Doing some further research into this issue. The "working" IP mentioned above, 185.246.188.177, is owned by FlokiNET, the hosting provider mentioned by Kestrel in the most recent DDoS post.
Code: Select all
inetnum: 185.246.188.0 - 185.246.188.255
netname: FlokiNET-Netherlands
country: NL
admin-c: KW2939-RIPE
tech-c: KW2939-RIPE
status: ASSIGNED PA
mnt-by: lir-is-flokinetehf-1-MNT
created: 2022-01-12T15:07:57Z
last-modified: 2024-03-22T14:01:59Z
source: RIPE
The "broken" IPs, e.g. 92.114.107.59 (really anything from the subnet 92.114.107.0/25), are owned by a different hosting provider:
Code: Select all
inetnum: 92.114.107.0 - 92.114.107.127
org-name: RoyaleHosting BV
country: NL
reg-nr: 82651329
org-type: OTHER
address: Galileïstraat 6
address: 7701 SK Dedemsvaart
address: The Netherlands
abuse-c: RBAC10-RIPE
mnt-ref: RoyaleHosting
mnt-ref: PREFIXBROKER-MNT
mnt-by: PREFIXBROKER-MNT
mnt-by: RoyaleHosting
I experimented with configuring my resolvd service to use FlokiNET's nameservers to resolve play.octowow.st (and only that FQDN), and at first, it seemed like it would work:
Code: Select all
>>] dig play.octowow.st
; <<>> DiG 9.18.50 <<>> play.octowow.st
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52760
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;play.octowow.st. IN A
;; ANSWER SECTION:
play.octowow.st. 295 IN A 185.11.145.5
;; Query time: 1 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed Oct 07 10:50:55 CDT 2026
;; MSG SIZE rcvd: 60
Unfortunately, when I tried to use the new IP for play.octowow.st (185.11.145.5), it did the following when trying to connect to the server:
- Connected
- Authenticated
- Hung on authentication
- Disconnected me
Admittedly, this was different from the 92.114 IP (which simply hung and timed out), but what I tried doesn't seem to be a solution. I was able to confirm that the authentication/realm list port for was listening for TCP connections on 185.11.145.5, but it would seem that whatever is listening at the IP refuses to authenticate my account. Or, it is simply an abandoned clone of the login server.
Currently the only real "solution" is to set my realmlist.wtf file to have the following in it:
And you cannot use the launcher to run WoW; the first thing it does is clobber reamlist.wtf to point to play.octowow.st. You have to edit realmlist.wtf and launch WoW.exe directly. You can use the launcher to update when necessary, but after updating, you'll have to go back and edit the realmlist.wtf file again.
This is a terrible solution. It is, at best, a temporary band-aid. There is no guarantee that the "working" IP will be valid in a an hour, much less permanently. I hope someone will pay attention to this thread and address it.
