Am I being stalked?
I was recently doing some basic Python development scripting.
Python has a nice feature where it can run a simple HTTP server that serves the contents of the local directory, on port 8000 by default, but selectable to any other port.
I went to serve the contents of my working directory using this feature. Note that it prints out a log with IP/Hostname of every request in real time.
(Note I'm masking my IP with 18.104.22.168)
Serving HTTP on 0.0.0.0 port 8000 ... 22.214.171.124 - - [02/May/2013 17:20:57] "GET / HTTP/1.1" 200 - 126.96.36.199 - - [02/May/2013 17:20:57] code 404, message File not found 188.8.131.52 - - [02/May/2013 17:20:57] "GET /favicon.ico HTTP/1.1" 404 - 184.108.40.206 - - [02/May/2013 17:21:01] code 404, message File not found 220.127.116.11 - - [02/May/2013 17:21:01] "GET /mobile HTTP/1.1" 404 -
Ok. This looks fine, getting all 404 errors at this point. 18.104.22.168 is me.
But then look:
22.214.171.124 - - [02/May/2013 17:21:08] "GET /mobile.html HTTP/1.1" 200 - ec2-54-242-63-60.compute-1.amazonaws.com - - [02/May/2013 17:21:40] "GET /mobile.html HTTP/1.1" 200 - usloft3354.dedicatedpanel.com - - [02/May/2013 17:22:13] "GET /mobile.html HTTP/1.1" 200 -
Look at the last two lines! Once I get my first 200 Response (OK), I'm being followed!
Note that there are of course no links to this page anywhere on the Internet, so web crawlers couldn't find it.
Let's just assume for a second it's a port crawler scanning port 8000 (very plausible). Then how does it know exactly to request the page
/mobile.html (nothing else)??
So I run the python web server again, this time removing
/mobile.html and making a new page
Serving HTTP on 0.0.0.0 port 8000 ... 126.96.36.199 - - [02/May/2013 17:34:05] "GET /test.html HTTP/1.1" 200 - ec2-54-242-63-60.compute-1.amazonaws.com - - [02/May/2013 17:34:06] "GET /test.html HTTP/1.1" 200 - usloft3101.dedicatedpanel.com - - [02/May/2013 17:34:06] "GET /test.html HTTP/1.1" 200 -
Whatever's happening, this much is clear: My web browsing is being recorded and shadowed.
To hammer in the point, I try serving the server on port 8001 with a new page (
Serving HTTP on 0.0.0.0 port 8001 ... 188.8.131.52 - - [02/May/2013 17:36:40] "GET /test2.html HTTP/1.1" 200 - ec2-107-20-20-213.compute-1.amazonaws.com - - [02/May/2013 17:36:41] "GET /test2.html HTTP/1.1" 200 -
Again, the mysterious shadower knows exactly the page to request (and NOTHING else).
I really have no idea how to explain this. It is important to note that I am browsing through a VPN located in Canada, while both me and the sites I'm vising are located in the United States. I have a suspicion that since this is crossing national boundaries, the traffic is flowing through a pipe tapped by [insert-three-letter-government-agency]. Laws regarding domestic censorship within the US are tough, but I doubt any of that applies to international traffic.
If not some agency, might it be my VPN provider snooping on my stuff while being proxied?
Also, could it be ISPs snooping on my traffic, since traffic originating from this IP is often used for torrents (I'm not torrenting, I'm using this VPN for anonymity while browsing). If so, is this unethical/illegal on their part?
Any thoughts/feedback/experience greatly appreciated, thank you!