Help
RSS
API
Feed
Maltego
Contact
Domain > n1.taur.dk
×
Welcome!
Right click nodes and scroll the mouse to navigate the graph.
×
More information on this domain is in
AlienVault OTX
Is this malicious?
Yes
No
DNS Resolutions
Date
IP Address
2024-08-16
217.198.219.102
(
ClassC
)
Port 80
HTTP/1.1 200 OKdate: Fri, 16 Aug 2024 23:13:08 GMTserver: Apache/2.4.61 (Fedora Linux) OpenSSL/3.1.1x-powered-by: PHP/8.2.21vary: Accept-Encoding,User-Agentstrict-transport-security: max-age15768000transfer-encoding: chunkedcontent-type: text/html; charsetUTF-8 !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN>HTML>script>window.onload function() { var image document.getElementById(reloader1); function updateImage() { image.src image.src.split(?)0 + ? + new Date().getTime(); } setInterval(updateImage, 3000);}/script>HEAD>META HTTP-EQUIVCONTENT-TYPE CONTENTtext/html; charsetwindows-1252>TITLE>n1.taur.dk/TITLE>/HEAD>BODY LANGen-GB DIRLTR>CENTER>TABLE WIDTH700 BORDER0 CELLPADDING4 CELLSPACING0 STYLEpage-break-before: always> TR> TD> P> BR>BR> /P> P ALIGNCENTER>B>FONT SIZE5 STYLEfont-size: 20pt>FONT FACEArial, sans-serif> n1.taur.dk /FONT>/FONT>/B> /P> P> n1 is a stratum 1 server steered by pair of GPS receivers.br> n1 exists because I need a reliable source of time. One where I know itll either give correct time, or be honest and say it is unsynchronized. Ive been burned one time too many. /P> P> B>2024.06.29 DDoS - kinda yay?/B>br> Upstream is now filtering, and nothing is affected. Attack traffic is from that federation.br> Edit: Now IPv6. Autoblocked. /P> P> B>2022.10.31 A Quarter of the world - yay?/B>br> This server has now seen a quarter of the IPv4 address space as clients. The first 600 million addresses went quickly enough, then it took somewhat more time. IPv6 is now 25%, total is about 240 terabytes of NTP traffic. Shoutout to Vatican City for using me as primary time source /P> P> B>2022.05.22: Spoofing, and SPF+DKIM+DMARC/B>br> b> Someone is spoofing the taur domain, and presenting this hosts name in the handshake. So the SPF rejects and DKIM failure are to be taken seriously. Hooray for dmarc reporting. /b> /P> P> B>2020.03.25: Fibre is good for the tummy/B>br> The cause of the receiver resets is a combination of a firmware bug and the characteristics of a local noise source. The plan is to switch to a different receiver - until then, the secondary receiver is going to be the master. The secondary receiver is now also an MC-1010, but it is located in the roof of building 10. A bit of encoding magic drives PPS and TXD over the same fibre with very low jitter. From the ceiling space, the first stop is server room 10, it gets patched through and ends up at the building 10 exit point. It gets patched out, and arrives in the building 8 switching room, gets patched again, and ends up in server room 8, with who knows how much loss due to the ebay-quality patch cords I used. There it gets decoded and drives N1.br> All is not well though - I know that I have 16us of transmission delay, and its not subtracted out yet - ntpd is being cross with me. So, sadly, Im 16us off. Not that anyone outside is going to care, but I do. /P> P> B>2020.10.30: Random guess/B>br> The 3.3V regulator in front of the GPS receiver is well behaved, low noise, verified good, and highly reliable type. But it is also the only part of channel 1 I have not replaced. So I have now replaced the known good regulator with a hacky zener-transitor regulator. And while at it, removed the holdover battery. /P> P> B>2020.10.22: New serial card/B>br> The server is suffering resets in the primary GPS receiver. I have replaced the receiver, the line driver, the cable, and I still have the resets. So, in went a new serial card, timer-capture module, and power supply for the line drivers on the server end. They are the only things I have not yet replaced. Funny thing, those two cards cost more than the rest of the server. No resets yet, but I will know in a month or two. /P> /TD> /TR> TR> TD VALIGNTOP> P> BR>BR> /P> P>IMG SRC/clock/peer.png>/P> P>IMG SRC/clock/packets.png>/P> br>b>Sky view/b>br> This is an intensity-graded plot of signal strength, seen both as the usual sky view, and as a south-centered cylindrical projection. Blue indicates that the satellite is excluded from the solution, red that the receiver has lost lock. P>IMG SRC/clock/gps.png?x idreloader1> /P> P>IMG SRC/clock/peerlo.png>/P> /TD> /TR> /TABLE>/CENTER>P>BR>BR>/P>/BODY>/HTML>
Port 443
HTTP/1.1 200 OKDate: Fri, 16 Aug 2024 23:13:08 GMTServer: Apache/2.4.61 (Fedora Linux) OpenSSL/3.1.1X-Powered-By: PHP/8.2.21Vary: Accept-Encoding,User-AgentStrict-Transport-Security: max-age32140800Transfer-Encoding: chunkedContent-Type: text/html; charsetUTF-8 !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN>HTML>script>window.onload function() { var image document.getElementById(reloader1); function updateImage() { image.src image.src.split(?)0 + ? + new Date().getTime(); } setInterval(updateImage, 3000);}/script>HEAD>META HTTP-EQUIVCONTENT-TYPE CONTENTtext/html; charsetwindows-1252>TITLE>n1.taur.dk/TITLE>/HEAD>BODY LANGen-GB DIRLTR>CENTER>TABLE WIDTH700 BORDER0 CELLPADDING4 CELLSPACING0 STYLEpage-break-before: always> TR> TD> P> BR>BR> /P> P ALIGNCENTER>B>FONT SIZE5 STYLEfont-size: 20pt>FONT FACEArial, sans-serif> n1.taur.dk /FONT>/FONT>/B> /P> P> n1 is a stratum 1 server steered by pair of GPS receivers.br> n1 exists because I need a reliable source of time. One where I know itll either give correct time, or be honest and say it is unsynchronized. Ive been burned one time too many. /P> P> B>2024.06.29 DDoS - kinda yay?/B>br> Upstream is now filtering, and nothing is affected. Attack traffic is from that federation.br> Edit: Now IPv6. Autoblocked. /P> P> B>2022.10.31 A Quarter of the world - yay?/B>br> This server has now seen a quarter of the IPv4 address space as clients. The first 600 million addresses went quickly enough, then it took somewhat more time. IPv6 is now 25%, total is about 240 terabytes of NTP traffic. Shoutout to Vatican City for using me as primary time source /P> P> B>2022.05.22: Spoofing, and SPF+DKIM+DMARC/B>br> b> Someone is spoofing the taur domain, and presenting this hosts name in the handshake. So the SPF rejects and DKIM failure are to be taken seriously. Hooray for dmarc reporting. /b> /P> P> B>2020.03.25: Fibre is good for the tummy/B>br> The cause of the receiver resets is a combination of a firmware bug and the characteristics of a local noise source. The plan is to switch to a different receiver - until then, the secondary receiver is going to be the master. The secondary receiver is now also an MC-1010, but it is located in the roof of building 10. A bit of encoding magic drives PPS and TXD over the same fibre with very low jitter. From the ceiling space, the first stop is server room 10, it gets patched through and ends up at the building 10 exit point. It gets patched out, and arrives in the building 8 switching room, gets patched again, and ends up in server room 8, with who knows how much loss due to the ebay-quality patch cords I used. There it gets decoded and drives N1.br> All is not well though - I know that I have 16us of transmission delay, and its not subtracted out yet - ntpd is being cross with me. So, sadly, Im 16us off. Not that anyone outside is going to care, but I do. /P> P> B>2020.10.30: Random guess/B>br> The 3.3V regulator in front of the GPS receiver is well behaved, low noise, verified good, and highly reliable type. But it is also the only part of channel 1 I have not replaced. So I have now replaced the known good regulator with a hacky zener-transitor regulator. And while at it, removed the holdover battery. /P> P> B>2020.10.22: New serial card/B>br> The server is suffering resets in the primary GPS receiver. I have replaced the receiver, the line driver, the cable, and I still have the resets. So, in went a new serial card, timer-capture module, and power supply for the line drivers on the server end. They are the only things I have not yet replaced. Funny thing, those two cards cost more than the rest of the server. No resets yet, but I will know in a month or two. /P> /TD> /TR> TR> TD VALIGNTOP> P> BR>BR> /P> P>IMG SRC/clock/peer.png>/P> P>IMG SRC/clock/packets.png>/P> br>b>Sky view/b>br> This is an intensity-graded plot of signal strength, seen both as the usual sky view, and as a south-centered cylindrical projection. Blue indicates that the satellite is excluded from the solution, red that the receiver has lost lock. P>IMG SRC/clock/gps.png?x idreloader1> /P> P>IMG SRC/clock/peerlo.png>/P> /TD> /TR> /TABLE>/CENTER>P>BR>BR>/P>/BODY>/HTML>
View on OTX
|
View on ThreatMiner
Please enable JavaScript to view the
comments powered by Disqus.
Data with thanks to
AlienVault OTX
,
VirusTotal
,
Malwr
and
others
. [
Sitemap
]