DNS resolve wrong IP in one country
Clash Royale CLAN TAG#URR8PPP
up vote
2
down vote
favorite
One of my friend has an elearning website based on Claroline.
Two days ago, only Switzerland users started to get redirect "randomly" on another IP when accessing to the website domain.
If I force the DNS server to 8.8.8.8 or 9.9.9.9 on the students PC, the domain is resolve correctly. But if I stay with the local swiss DNS Server, it resolve to a bad (blacklisted) IP.
The strange part is: It's not only this one customer and his own computer. Every students based in Switzerland is affected as well. But not French one.
The second strange part is: Some page respond from this false IP with the correct content. Like the elearning was duplicate on another server OR cached somewhere.
The server is an old Ubuntu 10.04.4 LTS, probably not correctly protected / configured. I have full access on this server, but I didn't manage it, so I'm not sure what to look for or even what to do.
Here is what I looked / tried so far :
Checked all apache2 vhost conf
Checked iptables (empty) and /etc/hosts and /etc/resolv.conf (safe)
Ask Swisscom (main swiss telecom) if they blacklisted the domain or something : Nope
Check claroline code base : look safe but it's huge, I can't check all files.
Here is a nslookup on one of the student windows computer.
C:WINDOWSsystem32>nslookup
Serveur par défaut : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
> elearning.affis.ch
Serveur : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
Réponse ne faisant pas autorité :
Nom : elearning.affis.ch
Address: 195.186.210.161
And of course, 195.186.210.161 is not the correct IP of the server.
I'm not a sysadmin, I'm just helping a friend, so I'm not sure on what to look next.
domain-name-system
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |Â
up vote
2
down vote
favorite
One of my friend has an elearning website based on Claroline.
Two days ago, only Switzerland users started to get redirect "randomly" on another IP when accessing to the website domain.
If I force the DNS server to 8.8.8.8 or 9.9.9.9 on the students PC, the domain is resolve correctly. But if I stay with the local swiss DNS Server, it resolve to a bad (blacklisted) IP.
The strange part is: It's not only this one customer and his own computer. Every students based in Switzerland is affected as well. But not French one.
The second strange part is: Some page respond from this false IP with the correct content. Like the elearning was duplicate on another server OR cached somewhere.
The server is an old Ubuntu 10.04.4 LTS, probably not correctly protected / configured. I have full access on this server, but I didn't manage it, so I'm not sure what to look for or even what to do.
Here is what I looked / tried so far :
Checked all apache2 vhost conf
Checked iptables (empty) and /etc/hosts and /etc/resolv.conf (safe)
Ask Swisscom (main swiss telecom) if they blacklisted the domain or something : Nope
Check claroline code base : look safe but it's huge, I can't check all files.
Here is a nslookup on one of the student windows computer.
C:WINDOWSsystem32>nslookup
Serveur par défaut : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
> elearning.affis.ch
Serveur : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
Réponse ne faisant pas autorité :
Nom : elearning.affis.ch
Address: 195.186.210.161
And of course, 195.186.210.161 is not the correct IP of the server.
I'm not a sysadmin, I'm just helping a friend, so I'm not sure on what to look next.
domain-name-system
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Perhaps it's possible the ISP of those students are attempting to perform some smart caching and so are interfering with the DNS. Are they all at the same university for example? If you utilise HTTPS for your server, then they can still modify the DNS, but the end user would see a certificate error if the DNS result is pointing to a server other than your own as they would not be in possession of the private key.
– David Goate
1 hour ago
Also, are you sure the IP address of the server is static? For example if frequently changing or recently changed within the TTL of the DNS record then it's possible that the DNS is being resolved to an old (once valid IP) - although that wouldn't perfectly explain why they do see mirrored content. If you use a tool such as mxtoolbox.com/DNSLookup.aspx you might be able to see the TTL of the A record or CNAME record attached to the domain.
– David Goate
1 hour ago
@DavidGoate That's the fun part, students are at home, all over France and Switzerland. The French one doesn't have any problem.
– iizno
1 hour ago
@DavidGoate Server IP is fix and never changed. dnschecker.org/#A/elearning.affis.ch doesn't show any errors.
– iizno
1 hour ago
Hi, another thing that can happen, as I seen some error like that in the past, it can be a badly maintained DNS server by the ISP. I seen DNS zone that was transfered but never erased at the ISP level, thus leading to strange error.
– yagmoth555♦
1 hour ago
add a comment |Â
up vote
2
down vote
favorite
up vote
2
down vote
favorite
One of my friend has an elearning website based on Claroline.
Two days ago, only Switzerland users started to get redirect "randomly" on another IP when accessing to the website domain.
If I force the DNS server to 8.8.8.8 or 9.9.9.9 on the students PC, the domain is resolve correctly. But if I stay with the local swiss DNS Server, it resolve to a bad (blacklisted) IP.
The strange part is: It's not only this one customer and his own computer. Every students based in Switzerland is affected as well. But not French one.
The second strange part is: Some page respond from this false IP with the correct content. Like the elearning was duplicate on another server OR cached somewhere.
The server is an old Ubuntu 10.04.4 LTS, probably not correctly protected / configured. I have full access on this server, but I didn't manage it, so I'm not sure what to look for or even what to do.
Here is what I looked / tried so far :
Checked all apache2 vhost conf
Checked iptables (empty) and /etc/hosts and /etc/resolv.conf (safe)
Ask Swisscom (main swiss telecom) if they blacklisted the domain or something : Nope
Check claroline code base : look safe but it's huge, I can't check all files.
Here is a nslookup on one of the student windows computer.
C:WINDOWSsystem32>nslookup
Serveur par défaut : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
> elearning.affis.ch
Serveur : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
Réponse ne faisant pas autorité :
Nom : elearning.affis.ch
Address: 195.186.210.161
And of course, 195.186.210.161 is not the correct IP of the server.
I'm not a sysadmin, I'm just helping a friend, so I'm not sure on what to look next.
domain-name-system
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
One of my friend has an elearning website based on Claroline.
Two days ago, only Switzerland users started to get redirect "randomly" on another IP when accessing to the website domain.
If I force the DNS server to 8.8.8.8 or 9.9.9.9 on the students PC, the domain is resolve correctly. But if I stay with the local swiss DNS Server, it resolve to a bad (blacklisted) IP.
The strange part is: It's not only this one customer and his own computer. Every students based in Switzerland is affected as well. But not French one.
The second strange part is: Some page respond from this false IP with the correct content. Like the elearning was duplicate on another server OR cached somewhere.
The server is an old Ubuntu 10.04.4 LTS, probably not correctly protected / configured. I have full access on this server, but I didn't manage it, so I'm not sure what to look for or even what to do.
Here is what I looked / tried so far :
Checked all apache2 vhost conf
Checked iptables (empty) and /etc/hosts and /etc/resolv.conf (safe)
Ask Swisscom (main swiss telecom) if they blacklisted the domain or something : Nope
Check claroline code base : look safe but it's huge, I can't check all files.
Here is a nslookup on one of the student windows computer.
C:WINDOWSsystem32>nslookup
Serveur par défaut : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
> elearning.affis.ch
Serveur : UnKnown
Address: fe80::8e59:c3ff:fecf:8d9b
Réponse ne faisant pas autorité :
Nom : elearning.affis.ch
Address: 195.186.210.161
And of course, 195.186.210.161 is not the correct IP of the server.
I'm not a sysadmin, I'm just helping a friend, so I'm not sure on what to look next.
domain-name-system
domain-name-system
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 1 hour ago
MadHatter
68.3k11139203
68.3k11139203
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 2 hours ago
iizno
1112
1112
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
iizno is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Perhaps it's possible the ISP of those students are attempting to perform some smart caching and so are interfering with the DNS. Are they all at the same university for example? If you utilise HTTPS for your server, then they can still modify the DNS, but the end user would see a certificate error if the DNS result is pointing to a server other than your own as they would not be in possession of the private key.
– David Goate
1 hour ago
Also, are you sure the IP address of the server is static? For example if frequently changing or recently changed within the TTL of the DNS record then it's possible that the DNS is being resolved to an old (once valid IP) - although that wouldn't perfectly explain why they do see mirrored content. If you use a tool such as mxtoolbox.com/DNSLookup.aspx you might be able to see the TTL of the A record or CNAME record attached to the domain.
– David Goate
1 hour ago
@DavidGoate That's the fun part, students are at home, all over France and Switzerland. The French one doesn't have any problem.
– iizno
1 hour ago
@DavidGoate Server IP is fix and never changed. dnschecker.org/#A/elearning.affis.ch doesn't show any errors.
– iizno
1 hour ago
Hi, another thing that can happen, as I seen some error like that in the past, it can be a badly maintained DNS server by the ISP. I seen DNS zone that was transfered but never erased at the ISP level, thus leading to strange error.
– yagmoth555♦
1 hour ago
add a comment |Â
Perhaps it's possible the ISP of those students are attempting to perform some smart caching and so are interfering with the DNS. Are they all at the same university for example? If you utilise HTTPS for your server, then they can still modify the DNS, but the end user would see a certificate error if the DNS result is pointing to a server other than your own as they would not be in possession of the private key.
– David Goate
1 hour ago
Also, are you sure the IP address of the server is static? For example if frequently changing or recently changed within the TTL of the DNS record then it's possible that the DNS is being resolved to an old (once valid IP) - although that wouldn't perfectly explain why they do see mirrored content. If you use a tool such as mxtoolbox.com/DNSLookup.aspx you might be able to see the TTL of the A record or CNAME record attached to the domain.
– David Goate
1 hour ago
@DavidGoate That's the fun part, students are at home, all over France and Switzerland. The French one doesn't have any problem.
– iizno
1 hour ago
@DavidGoate Server IP is fix and never changed. dnschecker.org/#A/elearning.affis.ch doesn't show any errors.
– iizno
1 hour ago
Hi, another thing that can happen, as I seen some error like that in the past, it can be a badly maintained DNS server by the ISP. I seen DNS zone that was transfered but never erased at the ISP level, thus leading to strange error.
– yagmoth555♦
1 hour ago
Perhaps it's possible the ISP of those students are attempting to perform some smart caching and so are interfering with the DNS. Are they all at the same university for example? If you utilise HTTPS for your server, then they can still modify the DNS, but the end user would see a certificate error if the DNS result is pointing to a server other than your own as they would not be in possession of the private key.
– David Goate
1 hour ago
Perhaps it's possible the ISP of those students are attempting to perform some smart caching and so are interfering with the DNS. Are they all at the same university for example? If you utilise HTTPS for your server, then they can still modify the DNS, but the end user would see a certificate error if the DNS result is pointing to a server other than your own as they would not be in possession of the private key.
– David Goate
1 hour ago
Also, are you sure the IP address of the server is static? For example if frequently changing or recently changed within the TTL of the DNS record then it's possible that the DNS is being resolved to an old (once valid IP) - although that wouldn't perfectly explain why they do see mirrored content. If you use a tool such as mxtoolbox.com/DNSLookup.aspx you might be able to see the TTL of the A record or CNAME record attached to the domain.
– David Goate
1 hour ago
Also, are you sure the IP address of the server is static? For example if frequently changing or recently changed within the TTL of the DNS record then it's possible that the DNS is being resolved to an old (once valid IP) - although that wouldn't perfectly explain why they do see mirrored content. If you use a tool such as mxtoolbox.com/DNSLookup.aspx you might be able to see the TTL of the A record or CNAME record attached to the domain.
– David Goate
1 hour ago
@DavidGoate That's the fun part, students are at home, all over France and Switzerland. The French one doesn't have any problem.
– iizno
1 hour ago
@DavidGoate That's the fun part, students are at home, all over France and Switzerland. The French one doesn't have any problem.
– iizno
1 hour ago
@DavidGoate Server IP is fix and never changed. dnschecker.org/#A/elearning.affis.ch doesn't show any errors.
– iizno
1 hour ago
@DavidGoate Server IP is fix and never changed. dnschecker.org/#A/elearning.affis.ch doesn't show any errors.
– iizno
1 hour ago
Hi, another thing that can happen, as I seen some error like that in the past, it can be a badly maintained DNS server by the ISP. I seen DNS zone that was transfered but never erased at the ISP level, thus leading to strange error.
– yagmoth555♦
1 hour ago
Hi, another thing that can happen, as I seen some error like that in the past, it can be a badly maintained DNS server by the ISP. I seen DNS zone that was transfered but never erased at the ISP level, thus leading to strange error.
– yagmoth555♦
1 hour ago
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
3
down vote
If you point a browser at the IP address returned, http://195.186.210.161/, you get Swisscom's "dangerous website blocked" message. My guess is that their "safe internet" content-blocking system works, at least in part, by lying in response to DNS requests, and that your website is falling foul of them, for some reason.
I understand that you asked them if they were blocking you, but in my experience even medium-sized ISPs' front-line tech support don't have the slightest idea what's going on out back. It's quite possible that the whole nanny system is outsourced (or done by a third-party commercial product) and that nobody at Swisscom has any idea which sites are blocked at any given time. Asking your student if (s)he has any kind of "nanny internet" settings on is more likely to be productive.
At the end of the day, this is not a problem you can solve, since you're not that ISP's customer, and they owe you nothing. Having the student's parent call their ISP support, complain loudly about wrong DNS resolution, and threaten to change ISP if it's not resolved, is likely to be the only thing that has any effect.
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
2
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
If you point a browser at the IP address returned, http://195.186.210.161/, you get Swisscom's "dangerous website blocked" message. My guess is that their "safe internet" content-blocking system works, at least in part, by lying in response to DNS requests, and that your website is falling foul of them, for some reason.
I understand that you asked them if they were blocking you, but in my experience even medium-sized ISPs' front-line tech support don't have the slightest idea what's going on out back. It's quite possible that the whole nanny system is outsourced (or done by a third-party commercial product) and that nobody at Swisscom has any idea which sites are blocked at any given time. Asking your student if (s)he has any kind of "nanny internet" settings on is more likely to be productive.
At the end of the day, this is not a problem you can solve, since you're not that ISP's customer, and they owe you nothing. Having the student's parent call their ISP support, complain loudly about wrong DNS resolution, and threaten to change ISP if it's not resolved, is likely to be the only thing that has any effect.
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
2
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
add a comment |Â
up vote
3
down vote
If you point a browser at the IP address returned, http://195.186.210.161/, you get Swisscom's "dangerous website blocked" message. My guess is that their "safe internet" content-blocking system works, at least in part, by lying in response to DNS requests, and that your website is falling foul of them, for some reason.
I understand that you asked them if they were blocking you, but in my experience even medium-sized ISPs' front-line tech support don't have the slightest idea what's going on out back. It's quite possible that the whole nanny system is outsourced (or done by a third-party commercial product) and that nobody at Swisscom has any idea which sites are blocked at any given time. Asking your student if (s)he has any kind of "nanny internet" settings on is more likely to be productive.
At the end of the day, this is not a problem you can solve, since you're not that ISP's customer, and they owe you nothing. Having the student's parent call their ISP support, complain loudly about wrong DNS resolution, and threaten to change ISP if it's not resolved, is likely to be the only thing that has any effect.
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
2
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
add a comment |Â
up vote
3
down vote
up vote
3
down vote
If you point a browser at the IP address returned, http://195.186.210.161/, you get Swisscom's "dangerous website blocked" message. My guess is that their "safe internet" content-blocking system works, at least in part, by lying in response to DNS requests, and that your website is falling foul of them, for some reason.
I understand that you asked them if they were blocking you, but in my experience even medium-sized ISPs' front-line tech support don't have the slightest idea what's going on out back. It's quite possible that the whole nanny system is outsourced (or done by a third-party commercial product) and that nobody at Swisscom has any idea which sites are blocked at any given time. Asking your student if (s)he has any kind of "nanny internet" settings on is more likely to be productive.
At the end of the day, this is not a problem you can solve, since you're not that ISP's customer, and they owe you nothing. Having the student's parent call their ISP support, complain loudly about wrong DNS resolution, and threaten to change ISP if it's not resolved, is likely to be the only thing that has any effect.
If you point a browser at the IP address returned, http://195.186.210.161/, you get Swisscom's "dangerous website blocked" message. My guess is that their "safe internet" content-blocking system works, at least in part, by lying in response to DNS requests, and that your website is falling foul of them, for some reason.
I understand that you asked them if they were blocking you, but in my experience even medium-sized ISPs' front-line tech support don't have the slightest idea what's going on out back. It's quite possible that the whole nanny system is outsourced (or done by a third-party commercial product) and that nobody at Swisscom has any idea which sites are blocked at any given time. Asking your student if (s)he has any kind of "nanny internet" settings on is more likely to be productive.
At the end of the day, this is not a problem you can solve, since you're not that ISP's customer, and they owe you nothing. Having the student's parent call their ISP support, complain loudly about wrong DNS resolution, and threaten to change ISP if it's not resolved, is likely to be the only thing that has any effect.
edited 1 hour ago
answered 1 hour ago
MadHatter
68.3k11139203
68.3k11139203
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
2
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
add a comment |Â
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
2
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
That's why I think too but, why are some pages displaying the correct content and other just timed out. ? It's like they duplicate some pages.
– iizno
1 hour ago
2
2
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
We don't know what they're using, so we can't know how it works. Maybe the first-line decision is taken at DNS resolution time, but the system at 195.186.201.161 implements a second-line decision based on what URL is requested, proxying through to the real server if and only if it decide the content is "safe". Once people start trying to bend internet protocols in pursuit of some (unattainable) vision of a "safe" internet, nearly anything can go wrong.
– MadHatter
1 hour ago
add a comment |Â
iizno is a new contributor. Be nice, and check out our Code of Conduct.
iizno is a new contributor. Be nice, and check out our Code of Conduct.
iizno is a new contributor. Be nice, and check out our Code of Conduct.
iizno is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f935025%2fdns-resolve-wrong-ip-in-one-country%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Perhaps it's possible the ISP of those students are attempting to perform some smart caching and so are interfering with the DNS. Are they all at the same university for example? If you utilise HTTPS for your server, then they can still modify the DNS, but the end user would see a certificate error if the DNS result is pointing to a server other than your own as they would not be in possession of the private key.
– David Goate
1 hour ago
Also, are you sure the IP address of the server is static? For example if frequently changing or recently changed within the TTL of the DNS record then it's possible that the DNS is being resolved to an old (once valid IP) - although that wouldn't perfectly explain why they do see mirrored content. If you use a tool such as mxtoolbox.com/DNSLookup.aspx you might be able to see the TTL of the A record or CNAME record attached to the domain.
– David Goate
1 hour ago
@DavidGoate That's the fun part, students are at home, all over France and Switzerland. The French one doesn't have any problem.
– iizno
1 hour ago
@DavidGoate Server IP is fix and never changed. dnschecker.org/#A/elearning.affis.ch doesn't show any errors.
– iizno
1 hour ago
Hi, another thing that can happen, as I seen some error like that in the past, it can be a badly maintained DNS server by the ISP. I seen DNS zone that was transfered but never erased at the ISP level, thus leading to strange error.
– yagmoth555♦
1 hour ago