Weird Military website warns you are being monitored

reply to post by DaddyBare


Target: gcic.af.mil

Nodes: 2


Node Data
Node Net Reg IP Address Location Node Name
2 1 - 131.6.12.77 Newport News


Packet Data
Node High Low Avg Tot Lost
2 ---- ---- ---- 2 2


Network Data
Network id#: 1

Query terms are ambiguous. The query is assumed to be:
n 131.6.12.77

Use ? to get help.






NetRange: 131.6.0.0 - 131.6.255.255
CIDR: 131.6.0.0/16
OriginAS:
NetName: LANGLEY1-NET
NetHandle: NET-131-6-0-0-1
Parent: NET-131-0-0-0-0
NetType: Direct Assignment
NameServer: MUHJ-NS-001.ACC.AF.MIL
NameServer: MUHJ-NS-002.ACC.AF.MIL
NameServer: NS4.ACC.AF.MIL
NameServer: NS3.ACC.AF.MIL
RegDate: 1988-09-08
Updated: 2009-07-30
Ref: whois.arin.net...

OrgName: 754th Electronic Systems Group
OrgId: 7ESG
Address: 501 E. Moore Drive
City: MAFB-Gunter Annex
StateProv: AL
PostalCode: 36114
Country: US
RegDate: 2008-06-05
Updated: 2010-08-25
Ref: whois.arin.net...

OrgTechHandle: JAMES23-ARIN
OrgTechName: Newton, James A
OrgTechPhone: +1-334-416-2719
OrgTechEmail: [email protected]
OrgTechRef: whois.arin.net...

OrgTechHandle: TIMAM1-ARIN
OrgTechName: Moore, Tim A
OrgTechPhone: +1-334-416-2845
OrgTechEmail: [email protected]
OrgTechRef: whois.arin.net...

OrgTechHandle: REGIS10-ARIN
OrgTechName: Registration
OrgTechPhone: +1-800-365-3642
OrgTechEmail: [email protected]
OrgTechRef: whois.arin.net...


ARIN WHOIS data and services are subject to the Terms of Use
available at: www.arin.net...

reply to post by CHA0S


Well,I just did a few seconds ago!I know "they"
won't like what "they" will see,another conspiracy
theorist trying to take a peek at "their" secrets.

If I get in trouble for this...the op won't get any of
Mama's homebaked cookies!

Been around for a long time
RegDate: 2008-06-05
Now I'm wondering if this is a training site...
ya know one where they teach newbees to build sites like a search engine????
we had a lot of those at the college I went too, if someone got into one of those by accident they wouldnt know it wasnt real but rather something we used in coder classes???
But my gut still says this is "NOT" a normal up and ready for daily use dot mil site...

Originally posted by ATLien
reply to post by badw0lf

 

How do you decide my intent? I was intrigued and now I'm not, "Unsuspecting" is a little much isn't it...No one on this site is illiterate, I described it in the title, then in the thread, your computer warned you and then the site warned you. That's 4 descriptions, so who's "unsuspecting" here? All scared and presumptuous, What's the worst case scenario? Is there even one?

Whatever, go do it from other forums, get your safety net that way.

And just because you are the law enforcements nightmare, doesn't mean everyone is.

reply to post by OTTOKARMA


Check this out..It has the same feel to it (minus the warnings), and towards the bottom it refers you to the "Honey Pot" site..Heres the quote from page 37-"Industry is encouraged to provide relevant technologies in these areas via the GCIC web site at www.gcic.af.mil..."

Hers is the similar site:
www.afspc.af.mil...

Click here for more information.

reply to post by DaddyBare


yup, it scream "honeypot" to me
but apparently its used to convoy and store datas like a hubnet in a school

ATS is a discussion board, and anyone is welcome here to discuss things.

I do hope thats clear.

reply to post by neformore


Got it, sorry..But yea, I'm no programmer or anything but these 2 sites were definitely created by the same person/s.
1.gcic.af.mil...
2.www.afspc.af.mil...

reply to post by ATLien

about www.afspc.af.mil
i got this

Target: www.afspc.af.mil

Nodes: 13


Node Data
Node Net Reg IP Address Location Node Name
13 1 1 62.41.63.63 s-Gravenhage static-ip-62-41.eurorings.net


Packet Data
Node High Low Avg Tot Lost
13 250 250 250 1 0


Network Data
Network id#: 1
This is the RIPE Database query service.
The objects are in RPSL format.

The RIPE Database is subject to Terms and Conditions.
See www.ripe.net...

Note: This output has been filtered.
To receive output for a database update, use the -B flag.

Information related to '62.41.0.0 - 62.41.255.255'

inetnum: 62.41.0.0 - 62.41.255.255
netname: NL-KPN-BBT-20000510
descr: Koninklijke KPN N.V.
country: NL
org: ORG-KOVN1-RIPE
admin-c: JZ1998-RIPE
admin-c: ADS-RIPE
tech-c: KPN-RIPE
status: ALLOCATED PA
remarks: Static IP KPN customers
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: AS286-MNT
mnt-routes: AS286-MNT
mnt-domains: AS286-MNT
source: RIPE Filtered

organisation: ORG-KOVN1-RIPE
org-name: KPN B.V.
org-type: LIR
descr: KPN Internet Solutions
address: KPN
Henk Hoogvliet
PO Box 30000
2500 GA The Hague
NETHERLANDS
phone: +31 70 4512906 begin_of_the_skype_highlighting              +31 70 4512906      end_of_the_skype_highlighting
phone: +31 70 4513398
fax-no: +31 70 4511116
e-mail: [email protected]
admin-c: ADS-RIPE
admin-c: AWH-RIPE
admin-c: BT6-RIPE
admin-c: KPN-RIPE
admin-c: JZ1998-RIPE
admin-c: KPN-RIPE
admin-c: FVD5-RIPE
admin-c: PBOS-RIPE
admin-c: RH13540-RIPE
admin-c: TJ354-RIPE
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: AS286-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE Filtered

role: KPN Internet
address: KPN
address: P.O. Box 30000
address: 2500 GA Den Haag
address: Netherlands
phone: +31 70 4513500
phone: +31 70 4513398
fax-no: +31 70 4511116
e-mail: [email protected]
e-mail: [email protected]
remarks: trouble: +-------------------------------------------
remarks: trouble: | Operational issues: [email protected] |
remarks: trouble: | Peering issues: [email protected] |
remarks: trouble: +-------------------------------------------
admin-c: JZ1998-RIPE
admin-c: ADS-RIPE
admin-c: BT6-RIPE
admin-c: PBOS-RIPE
admin-c: SOHC4-RIPE
admin-c: FVD5-RIPE
admin-c: TJ354-RIPE
admin-c: AWH-RIPE
tech-c: ADS-RIPE
tech-c: BC70-RIPE
tech-c: EP4185-RIPE
tech-c: LE864-RIPE
tech-c: MS2199-RIPE
tech-c: PF-RIPE
tech-c: MK6932-RIPE
tech-c: HB2754-RIPE
tech-c: MF7167-RIPE
tech-c: RV2905-RIPE
tech-c: MH5996-RIPE
tech-c: GvV48-RIPE
tech-c: RB15535-RIPE
tech-c: TP5384-RIPE
tech-c: BT6-RIPE
tech-c: AO1625-RIPE
tech-c: AK73
tech-c: SOHC4-RIPE
tech-c: FVD5-RIPE
tech-c: TJ354-RIPE
remarks: ========================================
remarks: Role Object for KPN Internet Solutions
remarks: For urgent operational issues, change requests, routing
remarks: policies, etc use the email address [email protected]
remarks: For portscans, DoS attacks and spam complaints, please use
remarks: the email address [email protected] .
remarks: Please include all headers and logging where appropriate.
remarks: For domain changes use the email address [email protected]
remarks: ========================================
nic-hdl: KPN-RIPE
mnt-by: AS286-MNT
source: RIPE Filtered

person: John van Zanten
nic-hdl: JZ1998-RIPE
address: KPN Internet Office
address: P.O. Box 30000
address: NL-2500 GA The Hague
e-mail: [email protected]
fax-no: +31 70 4511116
phone: +31 70 4512906
mnt-by: AS286-MNT
source: RIPE Filtered

person: Ad Spelt
address: KPN Internet Solutions
address: i-Develop New Architectures
address: P.O. Box 30000
address: NL-2500 GA The Hague
phone: +31 70 3711711
fax-no: +31 70 3713340
e-mail: [email protected]
nic-hdl: ADS-RIPE
mnt-by: AS286-MNT
source: RIPE Filtered

Information related to '62.41.0.0/16AS286'

route: 62.41.0.0/16
descr: KPN Eurorings
origin: AS286
mnt-by: AS286-MNT







Registrant:
KPN International Network Services
KPN Eurorings
Postbus 30000
Den Haag 2500GA
NL

Domain Name: EURORINGS.NET



Administrative Contact, Technical Contact:
OTS OER D&E NS, OVN [email protected]
KPN Telecom B.V.
KPN Eurorings
Postbus 30000
Den Haag 2500GA
NL
+31 70 343 0028 fax: 999 999 9999


Record expires on 28-Sep-2019.
Record created on 29-Sep-1998.
Database last updated on 18-Sep-2010 10:30:01 EDT.

Domain servers in listed order:

NS1A.EURORINGS.NET 193.242.90.198
NS2A.EURORINGS.NET 193.242.91.195
NSZ1.DE.KPN-EURORINGS.NET 193.141.40.115

Linked to gcic.af.mil directly thru 2 IP masquerading

reply to post by OTTOKARMA


So are those 2 sites affiliated in any way? Are neither real government sites?

I access various military and government sites all the time...so I had no problem accessing this. Looks like a real website to me

What is OneSource?
OneSource is an evolving data analysis and exploration tool used internally by the USAF Air Force Command and Control Integration Center (AFC2IC) Vocabulary Services Team, and provided at no additional cost to the greater Department of Defense (DoD) community. It empowers its users with a consistent view of syntactical, lexical, and semantic data vocabularies through a community-driven web environment, directly supporting the DoD Net-Centric Data Strategy of visible, understandable, and accessible data assets.

Who does OneSource serve?
OneSource serves developers, integrators, managers, and community-of-interest (COI) participants as a focus point for searching, navigating, annotating, matching, and mapping data terms extracted from military standards, COI vocabularies, programs of record, and other schemas and data sources. OneSource promotes awareness, cross-collaboration, rapid reuse, increased compatibility, and decreased complexity of data vocabularies, saving time and costs associated with integration, mediation, and development.

What is the Vocabulary Services Team?
The AFC2IC Vocabulary Services Team serves the Coalition Warfighter through data vocabulary analysis, vocabulary interoperability assessment, and service-oriented-architecture (SOA) application within the domain of USAF operations. The team provides expert support for data vocabulary development, cross-system-integration, gap resolution, and capability exercises. Subject coverage includes DoD and NATO data exchange Standards (including Message Text Formats, Tactical Data Links, and Information Exchange Data Models), COI vocabularies, and related government and industry data standards.

Since everyone is so scared to proceed thru the warning screen:


Screen Shot

reply to post by ATLien


they're related but one is just a honey pot made to attract young rebellious hackers

Originally posted by OTTOKARMA
reply to post by ALOSTSOUL

 

its a screencap of a man-in-the-middle sniffing session

analyzing raw tcp/ip and icmp packets exchanged between my fake ip and their servers
to make it simple, they're using multiples ip changers to cover their real ips and prevent from peoples to poke thems with sticks

oh and to see if they're able to catch some peoples attracted by their ip

I'd suspect using a nix server with IP chains.

Kinda explains the multiple IP's.

It's also pretty much standard for nix hardware firewall. Honey pot may be somewhere behind that.

Nothing nefarious about all that - pretty much standard setup for securing a network using a nix server as a firewall.

Originally posted by greeneyedleo
I access various military and government sites all the time...so I had no problem accessing this. Looks like a real website to me

That was my initial thought, It's too elaborate and knowledgeable to be anything but official..a little sketchy, but official none the less.

Don't be afraid kids.

This is SOP for a password protected .mil website. I can't even check my work email from home without going through at least 3 of those Firefox "Untrusted Connection" screens (I guess .mils don't keep their certificates up to date, or don't use them at all) and a "terms of service" warning that says they monitor the connection etc.

This website looks like a database for US Air Force (and interagency) coding and data networking. We use more and more of these wiki type applications. The only thing I see thats weird about it is that its extremely well designed for a military website and it didn't take 15 minutes to load up on my satellite modem. But it wouldn't surprise me if the Air Force was significantly better at that stuff than the Army.

My AKO username/pass didn't work, and I don't have a CAC reader on my PC so I couldn't sign into the site, so I can't tell you if the inside is any more interesting than the outside.

So if you're curious take a look, they're not going to show up on your front yard with black helicopters, but you won't find anything too interesting.

reply to post by Emptiness Dancing


yeah, they're using the same old ip cycle ,with the initial ip located at USAFA.AF.Mil
and damn, i rarely saw so much security breachs

HA HA I'm in! whats the big deal apart from it been a MIL. site?
use with caution maybe but looks like a search engine to me
BUT it may be a data mining site also.not sure as yet as i
skipped to through the post's.

Either the creator of OneSource was really into the chinese, eight sided Taoist Bagua symbol or they were just really into Lost and wanted to make their own Dharma initiative logo.

Either way you look at it, they butchered it.