Peerblock and Uk Government

Mistaken

I have peerblock running on my computer and noticed the following...

2015-12-12 09:54:43;UK Government Department for Work and Pensions;192.168.0.3:35327;51.36.110.255:2642;UDP;Blocked
2015-12-12 09:54:43;UK Government Department for Work and Pensions;192.168.0.3:35327;51.36.110.255:2642;UDP;Blocked
2015-12-12 09:54:43;UK Government Department for Work and Pensions;192.168.0.3:35327;51.36.110.255:2642;UDP;Blocked

How is this possible and what does it mean?

Is it really the Uk government spying in some way or another computer pretending to be them?

cookie365

I'd suspect the real DWP would use the phrase HM Government, not UK Government.

Big_Graeme

What it means is someone at the DWP is trying to connect to you, more than likely someone has a torrent client running on their PC

securityguy

I was told last week that UK government are selling parts of 51/8 (it's only ended up in DWP as a convenience, it was originally the DHSS's when that ran the NHS) to deal with the shortage that UK ISPs have. It's possible that's start already, and that there are ISPs issuing out of bits of 51/8.

Mistaken

Big Graeme you may be right

S0litaire

hmmm ISP called "UK Government Department for Work and Pension"
Created a few months ago.

http://www.traceip.net/whois/51.36.110.255

Owned by a Saudi national...

Nope nothing dodgy to me!

pogofish

Is this the modern equivalent of that old jape of changing your (or some unsespecting pal's) SSID to something along the lines of -

Police mobile drugs surveilance unit E11192

And watching which neighbours go a bit paranoid?

Strider590

Peerblock will block most govt related IP addresses, it also blocks most educational institutions and even some ISP owned email servers. At one point the authorities were paying universities to track and log people across the whole of the UK who were using torrenting software. In the same way they pay them to carry out "impartial" scientific studies.

onomatopoeia99

S0litaire wrote: »

hmmm ISP called "UK Government Department for Work and Pension"
Created a few months ago.

http://www.traceip.net/whois/51.36.110.255

Owned by a Saudi national...

Nope nothing dodgy to me!

That /16 is allocted by RIPE, the RIR, to Zain, a Kuwait mobile data company with a Saudi subsidiary and it is acting as a LIR. It's the normal way this stuff works.

My whois client says:

root@dangermouse:~# whois -h whois.ripe.net 51.36.110.255

% Information related to '51.36.0.0 - 51.36.255.255'

% Abuse contact for '51.36.0.0 - 51.36.255.255' is 'Abuse-notification@sa.zain.com'

inetnum: 51.36.0.0 - 51.36.255.255
org: ORG-MK8-RIPE
mnt-routes: MTCKSA-MNT
netname: SA-MTC
descr: MTC KSA
country: SA
admin-c: MIE43766-RIPE
tech-c: MIE43766-RIPE
status: LEGACY
mnt-by: MTCKSA-MNT
created: 2015-09-23T09:59:26Z
last-modified: 2015-10-14T09:51:36Z
source: RIPE # Filtered

(and quite a bit more in the same vein)

Organisations that got large allocations early on in the existence of TCP/IP have been asked to hand back what they aren't using to the relevant RIR due to IPv4 address exhaustion. RIPE allows allocations to be traded, so the DHSS (51.0.0.0/8 was allocated when it was still called that) could either be selling it off or have just handed it back.

jshm2

It doesn't actually mean much.

The IP address that has been blocked by peerblock had that detail attached to it. Blocklists tend not to get updated too often and it could be the connection was benign but for the fact it's on a known government/institution IP.

As for the traceroute. A lot of overflow network traffic gets diverted to KSA and Kuwait for various reasons. The government would be no exception as KSA and Kuwait are allies after all - regardless of what Daily Mail imbeciles think of them.