Archive for September, 2008

27
Sep

CS-1 Back in Production

By hinkydink 0 Comments
Categories: Uncategorized

CS-1 rose from the dead on Wednesday.

I didn’t notice until just moments ago. For the past week I’ve been putting most of my efforts in refining the Google Hack using CoDeeN proxies.

Turns out, they’re wise to Google harvesting.

You can only get ~500-1000 search results from any one CoDeeN server. That was hardly enough for my traditional method, which basicly just searched for port numbers.

CoDeeN’s restrictions taught me to maximize my results by subtracting certain search terms, like “-guestbook” and “-mp3″ and even “-SOCKS”. You can get completely different results with the same ports and different “minus” terms.

I don’t know why that never occured to me before, but it has been an excellent learning opportunity.

While I was learning all these wonderful things, Google lifted my ban, so I applied all this new found logic to the original hack.

The result? Thousands of new (DEAD) proxies and a smattering of active ones.

So the list goes on. I have backed off on the purge to keep the numbers up, but there is still a high percentage of good proxies in there.

22
Sep

PWN3D BY GOOGLE

By hinkydink 0 Comments
Categories: Uncategorized

As if things weren’t bad enough with all my big sources going dark, Google has finally got my number on the Google Hack.

For three months now I’ve been doing Google searches like…

:80 :8080 :3128

… getting a thousand pages, and hitting them all.

Three months!

Now, and I kid you not, boys and girls, I can’t even do a search on anything  without getting the “We’re Sorry” page.

Clear the cookies and… same thing.

They’ve definitely got my number!

And I’ve only had this IP address for less than a week (my old one, which I had for months, was knocked out by hurricane Ike last week).

I could change the IP any time, but it’s a hassle.  Lots of DNS changes have to be made every time the IP changes and I’m not a fast flux site by any means – I’m one of the GOOD GUYS!  So that’s out, but I still have sleeves, the requisite tricks, and 350+ CoDeeN proxies in the database.  Plus we all know Google is not the only search engine on the Internets.  Hear that Schmidt?

The Dink is down, but not out.

21
Sep

Hard Times in Proxyland

By hinkydink 0 Comments
Categories: Uncategorized

Three or four days ago I noticed “Curious Site” dried up.  I didn’t do much about it because, well, I bought a new laptop and I’ve been fucking around with it.

As it turns out, on September 8th, someone spilled the beans in a thread at anitchat.ru, a Russian message board with a relatively worthless proxy forum.  Now, there’s no more proxies to be had.  The link at CS-1 is still there, but there’s nothing in it.

That kills all three of my megasources.  Soon the list is going to degenrate to a few hundred proxies (mostly CoDeeN).  So it looks like I’m back to Google Hacking and List Raiding.  Since the Google Hack was the source of these sites, I’m going to refine my method.  I’m already getting some “interesting” hits.  Check out the domain name on this Russian site out (click for a larger view):

Obviously a “fast flux” site.

16
Sep

Down, but not Out

By hinkydink 1 Comment
Categories: Uncategorized

Sunday the 14th, remnants of hurricane Ike rolled through my state and knocked out power to over 3,000,000 people, including yours truly.

This is why the page has been static since then.   When the power comes back up the updates will begin again.  There is no word when that will be.  The local power company says it may take up to seven days.

08
Sep

Junkbusting

By hinkydink 0 Comments
Categories: Uncategorized

I have finally starting clearing the junk out.  For example, since the beginning there have been about 20-30 Japanese entries in the list that were garbage.  They’re finally gone.

I also learned a lesson about wget that didn’t directly affect the list.  Under certain circumstances, if you get, say, a “403 Access Denied” response, wget will not store the page you would normally see in your browser.  This only affected the “Timeout” servers, but there is more junk to be found if there is a 302 or 304 redirect.

I exported all the non-CoDeeN proxies and used SwitchProxy, a FireFox plug-in, to check the junk factor.  There’s still a fair amount in there, but the next purge should take care of most of it.

It seems that Interesting Sites 1 and 2 are gone for good.  No more 75,000+ proxy imports.  I’m glad I got those when I could.  Curious Site is still supplying proxies, and of course I still hit the other lists every night (but they have nothing).  I’m running the Google Hack on and off but not getting much live data.  I’m going to keep hitting it because that’s where the Interesting Sites came from in the first place.  Somewhere, there’s an IS-3 out there.

 

01
Sep

New Code in Production

By hinkydink 0 Comments
Categories: Uncategorized

I had a few hiccups at first.  The page size was 40 instead of 75, which made for a 32 page list.  I changed that and noticed that version of the page code was still set up for 30 second timeouts so I got some negative speed ratings.

In between I noticed I was doing the proxy count for every page, not just the first page (it takes a while for 1,000,000+ proxies), but by the third time it was back to normal.  Now it’s running swimmingly.

In this version, the live proxies found during the discovery cycle are moved into the gold database with a “Type” of “PENDING” as soon as they are found.  Between page runs, when “Type” is changed to “Transparent”, “Anonymous”, etc., you (well, I – not you) can run a query on the gold database to see what’s coming up for the next page run.

Very nice.

In the middle of hacking away at this code yesterday, both IS-1 and IS-2 went dark.  IS-2 and its companion, “Curious Site 1″ (CS-1), went SERVFAIL dark.  That is, its host name was simply gone from DNS.

Gone.

IS-2 and CS-1 finally came back online in the evening, much to my relief.  IS-2 had moved to Frankfurt.  I’m not sure what happened with CS-1, but it came up as well.  That’s compelling evidence that they’re in cahoots.

IS-1 simply changed.  Previously, there was no default page in the root, but they allowed folder browsing (a stupid thing, but that’s how I found them in the first place).  My code was using that “feature” to get the timestamp on the proxy file.  Consequently, it didn’t run right.  I only noticed when I checked the page out in a browser (they’re into some shady “PayDay Loan” scam now).  But a new file was there in the same place and it had over 75,000 proxies in it.

If they ever change the file name, I’m screwed.

Now, if you’ve been following the Atrivo/EstHost shitstorm that has been going down in the last week, none of this is a real surprise.  I’m certain a lot of shady Web sites were motivated to get out of Dodge but it surprises me that IS-2 moved to Germany, where they have some pretty serious anti-hacking laws.  With that in mind, they may be moving again any day now.

There is no doubt in my mind that all three of these sites are up to no good.  However, I don’t work for an LEA (Law Enforcement Agency).  I’m only in it for the research.