hard to go back to being the ignorant pussies we once were.

Not that we were really ignorant but Q provided a lot of confirmation. Bless Q!

>>13555782

Interesting. But this looks to be targeting client vulnerability not DNS server vulnerability.

>>13555793

The first meme is great. I don't quite grasp the second one.

>>13555804

That was a great fucking show!

>>13555822

Hmm. I should have a look around to see if I can identify the vulnerability that is being used to hack the DNS for 8kun.

BAKER

Just a note to ask you NOT to notable this post: >>13555587 (WARNING: DNS fuckery is in progress)

I will post an updated version in the next bread.

>>13555868

Depends on your physiology, I guess. Never did anything good for me either.

>>13555887

Yeah, (((they))) want us all stoned and stupid.

Drugs and circuses for the masses.

>>13555892

Trump never plays to lose. You be asshoe.

>>13555913

What part of "It's a marathon, not a sprint" do you not understand?