Wednesday, July 2, 2025

IPv6 or no IPv6 ... inferring an IPv6 address of a IPv4-only newsserver

Very hacky, but nice:


The newsserver eu.usenetprime.com has no IPv6 address:


$ host eu.usenetprime.com

eu.usenetprime.com is an alias for usenetprime-eu.tlsusenet.com.

usenetprime-eu.tlsusenet.com has address 185.151.15.173


Pity. But with some analysis of others newsservers, I could infer the IPv6 address, and bingo:


$ telnet -6 2a07:8085:119:fe::173 nntp

Trying 2a07:8085:119:fe::173...

Connected to 2a07:8085:119:fe::173.

Escape character is '^]'.

200 Welcome to UsenetPrime

quit

205 Goodbye

Connection closed by foreign host.



These newsservers are hosted by a wholesaler, and there is logic between IPv4 and IPv6 address:


185.151.15.X --- 2a07:8085:119:fe::X

with X written the same. Which means on the left decimal, and hexadecimal on the right. Just ignore that.



See below how I did it.


Ugly logging of "host <newsserver>" commands:


eu.newsdemon.com.txt-eu.newsdemon.com is an alias for nd-eu.tlsusenet.com.

eu.newsdemon.com.txt:nd-eu.tlsusenet.com has address 185.151.15.176

eu.newsdemon.com.txt:nd-eu.tlsusenet.com has address 185.151.15.186

eu.newsdemon.com.txt-nd-eu.tlsusenet.com has IPv6 address 2a07:8085:119:fe::176

eu.newsdemon.com.txt-nd-eu.tlsusenet.com has IPv6 address 2a07:8085:119:fe::186




eu-tst.newsgroupdirect.com.txt:eu-tst.newsgroupdirect.com has address 185.151.15.171

eu-tst.newsgroupdirect.com.txt:eu-tst.newsgroupdirect.com has address 185.151.15.181

eu-tst.newsgroupdirect.com.txt-eu-tst.newsgroupdirect.com has IPv6 address 2a07:8085:119:fe::181



news-eu.usenetexpress.com.txt:news-eu.usenetexpress.com has address 185.151.15.180

news-eu.usenetexpress.com.txt:news-eu.usenetexpress.com has address 185.151.15.170

news-eu.usenetexpress.com.txt-news-eu.usenetexpress.com has IPv6 address 2a07:8085:119:fe::180

news-eu.usenetexpress.com.txt-news-eu.usenetexpress.com has IPv6 address 2a07:8085:119:fe::170



Manual check that telnet works:



$ telnet -6 2a07:8085:119:fe::180 nntp

Trying 2a07:8085:119:fe::180...

Connected to 2a07:8085:119:fe::180.

Escape character is '^]'.

200 Welcome to UsenetExpress (fe02)

quit

205 Goodbye

Connection closed by foreign host.


Good.


Now the IPv4-only newsserver of which we want to infer the IPv6 address:



$ host eu.usenetprime.com

eu.usenetprime.com is an alias for usenetprime-eu.tlsusenet.com.

usenetprime-eu.tlsusenet.com has address 185.151.15.173



... ending in "117", so let's try 2a07:8085:119:fe::173


$ telnet -6 2a07:8085:119:fe::173 nntp

Trying 2a07:8085:119:fe::173...

Connected to 2a07:8085:119:fe::173.

Escape character is '^]'.

200 Welcome to UsenetPrime

quit

205 Goodbye

Connection closed by foreign host.



Bingo!




No comments: