///\\\ Poisoned Onion Relays ///\\\

Anonymous

unread,

Sep 10, 2015, 1:00:05 AM9/10/15

to

"Preliminary testing of two of the relays indicate an unknown
exploit causing a non-fatal, recursive stack overflow in the entry
guard, apparently to finesse the originating client IP."

_______________________________________________________________

router proximus 209.249.180.198 9001 0 80
platform Tor 0.2.5.12 on Linux
protocols Link 1 2 Circuit 1
fingerprint FFCF 1FD0 4F46 C429 712A C7A0 4BB4 42CA D46B 255B
extra-info-digest A10638843429477B0639DCD4057BC2C498D0F328
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALdvozsGLcClgS6Sj+PHtYuZ7Xk2sX5lq/VQHaBg5eDGp6GuByeIZA5W
FRxv8Op+jbFibfs5p6qDD18BNNms0aQJ0jNzwv1y9LhKS0tByb5siW8b9Urc0N4A
MRVy93ecPrl2AJFYWKs7J7hq2bCktjXUwM3Lg1ZtnAzYeXQBIydHAgMBAAE=
-----END RSA PUBLIC KEY-----
signing-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBANF18IylEdossKe0PID+/71b+VfU4U2Ek77r8Xd/2kkl6IKGzFmRpcwC
N220tlrwQv+V9qoQBUH8mTAINW7oaI1S2nzIkBAp1gKAZomLRf+Imh5GUIJpPbJK
OtuIYDQ2SiXNzRqKhb9E5C0Gw6GVH6M6aXKAN+TMV195pipYNbC/AgMBAAE=
-----END RSA PUBLIC KEY-----
hidden-service-dir
contact admin[AT]kartofelzik.info - 1FyVbHiuSRfH9QXYabaQxMZh9uzWSd5PP
ntor-onion-key HN+fue4euhDOgWoWJ460LWYXIGg3bXdGt4smltDUsUk=
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject 209.249.180.198:*
accept *:*
_______________________________________________________________

router RingsOfFury 209.249.157.69 9001 0 80
platform Tor 0.2.5.12 on Linux
protocols Link 1 2 Circuit 1
fingerprint E4C4 2A96 CED0 B96B A354 A2B0 FDC1 71C3 6E19 303E
extra-info-digest D65EBF4A6D5569BE89E9D16A87038416DAC1F253
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAML8jF8XLhg/XRWNe14M6L5CaY+VLpo68RvGcSYoGzJ3OqeGuI1Vt0kC
ojrKiVkrP+KleSXwsbFChOSotxLD+5zwXgs6sUA8hAENEKgquevdSPAMSeUPWfuq
Sqg+Y3N3ahV2fFT9FYPNwfsQ42na4fxWj7x9/ii2NvuTqkZqXw13AgMBAAE=
-----END RSA PUBLIC KEY-----
signing-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALmaS/OafBikIUznIoqJM8N0wZsJfupNVzufiq0KKyLTrZXchC1KBs6j
TgWZvU+okLkr2DcnuS0gxBTPsZYsXSHy0908wAj/fIXMqwaqOwNxc5pPPladQUlZ
C60uyrHGd26y0hCrYK4ZFg/HRUmkS3hAri+MZY/b9HCq+k3iE11TAgMBAAE=
-----END RSA PUBLIC KEY-----
hidden-service-dir
contact admin[AT]kapustik.info - 18uYYYBxReFtWd4v3P8e3C725DHRCaXdZK
ntor-onion-key Ifv4itFncqCRl5TyEJd9FUpf+JfM3yKIzXun4a8V6yQ=
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject 209.249.157.69:*
accept *:*
_______________________________________________________________

router telecommuter 4.31.64.70 9001 0 80
platform Tor 0.2.5.12 on Linux
protocols Link 1 2 Circuit 1
fingerprint 4BC4 8E7A E7F6 D14C 49BF 048E 2F7A E734 E8D9 E0E7
extra-info-digest 23A6579908D3C09D168F3EFB397673671DCAC590
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAMEwBQ795BcJXzX61GFpBh4BNzVHR3otuV7P+1tIUfUKEfjUQ3N8t78E
Dmi3dLgfbD5pAUFyp/1i5PBur0nan6FJ/6KOLiC/JM4NiiikYTVDJ0NXK2K4fAZn
Ir/C+hWexF70sddXoo4YukBzOQPqadNgN/Oy0PF6LbJjAA1AS7l3AgMBAAE=
-----END RSA PUBLIC KEY-----
signing-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBANzshqIQuyNKfTAxox+pfqutMArF+iuYJy1Ue9ObdXujtNRaV9RW6MAs
OScAYL2h+IiAPrWOYZxuDI7EMUrk3giwBvbkf/ArchREUEvsNGzgOSMTdtJjU/MX
RzP6liOpxjgXVFxf7RqRo9nzBYGkiuFm2Cx9MI+uGVhvrr08kertAgMBAAE=
-----END RSA PUBLIC KEY-----
hidden-service-dir
contact admin[AT]arbuzik.biz - 1BtJfTMKUhc6TM3MZz9w2N2eQkofTbaPam
ntor-onion-key uHDvMPF9Hep2+AuJSwvtRXFye2uHgFRM3kuOnXISJlQ=
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject 4.31.64.70:*
accept *:*
_______________________________________________________________

router TildeMash 209.66.119.150 9001 0 80
platform Tor 0.2.5.12 on Linux
protocols Link 1 2 Circuit 1
fingerprint 1DA3 3B98 23B9 E169 138D 2F7B 6A9D 0626 244F 0A4E
extra-info-digest 1D04D3DC6805ECD4291C6FF4197E2D84F38E7062
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALxtDWm1RKD+VnlsNhH1fhZvLw+8Kda9eB5TUeknKE/79x4pqvhRFEGS
/pyEtm2Oj2WRxiM00kf0qRx6e5mtVzIWKDqnfPX7k9j71TN81exfxR+28kFWVIIp
Us2I6vB3ywp0BbQ2KMP+WMRTaRXwOoGzw4H2m6TsD+asLWFzMiYzAgMBAAE=
-----END RSA PUBLIC KEY-----
signing-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAMqjEeKaQqSTnlmtWxD3mIRseaSXlaBUlh/g0CgB0ra/4BTGwzbdkRUl
Vxkr50EdNB7bIeesKKNP7vOmT4XJonbW9sVJCt8Sq19WWpnUvT4PH998FMcpC5sJ
+XmJHfSzMsLpRCunNix1YfLj6f7Wv17b3zA+YmFlOH/ug8dcaZuTAgMBAAE=
-----END RSA PUBLIC KEY-----
hidden-service-dir
contact admin[AT]baklazhanik.info
ntor-onion-key JnDVrsRBAXX/Hp+rUjcA9WSdbUY5dcqCxZ1B/wi4gx8=
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject 209.66.119.150:*
accept *:*
_______________________________________________________________

router VirginiaTor 70.164.255.174 9001 0 80
platform Tor 0.2.5.12 on Linux
protocols Link 1 2 Circuit 1
fingerprint 9286 1B98 11A3 8346 91C3 41C9 A934 CC35 355A 80DC
extra-info-digest DBA04FF8688ACB875950FC425B8DB77A54C33B8B
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAMT55gV8I+bRGS+7C8ZjBIQ7IGJN333Na31gEGYq3ffokjRcbHzt9ov7
e5y+y796AEfMsNrytDYFbtU3Mtrce3ZKb0tmQzTU4ktKfRf7CeoTgMzuZv00lqQb
+22/vSpcKU2mhHdzqoynpmvrfGbVzMiouXZNA5TYzxcGPGhY5WbrAgMBAAE=
-----END RSA PUBLIC KEY-----
signing-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAME2FOnQ40JKb6KQOhrTHaTOYvLAoGRTN8QEqOTcYq0iNkOP/OhNg+Nk
XzysACcA6WpNcTjG+LPIBNqYA3Jhojd5gP+XLNCTHRnIfq15UOI8cb/+/xmqD5Tq
VX87UveBoc7oRDaH3ol+gS/sr+87NHsJZUJDnAkwTO8bLYryQmphAgMBAAE=
-----END RSA PUBLIC KEY-----
hidden-service-dir
contact admin[AT]peretsik.info - 132EHw4Qvb3pX2hSnnaph9kU7aBhU959ua
ntor-onion-key AXe4R4gLO1AElijJmo2LdvlGCB2f6bX15JQxszGrqWs=
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject 70.164.255.174:*
accept *:*
_______________________________________________________________

router vitellius 209.133.66.214 9001 0 80
platform Tor 0.2.5.12 on Linux
protocols Link 1 2 Circuit 1
fingerprint 276E 109C 584D 98CA C781 3185 F217 D443 1A26 1F18
extra-info-digest 008BBB1048DC143890B397604D17C25F0872FBD8
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALB1227ZClMg0YnmgZorfmWELpKvdchp5CRycte0GriEaIIjaWr/OiIO
gEeA3DBEnrAGvN4/PhaIKmvM82KV8oHIz/wtqtI/p1Qm8F0cBo9pRvblDswsZpS/
Dpg9rCsZ7TMdEPYhMCCggzPdbnlNjHVJxvH4J/WiTnVQtAaycagtAgMBAAE=
-----END RSA PUBLIC KEY-----
signing-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALPba/HbpVH7sg5EWtCv/I1CzG9j+LTHg+zLpTjkVrFysln0sArOYSwG
gpNZ3Rh+rYA9DAKqTNFeSLTaLrs18gRGJiA38UlWIq3qXF4OtQv2bElRxkSQRVmm
XpcPH8Ep7oFHsYkF2d7ABNP+A31pIP2iWyR7OOtK13x2Y9HqF83XAgMBAAE=
-----END RSA PUBLIC KEY-----
hidden-service-dir
contact admin[AT]tykva.info
ntor-onion-key pDHCLwgaBplFDGla+KHlMAaVHkF3/24HXrzfypHygXU=
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject 209.133.66.214:*
accept *:*
_______________________________________________________________

Anonymous

unread,

Sep 10, 2015, 3:39:23 AM9/10/15

to

dunno

unread,

Sep 12, 2015, 6:17:11 AM9/12/15

to

Apparently they all belong to the same guy.

kartofelzik, kapustik, arbuzik, baklazhanik, peretsik, tykva - these all
are names of vegetables in some Slavic language, probably Ukrainian.

--
dunno

Jack Ryan

unread,

Sep 12, 2015, 5:29:20 PM9/12/15

to

In article <mt0u2t$gnk$1...@news.mixmin.net>
dunno <du...@dunno.dunno> wrote:

>
>Anonymous <nob...@remailer.paranoici.org> wrote:
>>
>> accept *:*
>> _______________________________________________________________
>

>Apparently all 6 honeypots belong to the same LEA.
>

Gee, ya think?

dunno

unread,

Sep 12, 2015, 10:30:59 PM9/12/15

to

I dunno what is LEA.

--
dunno

Harry

unread,

Sep 14, 2015, 3:33:41 AM9/14/15

to

Can you advise on how/where you obtained this information please?
You have the report in parentheses as a citation. It would be
valuable for the straight players in this group.

Thank you

Jeremy Bentham

unread,

Sep 14, 2015, 3:35:52 AM9/14/15

to

In article <e14f1941c81e0c7d...@remailer.cpunk.us>

Damn! How did that happen?

Anonymous

unread,

Sep 14, 2015, 3:48:04 AM9/14/15

to

In article <mt2n51$6a1$1...@news.mixmin.net>

Law

Enforcement

Agency

Not to worry, most cops are dumber than dirt.