<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><blockquote type="cite"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; "><a href="tel:50.57.190.113" value="+15057190113">50.57.190.113</a> </blockquote></div></blockquote><div><br></div><div>is the one "<a href="http://50-57-190-113.static.cloud-ips.com">50-57-190-113.static.cloud-ips.com</a>" is the reverse mapping - appears to come from Rackspace in Chicago.</div><div><br></div><div>There's a cluster of them over there. I've seen a few different ones. This isn't some minor test.</div><div><br></div><div>MMC</div><br><div><div>On 25/06/2012, at 11:55 AM, Joshua D'Alton wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">58.163.175.187 I assume you are all meaning? That is Telstra proxy of some sort, as is </span>1.136.95.242<br>
<br><div class="gmail_quote">On Mon, Jun 25, 2012 at 12:20 PM, Terry Manderson <span dir="ltr"><<a href="mailto:terry@terrym.net" target="_blank">terry@terrym.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; ">
<br>
My jaw dropped when I saw this.<br>
<br>
And indeed confirmed on my telstra sim and new valid url:<br>
<br>
58.163.175.xxx - - [24/Jun/2012:21:58:46 -0400] "GET /sn.html HTTP/1.1" 200 340 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3"<br>
<a href="tel:50.57.190.113" value="+15057190113">50.57.190.113</a> - - [24/Jun/2012:21:58:47 -0400] "GET /sn.html HTTP/1.0" 200 341 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0"<br>
<br>
and then to confirm carrier and not phone, swapped to a AT&T travel sim.<br>
<br>
166.137.11.xxx - - [24/Jun/2012:22:05:50 -0400] "GET /sn.html HTTP/1.1" 200 378 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3"<br>
<br>
No followup GET seen.<br>
<br>
I think like everyone, I would be most interested to see an explanation of the additional GET from a location in the US.<br>
<span class="HOEnZb"><font color="#888888"><br>
T.<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
<br>
On 25/06/2012, at 10:23 AM, Nicholas Weekley wrote:<br>
<br>
> I too have discovered similar traffic...<br>
><br>
> Legit:<br>
> 58.163.175.xxx /services.html 6/25/12 10:08 AM Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit<br>
><br>
> CIA/NSA/Those-out-to-get-me<br>
> 50.56.58.47 /services.html 6/25/12 10:08 AM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906<br>
><br>
> A quick signature scan of 50.56.58.47 identifies it as a squid proxy server based in Texas too. My best guess is the proxy takes time to process the retrieved page, so initial connections go directly to the source and subsequent requests to the proxy if valid caching occurs.<br>
><br>
> Regards,<br>
><br>
> Nicholas Weekley<br>
> TSM32 Pty Ltd<br>
><br>
><br>
> From: <a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a> [mailto:<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>] On Behalf Of Eric Pinkerton<br>
> Sent: Monday, 25 June 2012 09:50<br>
> To: <a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br>
> Subject: [AusNOG] Telstra's Texan Teaser - Tin Foil Stetsun anyone?<br>
><br>
> Ausnoggers..<br>
><br>
> Whilst there is a lot of tin foil hattery and other spasticity on this WP Thread, <a href="http://forums.whirlpool.net.au/archive/1935438" target="_blank">http://forums.whirlpool.net.au/archive/1935438</a> - the questions it throws up have made me curious, esp given Telstra's official response in the following article "<br>
><br>
> <a href="http://www.scmagazine.com.au/News/305928,telstra-says-its-not-spying-on-users.aspx" target="_blank">http://www.scmagazine.com.au/News/305928,telstra-says-its-not-spying-on-users.aspx</a><br>
><br>
> "But in a short statement, Telstra's senior media boss Craig Middleton said the company's wireless network management assured that "there is nothing untoward in what the Whirlpool member has observed - it is a normal network operation" NOTHING TO SEE HEAR MOVE ALONG.<br>
><br>
> In short, if you make a request to a web server on port 80 from a Telstra mobile, you'll see a request immediately after your legit request from the Telstra gateway that originates from a US IP address hosted at Rackspace.<br>
><br>
> Legit request..<br>
> 58.163.xxx.xxx - - [24/Jun/2012:23:12:09 +0000] "GET /test101 HTTP/1.1" 404 464 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3"<br>
><br>
> Curious identical request follows...<br>
> 50.57.190.97 - - [24/Jun/2012:23:12:09 +0000] "GET /test101 HTTP/1.0" 404 526 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0"<br>
><br>
> Whilst I accept this is probably benign, and can think of several reasons why the output of such a process might be of value to Telstra, I find myself less convinced than a certain senior media boss seems to be that this is "a normal network operation". To me normal would be to say pull this info straight from the proxy server.<br>
><br>
> Also, just to be awkward, I am curious as to why a cloud provider, would be using what looks a lot like a cluster of VPS's in someone else's cloud based out of Texas ;-)<br>
><br>
> Also why is there a black helicopter hovering above me?<br>
><br>
> So many questions....<br>
><br>
> Discuss!<br>
><br>
><br>
> E<br>
><br>
> Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering.<br>
> <a href="http://www.mailguard.com.au/mg" target="_blank">http://www.mailguard.com.au/mg</a><br>
><br>
><br>
> _______________________________________________<br>
> AusNOG mailing list<br>
> <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
> <a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></div></blockquote></div><br>
_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>http://lists.ausnog.net/mailman/listinfo/ausnog<br></blockquote></div><br></body></html>