Not a mirror. It's signing SSL using same certs as http://wikileaks.org for goodness sakes.
Do mirrored or load-balanced sites not share the same SSL key? Is the author claiming something like: "If a site that isn't Wikileaks, appears to have the Wikileaks SSL private key, something shady is going on?" Or have I misunderstood? The author is referencing that when they did a
dig wikileakgs.orgthe below two of the IPs linked to that domain were called into question (note: I don't understand why, hence the thread). (Edit re: these hosts added at bottom of thread.)
wikileaks.org. 600 IN A 18.104.22.168 wikileaks.org. 600 IN A 22.214.171.124
I'm confused by both statements:
Best case scenario, keys aren't physically there (but bad actor can still forge)
Worst case scenario: Bad actor can decrypt anything. If WL was your bank, this server can take money
Is this because they appear to have a SSL key that they shouldn't? How does one tell if a web server is a separate entity, and not just load-balancing (on behalf of Wikileaks, as in this example)?
One big issue, that I can identify, is as follows: Wikileaks is hosted by Swedish ISP Bahnhof, in the Pionen facility. However, when users did a
whois 126.96.36.199, they got this response:
organisation: ORG-MTL21-RIPE org-name: Mir Telematiki Ltd org-type: LIR address: Barabannii pereulok 4/4 address: 107023 address: Moscow address: RUSSIAN FEDERATION phone: +7 495 369 9796 fax-no: +7 495 369 9796 mnt-ref: MTLM-MNT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT mnt-by: MTLM-MNT abuse-mailbox: email@example.com abuse-c: HA2800-RIPE created: 2010-10-06T10:46:46Z last-modified: 2016-09-30T12:14:19Z source: RIPE # Filtered
I am now thinking, that this host being owned by a Russian provider (who Patribotics associates with Russian hacking communities -- potentially an entirely separate issue), and not being owned by the Swedish ISP or a reputable CDN... perhaps is the issue?