4

Am I being stalked?

I was recently doing some basic Python development scripting.

Python has a nice feature where it can run a simple HTTP server that serves the contents of the local directory, on port 8000 by default, but selectable to any other port.

I went to serve the contents of my working directory using this feature. Note that it prints out a log with IP/Hostname of every request in real time.

(Note I'm masking my IP with 1.2.3.4)

Serving HTTP on 0.0.0.0 port 8000 ...
1.2.3.4 - - [02/May/2013 17:20:57] "GET / HTTP/1.1" 200 -
1.2.3.4 - - [02/May/2013 17:20:57] code 404, message File not found
1.2.3.4 - - [02/May/2013 17:20:57] "GET /favicon.ico HTTP/1.1" 404 -
1.2.3.4 - - [02/May/2013 17:21:01] code 404, message File not found
1.2.3.4 - - [02/May/2013 17:21:01] "GET /mobile HTTP/1.1" 404 -

Ok. This looks fine, getting all 404 errors at this point. 1.2.3.4 is me.

But then look:

1.2.3.4 - - [02/May/2013 17:21:08] "GET /mobile.html HTTP/1.1" 200 -
ec2-54-242-63-60.compute-1.amazonaws.com - - [02/May/2013 17:21:40] "GET /mobile.html HTTP/1.1" 200 -
usloft3354.dedicatedpanel.com - - [02/May/2013 17:22:13] "GET /mobile.html HTTP/1.1" 200 -

Look at the last two lines! Once I get my first 200 Response (OK), I'm being followed!

Note that there are of course no links to this page anywhere on the Internet, so web crawlers couldn't find it.

Let's just assume for a second it's a port crawler scanning port 8000 (very plausible). Then how does it know exactly to request the page /mobile.html (nothing else)??

So I run the python web server again, this time removing /mobile.html and making a new page /test.html:

Serving HTTP on 0.0.0.0 port 8000 ...
1.2.3.4 - - [02/May/2013 17:34:05] "GET /test.html HTTP/1.1" 200 -
ec2-54-242-63-60.compute-1.amazonaws.com - - [02/May/2013 17:34:06] "GET /test.html HTTP/1.1" 200 -
usloft3101.dedicatedpanel.com - - [02/May/2013 17:34:06] "GET /test.html HTTP/1.1" 200 -

Whatever's happening, this much is clear: My web browsing is being recorded and shadowed.

To hammer in the point, I try serving the server on port 8001 with a new page (/test2.html):

Serving HTTP on 0.0.0.0 port 8001 ...
1.2.3.4 - - [02/May/2013 17:36:40] "GET /test2.html HTTP/1.1" 200 -
ec2-107-20-20-213.compute-1.amazonaws.com - - [02/May/2013 17:36:41] "GET /test2.html HTTP/1.1" 200 -

Again, the mysterious shadower knows exactly the page to request (and NOTHING else).

Hypotheses

I really have no idea how to explain this. It is important to note that I am browsing through a VPN located in Canada, while both me and the sites I'm vising are located in the United States. I have a suspicion that since this is crossing national boundaries, the traffic is flowing through a pipe tapped by [insert-three-letter-government-agency]. Laws regarding domestic censorship within the US are tough, but I doubt any of that applies to international traffic.

If not some agency, might it be my VPN provider snooping on my stuff while being proxied?

Also, could it be ISPs snooping on my traffic, since traffic originating from this IP is often used for torrents (I'm not torrenting, I'm using this VPN for anonymity while browsing). If so, is this unethical/illegal on their part?

Any thoughts/feedback/experience greatly appreciated, thank you!

Improve this question
4
  • 5
    The VPN you're connecting through might have what is called a caching proxy. Some of these are known to have rather poor implementations (no gzip or deflate support), so it would be interesting to see your logs if you enable logging of response size - if the response size changes, indicating no compression. That would be consistent with e.g. Blue Coat's ProxySG. A long discussion about it can be found here. It reveals how the proxy is following web requests users make, and where it's ineffective and considered intrusive.
    – TildalWave
    Commented May 2, 2013 at 22:06
  • Would be interesting to see the User Agent headers for those requests. Maybe you should look at wireshark or tcpdump to capture more information.
    – David
    Commented May 3, 2013 at 1:06
  • Try with a different browser, and see if the behaviour changes. I also agree with @David, it'd be helpful to have more data from these requests. You might want to put up a page that captures all of the request data and saves it off, then hit it and see what you get.
    – Xander
    Commented May 3, 2013 at 1:24
  • Have you checked for nefarious toolbars/plugins in your browser? Maybe you've got one reporting your usage somewhere, and that's triggering a crawler...?
    – Roger Lipscombe
    Commented Jun 17, 2014 at 9:21

2 Answers 2

Reset to default
3

I agree with TildalWave and Tracy Reed. This is almost certainly a caching proxy or an indexer of some sort being run either by your VPN provider, their upstream connectivity provider, or the server hosting provider.

It's not NSA/TLA "snooping" for the following reasons:

  1. The NSA would just sniff the packets over the wire
  2. The NSA would force your VPN provider to span them a feed from the outbound side of their gear
  3. The NSA would tap into the packets by compromising your computer
  4. The NSA would not use such an amateurish, easily detectable method of snooping

For all those reasons, I'd say there is no determined adversary spying on you. The other explanations are much more plausible.

Improve this answer
1
2

Web proxy. Maybe your VPN provider is caching. Try this test without the VPN. Is the server on your localhost? Try connecting to 127.0.0.1 to get the file. See which of these steps causes the shadow behavior to stop. That will help you deduce where the proxy/stalker is. :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .