Web.com and Microsoft

On Sun, 05 Aug 2007 09:35:42 -0700
"John Bailo, Texeme.Construct" <jabailo.TakeThisOut@texeme.com> wrote:

> On Aug 5, 9:31 am, Shibal Nom <truth1....TakeThisOut@googlemail.com> wrote:
> > Rumor has it that Web.com is using RedHat servers with Microsoft
> > proxy servers in front of them to make Microsoft think they are
> > running their servers.
>
> MS is trying to take money from Cisco by pushing ISA.

How do you draw that conclusion? Cisco are network hardware, not
exactly proxy market leaders.

ISA is just about the worst proxy server going, we used to have one
setup back in the day before I was netadmin, it needed a reboot just
about every week.

--
The dual T1 to www.tatooine.net is reporting 100% packet loss because
of the Dali-Lama. The Sys Admin is laying off the portland office.
:: http://www.s5h.net/ :: http://www.s5h.net/gpg

On Sun, 05 Aug 2007 16:31:52 -0000
Shibal Nom <truth1984.TakeThisOut@googlemail.com> wrote:

> Rumor has it that Web.com is using RedHat servers with Microsoft proxy
> servers in front of them to make Microsoft think they are running
> their servers.
> Rumor also has it that MS paid them a couple a million dollars to
> advertise how wonderful their MS servers are but it appears that
> Web.com chose to run Redhat anyways with proxies and make it look like
> they made the change.
> See for yourself:
>
> bh-www1.sites.myregisteredsite.com --- Linux [IP Address :
> 209.237.150.13]
> bh-winproxy1a.sites.myregisteredsite.com --- Win proxy [IP
> Address : 209.237.150.13]
>
> I tried to confirm it using GFI Languard and it appears it's two
> different OS'es.

If it is RH then it will be running with mod-mono, unless they have
made some changes to make the cookies etc look like its .net.

ed@workstation:~$ telnet www.web.com 80
Trying 64.226.3.45...
Connected to www.web.com.
Escape character is '^]'.
HEAD / HTTP/1.1
Host:www.web.com

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Sun, 05 Aug 2007 19:57:14 GMT
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=1r2jpfafx41bma45oubaeyqq; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 22025

I'm not sure about the X-AspNet-Version header, that might be set by
mod-mono, I'm not sure.

Unless there's something like a phpinfo.php file on the server some
place I don't think you can really back this claim up.

--
The DS3 to Alderan is A.F.U. because of Bernard Shifman threatening to
sue. Han Solo is going bankrupt.
:: http://www.s5h.net/ :: http://www.s5h.net/gpg

You were checking the wrong server.

The servers are:
bh-www1.sites.myregisteredsite.com --- Linux [IP Address :
209.237.150.13]
bh-winproxy1a.sites.myregisteredsite.com --- Win proxy [IP
Address : 209.237.150.13]

Scan those two and see. I found this and more:

Scan target : bh-www1.sites.myregisteredsite.com [ 1 computers found ]
209.237.150.13 [ ] probably Unix
IP Address : 209.237.150.13
Resolved : sites.myregisteredsite.com
Operating System : probably Unix
Time to live : 255

TCP ports - 6 open ports
21 [ Ftp => File Transfer Protocol ]
220 Web Publishing FTP Service Ready

25 [ Smtp => Simple Mail Transfer Protocol ]

22 [ Ssh => Remote Login Protocol ]
SSH-1.99-OpenSSH_3.9p1

80 [ Http => World Wide Web, HTTP ]

110 [ Pop3 => Post Office Protocol 3 ]

443 [ HttpS => Secure HTTP ]

Why else would they be running that WinProxy in front of it?
###########################################################


> ed@workstation:~$ telnetwww.web.com80
> Trying 64.226.3.45...
> Connected towww.web.com.
> Escape character is '^]'.
> HEAD / HTTP/1.1
> Host:www.web.com
>
> HTTP/1.1 200 OK
> Server: Microsoft-IIS/5.0
> Date: Sun, 05 Aug 2007 19:57:14 GMT
> X-Powered-By: ASP.NET

>
> Unless there's something like a phpinfo.php file on the server some
> place I don't think you can really back this claim up.

On Sun, 05 Aug 2007 19:54:19 +0000, ed wrote:

> On Sun, 05 Aug 2007 09:35:42 -0700
> "John Bailo, Texeme.Construct" <jabailo.TakeThisOut@texeme.com> wrote:
>
>> On Aug 5, 9:31 am, Shibal Nom <truth1....TakeThisOut@googlemail.com> wrote:
>> > Rumor has it that Web.com is using RedHat servers with Microsoft
>> > proxy servers in front of them to make Microsoft think they are
>> > running their servers.
>>
>> MS is trying to take money from Cisco by pushing ISA.
>
> How do you draw that conclusion? Cisco are network hardware, not
> exactly proxy market leaders.
>
> ISA is just about the worst proxy server going, we used to have one
> setup back in the day before I was netadmin, it needed a reboot just
> about every week.
>

Cisco also makes webcaching systems as well as firewalling systems.

On Sun, 05 Aug 2007 22:25:56 -0000
Shibal Nom <truth1984 DeleteThis @googlemail.com> wrote:

> bh-www1.sites.myregisteredsite.com --- Linux [IP Address :
> 209.237.150.13]
> bh-winproxy1a.sites.myregisteredsite.com --- Win proxy [IP
> Address : 209.237.150.13]

You do notice these are the same IP address right?

How are you determining what is a Linux kernel and what is not? nmap
reports that it might be OpenBSD, which would negate your winproxy
idea, unless OpenBSD is operating the firewall and changing the OS
signatures - which from my experience it does not.

--
The OC48 to your house is screwed because of electromagnetic pulse.
Homer Simpson is having Robert Mann to write some scripts.
:: http://www.s5h.net/ :: http://www.s5h.net/gpg

I did in fact notice the IP's are the same. Hence my conclusion. Did
you notice the two different names of servers?

bh-WINproxy1a.sites.myregisteredsite.com --- winproxy as in windows
proxy.
bh-www1.sites.myregisteredsite.com -- this is the one that returns
info as being linux.

And yes.. of course they have the same IP. Thats what a proxy does.
Mask the real server....
And I may be mistaken but I am pretty sure that Windows should not be
running 'SSH-1.99-OpenSSH_3.9p1' as shown on the port scan.
But who really knows. Maybe a MS employee could have their hosting
division do a visual and report back to us.


22 [ Ssh => Remote Login Protocol ] SSH-1.99-OpenSSH_3.9p1

#####################################################################
>
> You do notice these are the same IP address right?
>
> How are you determining what is a Linux kernel and what is not? nmap
> reports that it might be OpenBSD, which would negate your winproxy
> idea, unless OpenBSD is operating the firewall and changing the OS
> signatures - which from my experience it does not.