The Phantom Flusher stats thread.

[ViRGE]

Well, that settles it, it's either Crimson, or a trojan, and hopefully, it isn't the latter.

 

[DJ_D]

I was checking my stats today and I saw that Boberfett's stats have gone off the chart the last three days and he is out of town. I guess that must be the work of the phantom flusher. I hope this isn't an attempt to dilute Team Anandtech's good blocks with bad ones. :|

Hmm, I was just thinking, if the blocks are trojans, it would be difficult to change the e-mail address. These blocks do seem to have wandered from person to person. Or at least more and more people are getting mystery blocks. If this is benevolant help, then three cheers for the phantom flusher!

 

[Jmman]

All I know is that if the PF is feeling generous, I will take a few blocks off his hands....My home network barely does 1000+ blocks a day.....

 

[bfour]

I noticed this morning, but did not have time to post, we gained an approximate 700 blocks, and we have not assimilated anything over the last 5 days....... It's nice, but is also suspicious!

 

[BoberFett]

Whew, I leave town for a few days and all hell breaks loose. If I could assimilate like this when I'm on vacation then I guess I'll just have to head back to the beach!

Does there seem to be any rhyme or reason to the members that are getting the extra blocks?

 

[ViRGE]

Not really Bobber, Ray and I are both Elites, but thats the only connection between any 2 of us.

 

[BoberFett]

There you go rubbing that elitism in our faces again. j/k

After the stats came back up tonight I put together a chart of my stats comparing Mika's to D.net back to June 1. While I like big numbers as much as any of you, not knowing where they come from is a little disturbing.

D.net___Mika
-------------------
26,239__5643 blocks
20,780__6725 blocks
19,074__5634 blocks
18,587__7435 blocks
7,880___5114 blocks
7,383___5597 blocks
7,025___5644 blocks
8,911___6908 blocks
6,369___5038 blocks
7,025___5501 blocks
6,599___5255 blocks
7,427___5723 blocks
7,093___4505 blocks
7,121___6148 blocks
7,469___6698 blocks
5,980___5507 blocks
5,780___5566 blocks
6,741___6160 blocks
5,591___5591 blocks
-------------------
189,075_113158 blocks

75,916 difference

I could explain possibly a few thousand of those as machines that don't flush through my proxy. Any word from D.net yet on possible sources?

 

[Dutchman2000]

Or plotted: http://home.student.utwente.nl/e.degraaf/trojan.gif

ps: For all newbee's: you will not get infected by a trojan by a .gif image named trojan
pps: I finally found a signature for myself, thnx Russ

[DPC]Dutchman
"..a Dutch-type entity that pops in this thread.. "

 

[JHutch]

While this is still making me a nervous wreck, I'm gonna miss those extra blocks if it ever stops ... I'm getting spoiled rotten here!

JHutch

 

[RaySun2Be]

I know what you mean, JHutch! I'm starting to get used to running with the *big* herds....watching myself move up the stats quick.....

But on the other hand, I've hit the 750K mark that KingHam and I were racing to, and there is no fun in it. No joy. It means nothing, as it's not my herd that got me here so quick, and there was no competition in it.

*Sigh* I liked things the way they were....

 

[JonB]

It is starting to spook me. I came to work this morning to check the status of my old herd. I had shut it down pretty solidly (I thought) but was afraid it may have re-awakened. If so, I would probably not survive the firestorm. But, that isn't it. My old herd is still lying there, dead and bloated in the pasture.

My daily numbers are getting larger and I'm getting more concerned. If they would go through Mika, we could track them.

 

[BoberFett]

I'm with you Ray. There's not much satisfaction in watching your numbers go through the roof if they're not really your blocks.

 

[Russ]

Dutchman2000,

Glad I could help.

Looking at yesterdays totals, I'd have to say that it probably isn't the DPC's unless they've been doing some major sandbagging. They were over 1.1 million blocks, and you guys received even more mystery blocks.

I hope the Phantom Flusher is a REAL person (or persons) and not a Trojan. Kicking the Macs out of second place wouldn't be nearly as satisfying if it turns out that we got there sooner because of nefarious activity.

OTOH, if it is a person (or persons) that simply wishes to remain anonymous, than I'd like to say WELCOME TO THE TEAM!

Russ, NCNE

 

[Dutchman2000]

Well the 'latest news' is that a DPC member who frequents this board to is recieving a huge amount of unexplained blocks like you guys
are. It seams the TA new-member theory is not very likely...

 

[ViRGE]

Ugg, that's just great. I'll talk with the gang, and see what we'll do next.

 

[BoberFett]

ViRGE

You seem to have a relationship with Moose and the gang, would it be possible to get a log from one of the last few days? It would be easy enough to look for blocks that are coming from an address other than Mika's proxy and trace the IP.

 

[Viztech]

The Dutchman must be talking about Chakotay.
http://stats.distributed.net/rc5-64/phistory.php3?id=269388
Welcome to the mystery club.

viz

 

[JHutch]

Here is the last reply Ray got from dBaker:

I just took a look at your stats for yesterday, and they seem to have
leveled off at ~23k blocks per day. Because they leveled off, I rather
doubt that they're being generated by a trojan. The participants who
used those experienced very rapid growth up to ~700k blocks per day.

If you want me to investiget further, I can grep logs to see what IPs
your blocks are comming from, but at this point I'm not worried about
your rate.

Moo!
dB!

**************

Now, since we are getting more and more "victims," it might be a good idea to reopen this with DNet, because the trojan may be using some sort of rotation in the e-mail field to keep the rapid climb curve better hidden. Ray, VIrge, what do you guys think?

JHutch

 

[BoberFett]

I definitely think it needs to be looked into. Again, this seems a simple matter of checking the IPs of blocks for any affected members and comparing them to the IP addresses they should be coming from.

For instance, blocks from me should only come from Mika's or from one C block of IP addresses that I alone have control over, or a couple of other IPs which would only produce a couple hundred blocks per day each. It's a fairly limited number and I'd be able to determine pretty quickly where the rogue blocks are coming from.

 

[ViRGE]

Dnet definately needs to look into this, no ifs ands or buts.

 

[Possessed Freak]

Now Now, stop referring to me as the flusher... PF != Phantom Flusher. If I had that kind of computing power ATRC5 would be screaming past red^^^ (again) and those pitiful disgusting Borg!

 

[RaySun2Be]

Update

Now that I'm home, I've sent a request to D.NET to go ahead and look into it. I've given them mine and Viztechs IP information. I will post any/all results.
Ray

 

[eNeRGy]

I just want to let you know I am a frequent visitor of this forum... am I qualified to get phantom blocks now too ???

Greetinx [eNeRGy]

 

[Russ]

Possessed Freak,

Despite your animosity, TA Cube still loves you.

Russ, NCNE

 

[Decibel]

JHutch: Just to let you know, there is more than one 'db' in distributed.net. db is dbaker, dB! is Decibel!

Sorry, I should have been more clear.

As far as the mystery blocks go, they are definitely not from trojans, at least no trojans that we've ever seen before. The trojans that we have seen ramp very quickly up to hundreds of thousands of blocks per day.

I can also tell you that we are definitely not trying to 'spread nugget's trojaned blocks around'.

Moose and I will look into this some more, but we do not feel there is any cause for concern at this point.

Moo!
dB!