Hinky’s Proxy Obsession

Here is a site the Google Hack barfed up the other day.  At first glance it would appear to have dozens of proxies listed, but on closer examination you will notice there are only two distinct IP addresses.  The only difference is the ports.

When refreshed, the page is updated.

If you go to the trouble of scanning the IPs, at least one has a possible proxy port (8080).  Apparently, these are connections from proxies.  That is, the listed port is the dynamic port the proxy is using to connect to this (?) site.

This is not helpful.

This site added about a thousand rows of junk to the database.  In the Grand Scheme of Things, that’s not a lot, especially if your definition of “junk” includes “dead proxies”.  If so, the database is 99.95172% junk.  However, my junk is required to have been a proxy at some time in the past, so these had to go and the URL has been banned from subsequent scans.

This comment was posted at my Unreal Tournament Blog, in response to my post about my Cameroonian users (nearly 60% of all visitors to the List)…

hello Mr Hinky i understand how you feel and think about cameroonians well you see let me let you know more……think of a child who just completed his secondry school studies after loosing his parents and sponsoured by his uncles who now turn the world on him and in this situation he tries to get him self to the university and only ends up seeing he can’t affored his fees and rents. one day he notices that an hour or 2 spend at the cyber can earn him hundreds of thousands …that with you help(hope you understand what i mean) so should he just go outside there and hold a gun pointing at inocent people at night and even ending up killing some who say they have no cash on the for real ..or should he just sit calmly at the cyber dtore and AVENCHE our 4fathers for the meseries and pains put upon us…while regarded by the scammed(Europeans) as Slaves times back….well living a luxury life is normal for the well living, better still not all scammers leave that way …i won’t encourage them but i will say those are poeple who only are victims of circumstancies and i think think all they need is Employment of which the government is backholding…..so you see her in cameroon not the scammers are to be blammed but the government for being the cause-effect. anyway thanks to you for solving the problem of unemployment here for use and i know by his grace one day i will change from my deeds……and become a person who can boost to create jobs oppotunities in his county and limit the rate of scamming…..if you could me me score my goal quicker then i think i can then contact me at : [deleted]@yahoo.com …..for any advices and maybe talks like a child to father issue…..cause i have no parents am 19 and living a life from hand to mouth. but sure to achive my dreams someday……thanks for the patience to read all through if you completed stay wise and meet your goals too in life….Allino€

You meet the most interesting people running a proxy list!

It looks like our Russian friend has set his sites on Brazil.

After the 4AM/5AM run there were no less than three pages of Brazilian proxies.  From my past experience, Brazilian proxies are about as worthwhile as Chinese proxies.  They never seem to be working by the time I get around to needing one.

But that was then, this is now.  In those days every other Brazilian proxy was on TCP port 6588, which I believe was WinGate or WinProxy or something similar.  This time around the ports are mostly 8080 and 3128, with a smattering of oddballs.

Still, old prejudices die hard.  I’m going to run them through the same tests I did with the Chinese proxies.

Got more junk from a known comment SPAMmer using a SQUID proxy at 89.248.160.248 on port 31337 (dweebish for “eleet” – jesus, how unoriginal).  The box is at this hosting provider in Belize.

I’d put it in The List (it’s not in the database – I checked), but the proxy requires authentication, which makes it un-listworthy.

FWIW, there are only 50 proxies in the database – out of 1.9 million – that use port 31337.  None of them have ever made it into the gold table (live proxies).

I woke up this morning with an e-mail telling me to approve a new comment here.  I logged in, looked at it and found it was junk.   Just as I was about to delete it forever, I saw the IP address (218.204.251.148) and it dawned on me it could be a proxy.  I did a whois and found it belonged to “China Mobile Communications Corporation” (no surprise there).  I scanned it with nmap and got these results:

Very odd, especially port 1720, which indicates some kind of telephony application, perhaps VOIP. Definitely not a proxy, unless someone has decided to use port 22 as a ruse.  I tried it anyway.  No go.  I tried making an SSH connection.  No go.  On to the next port, telnet.  I got this:

Now it gets interesting (you knew that would happen sooner ot later, right?).  This banner appears to be specific to products made by Huawei Technical.  We are definitely outside of Proxy Territory now.

And if you’re wondering, no, I didn’t guess the password.

If you do a search on “Huawei Hacking“ , the plot thickens.  A couple of hundred thousand links, including YouTube videos!  Most of the videos concentrate on “unlocking” various Huawei 3G broadband products, but if they are that easy to unlock there must be more haxx to be had.

So what is this thing?  One of the few references I found to that banner was in this Chinese router manual, shown below:

This makes me think it’s some sort of router or other broadband device (probably “consumer quality”).

[Oh by the way... can anyone tell me why any screen capture of a PDF file made on Windows doesn't fucking work on WordPress?  Is this some sort of DRM thing?  It was a major pain in the ass getting that picture online here and I finally had to do the capture on an Ubuntu VM. -hinky]

So we have a new vector here.  Or at least it’s new to me.

Looking back at the SPAM, it’s obvious – in retrospect – he was testing to see if comments were unmoderated here – which they are not.  All the text is random: his email address and several embedded links are all garbage constructed to look like URLs.  And if you Google this guy, you’ll find he’s new but he’s getting around.  So far he’s only been posting from that IP for the last few days.  He’s definitely looking for blogs to SPAM.

And who knows what else?

But – for sure – he’s found a kick-ass platform to do his dirty work on.

I am officially impressed.