Archive for May, 2009

31
May

China PWN3D

That took care of the China issue quite nicely.  They are scheduled to be rechecked at 3AM every night.  The 6AM run will reflect that every morning and they’ll be rechecked throughout the day.

The ones remaining should be the most stable but there are never any guarantees in this business.

31
May

Chinese Junkbuster

The List was up to 850 proxies this morning, many Chinese, so I ran the China Recheck.  By the next page publish, about a hundred of them dropped out.

Since it’s my goal to have active proxies – a very rare commodity – rather than dead ones  in the list, I’m going to run the recheck/purge after the page is published (every other hour).  This isn’t really going to help because it means that dead Chinese proxies will be in the list anyway.  The way I move things around in the database, I can’t really do a recheck unless the address has already been published.  They shouldn’t be there for more than a couple of hours, when, if things keep going the way they have been, a new set of dead Chinese proxies will take their place.

Hopefully this problem will eventually work itself out.

As an experiment, I ran the Resurrection Hack on the dead Chinese proxies to see exactly how dead they are.   The vast majority time out.  The rest are closed.  A small handful came back from the dead.

Using the SwitchProxy Tool for Firefox, I pulled one of the resurrected proxies, 58.17.3.2:80, and I’m putting it through its paces.  The speed is reasonable, but the first time I tried a Google search through it I got the “looks like you have a virus” page.  You know what that means.

I’m not sure how representative 58.17.3.2 is of the rest of the Chinese bunch.  I first encountered that address back in February (on four different ports – it may also be a SOCKS proxy).  It appears to be a business, registered to “Nanchang Jianmin Nuitrition Products Factory” (proud makers of melamine, I’m sure), does not reverse-resolve, and the IP itself can be found on no less than “ about 9,270″ Web sites, according to Google (very good results there – that particular search is going into the Google Hack).

Obviously, a well-known, heavily abused proxy (due to the Google warning and a permanent IP ban at 4chan.org, which is always an excellent abuse acid test).

I think a combination of agressive purging and selective resurrection of the Chinese Junk will result in having only the most available proxies show up in the list.

We’ll see what happens with that theory.

30
May

Best Week EVAH

I looked over the logs and noticed we’ve finally surpassed Junuary’s record number of unique users:

 

Best Week

Best Week

These stats are no big secret.  You can check them out at this link.

30
May

Chinese Proxy Purge, Part II

The 7AM run came and went and the 8AM page refresh had 59 new Chinese proxies, taking the total Chinese proxy count up to 167.

I ran the China Purge again and the number dropped to 108.

There’s some kind of strange equilibrium going on there.

Anyway, I re-ran the page refresh at 8:18 to reflect the changes.

30
May

Chinese Proxy Purge

It seems my Russian “supplier” is overly fond of Chinese proxies lately.  Since I fixed my code yesterday that seems to be all I get out of him.

Our Russian friend may like them (who knows – he may have grown them), but I’ve never cared for them.  Back when I used to scour the lists by hand, the Chinese proxies never worked (Brazil used to have the same issue, btw).  And with all the recent news about cyberwar and the weaponization of the Internet, you just have to think twice about using anything Chinese (even though your system, a large chunk of the software you run, and your ISP’s network was probably made in China or built with Chinese parts), especially Chinese proxies from a Russin supplier.  The mind boggles.   

However, sometime this year – perhaps it has happened already – China is predicted to have the highest number of users online, so it would seem only natural for them to have the most proxies – or the most hacked systems – on the Net.

But be that as it may, old habits die hard.  I don’t like seeing all those little red flags on Page 1.

So this morning I ran a special recheck on all those allegedly active Chinese proxies.

53% were already dark.

Even with that correction, China still leads the pack in verified, non-CoDeeN proxies.

29
May

CoDeeN List Change

I know almost no one cares about the CoDeeN text files, but starting with the 4PM (EST) run they will be randomized, thanks to “order by rand()“.

Currently they’re listed in the reverse order of  when they were discovered (like the rest of the list), which isn’t very random.

29
May

05/27/09 9AM Run

When I added the Javascripters this morning I also uncommented a single line from the harvester script.  I have one Russian… ummm… “supplier” who bounces between two URLs to deliver the goods.  There never seemd to be a pattern between which URL was working and which one wasn’t, but I never paid that much attention to it.

Usually I just use the working URL.  I checked that one this morning and it had morphed into the non-working URL, so I switched.  But I thought – what the heck – why not use them both all the time?   That way it doesn’t matter which one is working and anyway the non-working URL will only take a second to check .

Duh.  A no-brainer.

Sometimes I’m slow like that.  Most of the time, actually.

I picked up a whole page of proxies with that one change.

29
May

Javascripters Added To Harvest

Yesterday, after banging on the latest Javascript Obfuscator site, I got four new active proxies.

Not much but this does represent a 1% return, which frankly isn’t that bad.  Four per day is 25-30 per week, if they can keep it up.

Which I doubt.

That’s better than most lists which are likely to have one active proxy out of a thousand listed.

Anyway, my script runs fast enough to check them out once an hour.

28
May

Google’s Revenge

One of the problems with the Google Hack has been the garbage that’s not related to proxies.  Usually this just wastes time and cycles.  Sometimes it crashes the system.

Which is what happened today.

The system in question is the AMD64x2 Mythbuntu box I run the Google Hack on (the VM that holds the database and updates the Web page is a little too wimpy to run The Hack).

Today it tried to snarf down this text file.

I have no clue what kind of log file that is, but when my script slammed it the box went bye-bye.  It’s gone.  Can’t even ping the sucker.

27
May

Obfuscators PWN3D!

Get a load of this garbage…

Our service provides free proxy list and fresh proxy list.
Our proxies are the most updated and fresh proxies you may find in the web.
Our free proxy list is one of the most reliable in compare to other proxy lists.

Whut a pile!

It took me about forty five minutes to hack out a script to de-obfuscate these clowns.  It ran the first time.  When the smoke cleared they had a total of two proxies that weren’t in my database.  Of these two, one was CLOSED and the other timed out.

In other words, same old CRAP.  There is NOTHING special about these guys.  They have the same SHIT every proxy list on the Web has.

Here is more of their advertising…

We are updating constantly, every few seconds we add new anonymous proxy or elite proxy to the list. And we also delete a proxy server that is down and can’t be used anymore.
We do all of this to make sure you get the best anonymous proxy list. We provide http proxy, elite proxy, anonymous proxy, Codeen/PlanetLab proxy and transparent proxy.
e-pr0xy is one of the best proxy sites online!

Utter.  Fucking. Nonsense.

I’ll run a few more tests, but it doesn’t look like these jokers are going into the harvester.   They’re probably not worth the trouble, but if they can supply a half dozen new IPs a day I may reconsider.  But I doubt it.