- cypherpunks-legacy - lists.cpunks.org

Anongo is DoD Domain
by John Young 13 Oct '01

13 Oct '01

================================================== === VisualRoute report on 13-Oct-01 9:39:35 AM === ================================================== Real-time report for anongo.com [215.104.228.144] (80% done) Analysis: IP packets are being lost past network "Qwest Communications" at hop 13. There is insufficient cached information to determine the next network at hop 14. ---------------------------------------------------------------------------- --------------------------------------------------------------------------- | Hop | %Loss | IP Address | Node Name | Location | Tzone | ms | Graph | Network | ---------------------------------------------------------------------------- --------------------------------------------------------------------------- | 1 | | 206.115.154.10 | tnt10.nyc3.da.uu.net | New York, NY, USA | -05:00 | 164 | --x-- | UUNET Dial-Up Networks | | 2 | | 206.115.245.2 | - | ?Fairfax, VA 22031 | | 152 | -x-- | UUNET Dial Access Network | | 3 | | 152.63.23.190 | 230.at-2-1-0.HR2.NYC9.ALTER.NET | New York, NY, USA | -05:00 | 156 | -x-- | UUNET Technologies, Inc. | | 4 | | 152.63.15.198 | 0.so-2-3-0.XL2.NYC9.ALTER.NET | New York, NY, USA | -05:00 | 168 | --x-- | UUNET Technologies, Inc. | | 5 | | 152.63.23.142 | 0.so-7-0-0.XR2.NYC9.ALTER.NET | New York, NY, USA | -05:00 | 173 | --x---- | UUNET Technologies, Inc. | | 6 | | 152.63.18.205 | 280.at-1-0-0.XR2.NYC8.ALTER.NET | New York, NY, USA | -05:00 | 159 | -x-- | UUNET Technologies, Inc. | | 7 | | 152.63.23.173 | 182.ATM6-0.BR1.NYC8.ALTER.NET | New York, NY, USA | -05:00 | 128 | x----- | UUNET Technologies, Inc. | | 8 | | 205.171.4.9 | jfk-brdr-02.inet.qwest.net | New York, NY, USA | -05:00 | 129 | x---- | Colorado Supernet, Inc. | | 9 | | 205.171.230.26 | jfk-core-03.inet.qwest.net | New York, NY, USA | -05:00 | 125 | x-- | Colorado Supernet, Inc. | | 10 | | 205.171.230.5 | jfk-core-01.inet.qwest.net | New York, NY, USA | -05:00 | 123 | x-- | Colorado Supernet, Inc. | | 11 | | 205.171.5.236 | wdc-core-01.inet.qwest.net | Washington, DC, USA | -05:00 | 129 | x-- | Colorado Supernet, Inc. | | 12 | | 205.171.24.82 | wdc-edge-05.inet.qwest.net | Washington, DC, USA | -05:00 | 127 | x-- | Colorado Supernet, Inc. | | 13 | | 63.148.66.222 | - | ?Arlington, VA 22203 | | 133 | -x--- | Qwest Communications | | ... | | | | | | | | | | ? | | 215.104.228.144 | anongo.com | ?Vienna, VA 22183 | | | | DoD Network Information Center | ---------------------------------------------------------------------------- --------------------------------------------------------------------------- Roundtrip time to 63.148.66.222, average = 133ms, min = 112ms, max = 234ms -- 13-Oct-01 9:39:35 AM -------------- DoD Network Information Center (NETBLK-DDN-NIC16) 7990 Boeing Court M/S CV-50 Vienna, VA 22183 US Netname: DDN-NIC16 Netblock: 215.0.0.0 - 215.255.255.255 Maintainer: DNIC Coordinator: DoD, Network (MIL-HSTMST-ARIN) HOSTMASTER(a)NIC.MIL (703) 676-1051 (800) 365-3642 (FAX) (703) 676-1749 Domain System inverse mapping provided by: AAA-VIENNA.NIPR.MIL 207.132.116.60 AAA-KELLY.NIPR.MIL 199.252.162.251 AAA-WHEELER.NIPR.MIL 199.252.180.251 AAA-VAIHINGEN.NIPR.MIL 199.252.154.251 Record last updated on 09-Jun-1998. Database last updated on 12-Oct-2001 23:25:26 EDT. ----------

1 0

evil empire meets evil disease
by mattd 13 Oct '01

13 Oct '01

Pre emptive strike? In the 29th sept new scientist theres a story on US financed(mainly)biowarfare testing for a fungus poppy root destroyer.Ghan is practically a one crop country.Motive to attack the great satan, if only to scare the shit out of the infidels.You people have to do something about the crimes committed in your name or...just say so.

1 0

RIAA Safeweb Proxy ID
by John Young 13 Oct '01

13 Oct '01

Thanks to SC: [SC's IP address replaced by xxx.xxx.xxx.xxx] ----- I've tuned in late to the riaa/safeweb thing, but I'm chiming in with my bit. Tracing from safeweb is an interesting exercise; the geography is very typical of the internet backbone and the router hops packets take. I wrote a script to mail all possible headers from a connecting browser to myself. I installed it on my server http://xxx.xxx.xxx.xxx:8140, and then connected from Safeweb. This anonymizer uses a caching proxy server, listening for connections on several IPs; it preserves client headers while obviously changing the IP of the originating connection; it preserves many of the originating headers; it adds some new headers. Here's the output: GATEWAY_INTERFACE..........CGI/1.1 REMOTE_ADDR..........64.124.150.136 DATE_LOCAL..........Saturday, 13-Oct-2001 01:22:45 EDT REQUEST_METHOD..........GET QUERY_STRING.......... DOCUMENT_URI........../index.html HTTP_ACCEPT..........image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */* REMOTE_PORT..........2513 SERVER_ADDR..........142.204.119.75 HTTP_ACCEPT_LANGUAGE..........en-us HTTP_CACHE_CONTROL..........max-age=259200 REDIRECT_STATUS..........200 HTTP_ACCEPT_ENCODING..........gzip SERVER_NAME..........xxx.xxx.xxx.xxx HTTP_X_FORWARDED_FOR..........127.0.0.1 SERVER_PORT..........8140 DOCUMENT_NAME..........index.html HTTP_IF_MODIFIED_SINCE..........Sat, 13 Oct 2001 05:15:44 GMT; length=853 REDIRECT_URL........../ DATE_GMT..........Saturday, 13-Oct-2001 05:22:45 GMT SERVER_PROTOCOL..........INCLUDED HTTP_REFERER..........http://xxx.xxx.xxx.xxx HTTP_USER_AGENT..........Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) HTTP_CONNECTION..........keep-alive REQUEST_URI........../ HTTP_HOST..........xxx.xxx.xxx.xxx:8140 HTTP_VIA..........1.0 anongo.com:3128 (Squid/2.3.STABLE3) The last one in the list is the flavour of proxy they use: Squid/2.3.stable3 And the DNS name of the source box for the HTTP request is anongo.com, which I don't believe showed up in your trace logs. Basically a caching proxy server's header set. The authoritative name servers for anongo.com are ns3.above.net www.anongo.com redirects to Safeweb. The boxes are standard unix/apache with ssl. They have written scripts to replace the originating address header and keep track of the connection, receive requested files to their cache, and then serve from that cache to your browser. The machines would absolutely be configured to do sophisticated logging; there is no free lunch on the net. While they appear to do a nice job, their server logs would be a goldmine. Everyone who uses a commercial web browser agrees to have their information gathered the first time they use that browser - do you want to continue? When you say yes, you mean it! -----

1 0