UltraSurf observations

CloneRanger · Nov 5, 2010

Almost forgot i had it, so to see what's what lately with it, under SD i launched it. Told me a new version was available U1001.exe which i allowed. Closed down the previous version & relaunched the new.

Visted various dodgy & kosher www's to see what might happen

During both launches i got various alerts/prompts from PG & ZA which i allowed, BUT more interestingly this

I had CurrPorts running for the duration, and here's just a couple to highlight.

118.161.71.52 = China - Expected

65.49.2.27 =

CustName: Sophidea, Inc.
Address: 2710 Thomes Ave
Address: Suite 884
City: Cheyenne
StateProv: WY
PostalCode: 82001
Country: US
RegDate: 2009-11-25
Updated: 2009-11-25
Ref: http://whois.arin.net/rest/customer/C02365956

OrgTechHandle: ZH17-ARIN
OrgTechName: Hurricane Electric
Click to expand...

This IP addresses has been seen by at least one Honey Pot. However, none of its visits have resulted in any bad events yet. It's possible that this IP is just a harmless web spider or Internet user.

http://www.projecthoneypot.org/ip_65.49.2.27
Click to expand...

Re: Perfect Optimizer

There's another interesting thing too. Roughly half of the spam accounts were created from the US netblock 65.49.2.0/24, which has been allocated to a company called Sophidea, Inc. There's hardly any information about the company on the web, but this is not the first spam indicent we've seen from this address block.

http://www.mywot.com/en/forum/6695-perfect-optimizer
Click to expand...

Sophidea .info names odd behavior

Service for those addresses is currently being provided by HE and is SWIP'd to an organization called Sophidea Inc in Cheyenne, WY, apparently headed by a Gerarld Pitts who heads a number of other groups at that street address. With some digging there are a few suspicious cases of Internet activity emanating from affiliated organizations in the past, but its tough to say this is nefarious by association from what I've seen.

https://lists.dns-oarc.net/pipermail/dns-operations/2010-January/004835.html
Click to expand...

Make of it what you will !

Log in or Sign up

UltraSurf observations

CloneRanger Registered Member

Log in or Sign up

UltraSurf observations

CloneRanger Registered Member

Useful Searches