duc.avid.com is routing to a urljet placeholder

[Top Jimmy]

Since yesterday, duc.avid.com is routing to a urljet migration placeholder here. I thought the duc was down until I actually googled and clicked directly into one of the forums.

Page looks like this: http://dl.dropbox.com/u/2505899/duc.jpg

And merry Christmas everyone!

[M-ManLA]

Seems fine on my end. Are you still having this problem?

[necjamc]

Sounds like that was a cached copy. Last night during maintenance that's what it was going to. It came back today.

[Top Jimmy]

Originally Posted by necjamc

Sounds like that was a cached copy.

DOH! Trashed cache and all is fine.

[Craig F]

I've been having log-on problems scene the update/migration

[aka21stCentury]

Anyone get an email from DUC admins regarding a hacker's attempt to login from the IP address: 64.57.214.221 (on the 24th) 7:31 AM PST????

I traced it back as far as Kansas City (Greensoft) where it bounced back to an adult video webhosting service in California.

[Noiselab]

It appears as though the duc is actually a SAAS solution hosted by GSI Hosting NET-GREENSOFT. I thought most of Avid's web presence was hosted through a big provider that's HQ'd in St Louis, but the duc is obviously a different animal.

Traceroute to "duc.avid.com" translated to the IP address 206.55.124.187. Using this IP address in a Whois search via arin.net yielded "GSI Hosting NET-GREENSOFT" with a good sized IP block allocated to the ARIN registry entry.

NL

[aka21stCentury]

Actually the log showed a hop in St. Louis. I'm having Flash Player problems, I mean what sensible DAWg uses a precious MacIntel for online use when it can run plugins?

Darn Debug version Flash player worked better but Safari 5 update killed all my Flash. Deinstalled and reinstalled last known version, so I can no longer see that gnarly sounding Christmas tree snap, crackle and pop over at NI.

NI's website is not possible without flash. I get it, the Tim Burton thing, but still can't there be an alternate xml or shtml version?

Anyway, BBS sites are commonly hacked so the 'cached' page then contains an embedded javascript which attempts to run a java applet, which looked to me as if it was seeking out autofill personal data. ClamXav caught that signed hack:

Who's got control of 64.57.214.221 at WBS LLC connect in Calabasas California?

SAFARI at least in privacy mode does not cache to hard disk, if going to a poorly maintained BBS.

SAFARI 5.03 in Leopard (PPC) killed my Flash. Click to Flash doesn't work either. Arrrg!

I have the DUC at 92.242.144.10 GSI hosting

64.57.214.221 <---------------- (hacker's IP according to DUC Admin). WBS LLC connect.

[necjamc]

I had this problem the day after the maintenance and emailed Duc support. Now they never responded but funny thing that after this my email notifications started working, and they never did from day 1. I changed my password and after a few failed attempts I was a LE to log on and it's been fine since. I thought it was because of tapatalk being open on my phone but turns out it was something entirely different.

[Delta Music Belgium]

Originally Posted by aka21stCentury

Anyone get an email from DUC admins regarding a hacker's attempt to login from the IP address: 64.57.214.221 (on the 24th) 7:31 AM PST????

I traced it back as far as Kansas City (Greensoft) where it bounced back to an adult video webhosting service in California.

Yes, I did get this mail:

Dear Delta Music Belgium,

Someone has tried to log into your account on Avid Audio Forums with an incorrect password at least 5 times. This person has been prevented from attempting to login to your account for the next 15 minutes.

The person trying to log into your account had the following IP address: 64.57.214.221

All the best,
Avid Audio Forums

On december 24, 2011 I wanted to log in to my account and did get an onscreen message that I used 5 attempts to log in and needed to wait for 15 minutes. Then I tried to reset my password and got 2 mails, one mail with the link to reset the password and one mail with the new password.

I waited for 15 minutes and tried the new password, but it did not work. Then I received the mail quoted above with the IP address. I did check the IP address to see if it was my IP address, but it was not. I was also able to trace it back to Kansas City.

So I waited for 15 minutes more, tried again to reset the password and got 2 new mails, again one mail with the link to reset the password and one with another new password.

Then I was able to log in and change the new password to my own password.

Everything seems to be fine since then...