Code and data download: git clone https://www.bamsoftware.com/git/sniproxy.git
or snapshot sniproxy-20161220.tar.gz
I found a set of strange HTTP servers that serve a
302 redirect to the nonexistent URL http://dns.auth.fail/.
The servers have many other characteristics in common:
they all run
lighttpd 1.4.35
and many have a similar pattern of open ports.
Despite some investigation,
I was not able to determine the purpose of these hosts
nor any source code referring to "dns.auth.fail".
It looks like these mysterious hosts are VPN proxies of
SimpleTelly or
My Private Network,
which seem to be related services of Global Network Services Ltd.
(both web sites share the same TLS certificate,
SHA-1 fingerprint C7:2B:71:BC:23:5C:82:09:75:AA:C0:8A:C8:DE:2B:AE:3B:19:B3:62).
Kevin Wheal informed me about this possibility.
While investigating
some IP addresses posted to a forum[archive],
he found that some of the hosts in question responded to DNS requests,
and in particular, resolved the name dns.auth.fail to 174.127.126.11,
whose reverse DNS is www.simpletelly.com.
Accessing http://174.127.126.11/ redirects to
https://174.127.126.11/, which then redirects to
https://www.simpletelly.com/.
Accessing http://174.127.126.11/ with a
Host: dns.auth.fail header,
on the other hand, redirects to
https://www.simpletelly.com/client/checkip.php.
(This is what would happen if you had configured one of these
dns.auth.fail hosts as your DNS server, and then tried
to access the HTTP service on the same host.)
The page
https://www.simpletelly.com/client/checkip.php[archive]
displays the client IP address and says
"Check your SimpleTelly setup; This IP is not registered with the system."
The funny name dns.auth.fail seems to be an artifact
of some kind of IP address–based authentication system.
While investigating SNI proxies,
I accidentally found some hosts with strange characteristics
that I am calling "dns.auth.fail" hosts. These hosts:
run lighttpd/1.4.35 on port 80 and serve a redirect to
the nonexistent URL http://dns.auth.fail/
run OpenSSH on port 99
run PPTP on port 1723
run lighttpd/1.4.35 on port 8181, serving either the string OK or the PHP source code checkPID();
run lighttpd/1.4.35 on port 8888, serving either a directory listing or the string PASS;
clicking on the file dns.php in the directory listing returns the string ("PASS");.
One of the SNI proxies in the
GoProxy list,
103.15.187.54, has a strange response when contacted on port 80.
It sends a 302 redirect to the URL http://dns.auth.fail/.
Although the URL http://dns.auth.fail/ does not exist,
.fail is a real TLD since 2014-04:
https://www.iana.org/reports/c.2.9.2.d/20140421-fail
The DNS name dns.auth.fail does not resolve.
However just
auth.fail
is registered through Gandi.net and resolves to 217.70.184.38 (reverse DNS webredir.vip.gandi.net).
There is a parking page at
http://auth.fail/.
I searched the
Project Sonar HTTP data set
dated 20160830 for the "dns.auth.fail" fingerprint. "Project Sonar includes a regular HTTP GET request for all IPv4 hosts with an open 80/TCP."
The input contains 61,683,005 IP addresses.
The search found 2,460 IP addresses
(grepsonar/dns.auth.fail-20160830.txt
in the source code):
Nearly all the hosts have the same pattern of open and closed ports:
PORT STATE SERVICE
80/tcp open http
99/tcp open ssh
113/tcp closed ident
1723/tcp open pptp
8181/tcp open http
8888/tcp open http
A small number of them also have port 443 open:
PORT STATE SERVICE
443/tcp open https
A scan on of only ports
80,443,1723,8888 showed that nearly nearly all hosts had
80,1723,8888 open, but only a small number had 443 open:
PORT STATE SERVICE
2454 80/tcp open http
116 443/tcp open https
2442 1723/tcp open pptp
2441 8888/tcp open http
Another scan on , adding ports 99 and 8181, showed the same pattern, though about 400 hosts had gone offline
since the 2016-09-28 scan:
PORT STATE SERVICE
1983 80/tcp open http
2025 99/tcp open ssh
80 443/tcp open https
1963 1723/tcp open pptp
2020 8181/tcp open http
2000 8888/tcp open http
The X-Powered-By header always starts with
PHP/5.5.9-1ubuntu but the number that follows
ranges from 13 to 19.
This looks like a PHP source code leak.
The delimiter <? is a PHP
"short open tag",
which is not supported by all PHP servers.
The equivalent, universally accepted open tag would be
<?php.
These servers evidently do not have short open tag support,
so they dump the source code
checkPID(); rather than its output OK.
Most of the time, on port 8888 there is a lighttpd directory listing showing one file, dns.php.
The Server header always has the value
lighttpd/1.4.35,
matching a version string in the HTML itself.
The "Last Modified" dates of dns.php range between
and
.
Hosts within a subnet usually have a "Last Modified" time that varies by at most a few minutes, for example
(from webarchive/dns.auth.fail/8888/dns.auth.fail-lastmodified-20160830.txt):
The headers may vary, for example the exact contents of
X-Powered-By, or
Content-Length versus Transfer-Encoding.
Notice the unusual lowercasing in Content-type.
