Did Techcrunch get Hacked?

#1

Post by livestyle » Wed, Jan 18, 2012, 2:57 PM UTC

I was doing a search for Reddit's open source version and stumbled upon this article http://techcrunch.com/2008/06/18/introducing-technews-our-own-reddit-clone/ and when I followed the link this Asset Management group website popped up?

Did Techcrunch get Hacked?
technews.techcrunch.com

Re: Did Techcrunch get Hacked?

#2

Post by dazbradbury » Wed, Jan 18, 2012, 3:19 PM UTC

It's available as normal on the main site so I suspect not:

http://techcrunch.com/

This subdomain also has the same content:

http://primaries.techcrunch.com/

http://technews.techcrunch.com/

I'm pretty sure both of these subdomains aren't ever used though.

Re: Did Techcrunch get Hacked?

#3

Post by bretr » Wed, Jan 18, 2012, 3:22 PM UTC

it appears to have been around for 4+ years

http://wayback.archive.org/web/20070915000000*/http://primar...

Re: Did Techcrunch get Hacked?

#4

Post by citricsquid » Wed, Jan 18, 2012, 3:25 PM UTC

bretr wrote: post #3

it appears to have been around for 4+ years http://wayback.archive.org/web/20070915000000*/http://primar...

So the assumption I'm making here is that they set this (sub)domain up and had the IP as their old servers, the servers have changed hands (since they moved to Wordpress vs. self hosted) and the new owner has a wildcard host entry set up.

Re: Did Techcrunch get Hacked?

#5

Post by amirmc » Wed, Jan 18, 2012, 3:25 PM UTC

dazbradbury wrote: post #2

It's available as normal on the main site so I suspect not: http://techcrunch.com/ This subdomain also has the same content: http://primaries.techcrunch.com/ http://technews.techcrunch.com/ I'm pretty sure both of these subdomains aren't ever used though.

And that second URL is the first hit if you google for the company name.

http://www.google.co.uk/search?q=black+oak+asset+management

Re: Did Techcrunch get Hacked?

#6

Post by hkolk » Wed, Jan 18, 2012, 3:25 PM UTC

Probably caused by pointing to an old IP in their DNS, which is now reused for a different site. And because that server doesnt know about that domain, it shows the default vserver: http://70.32.92.201/

Still bad though, since they now have access to the cookies/local-storage of techcrunch.com itself.

Re: Did Techcrunch get Hacked?

#7

Post by entropyneur » Wed, Jan 18, 2012, 3:26 PM UTC

Are they still using these domains? Looks like they just stopped using them but didn't update the DNS records and now someone else has that IP address.

Re: Did Techcrunch get Hacked?

#8

Post by mmmooo » Wed, Jan 18, 2012, 3:27 PM UTC

Looks like just a new owner of 70.32.92.201 where they still have some old dns records pointed..and what you see is the default vhost on new owner's site, blackoakam.com. Nothing to see here.

Re: Did Techcrunch get Hacked?

#9

Post by terrellm » Wed, Jan 18, 2012, 3:28 PM UTC

The two subdomains (technews and primaries) both have the same IP of 70.32.92.201, a MediaTemple IP. TechCrunch used to host at Media Temple according to DomainTools Hosting History. There is probably an A record in the DNS pointing those subdomains to those specific IPs.

The IPs have just been recycled and are being used by MediaTemple hosting customer.

Re: Did Techcrunch get Hacked?

#10

Post by oelmekki » Wed, Jan 18, 2012, 3:43 PM UTC

Quite perturbing fact is that only those two techcrunch related domains seems to be pointing on that host : http://www.bing.com/search?q=ip%3A70.32.92.201&go=&q...