YiffyLeaks Discussion

[jurann]

I want to talk about YiffyLeaks here

Comments

[teddytiger]

Huh, if you go to just Malicelabs.com, it's still up and about. My guess is your assumption about it being a ploy is correct, it's just a JPG file, nothing else.

[jurann]

There's some weirdness going on with the webserver though on the Yiffyleaks site, if you do some poking at a lower level. I did some manual HTTP GET requests over telnet to that server without using any client headers and got some typical Apache responses for a "site temporarily unavailable", but when you do an HTTP request with full client headers you wind up getting a generic, non-headered response back with the DOJ seizure thing. It's totally possible to hack Apache to give that kind of response, but it FEELS more like a brute-force traffic-level override. The thing that doesn't make sense is why you only get it when you supply valid client headers and not otherwise. Point is, in the end, all we can do is speculate. But it's still weird.

I'm hoping that YiffyLeaks comes back up, because the messages are terribly fascinating and revealing.

Re: *shrugs*

[jurann]

I'm not interested in "moving on" until I feel that folks have had a chance to discuss the angles openly and get thoughts and notions off their chests. I'm not even sure what *I* personally make of it yet, so I'd like to discuss it until the horse is at least dying, if not cold stone dead

[wolfwings]

The 'yiffyleaks' seizure is bogus, Arcturus just yanked the site down due to traffic/web-server load and slapped that up to stop people rooting around much/at all. I say that because of a couple things:

1. Such seizures take an entire TLD, not a sub-domain. MaliceLabs.com is still functioning correctly. This example of an actual seized domain will show you what I mean. They take the whole TLD and wildcard the hell out of it.


2. The site's IP hasn't changed to http://74.81.170.110 which is the actual 'seizure parking' IP address used by the US federal government.


3. He didn't actually make it post a tag in the HTML page returned now. Another 'derp, wrong web-code' moment that ties into the below as to where he sourced the image/page-source from:


4. Finally, the image he used is a well-known fake that was created by FilesPump.com several months back. Note the incorrect legalese and use of the master U.S. Immigrations and Customs Enforcement badge instead of the correct sub-branch Homeland Security Investigations which deals with actual customs-

[jurann]

Excellent information, thank you VERY much for dropping this in here. =D A lot of folks have suspected it's a hoax either to draw attention or curtail bandwidth usage, though I personally admit it's a pretty good idea. Maybe I should offer to host it on my servers for a while. ;D

[funkicarus]

but wolfwings, this isn't nearly dramatic enough! how are they going to drag this out for three more days making a big deal out of something that's just an admin being an admin!

[wolfwings]

Yeah, I know, right? *laughs* I'm just explaining this to rumor-squash with a sledgehammer, mostly. Just like I'm laughing at the folks panic-deleting their notes, and all that. It's amusing to me. =^.^=

[jaffa_tamarin]

I like pie.

[wolfwings]

Have a kilodigit of it then! =^.^=3.141592653589793238462643383279502884197169399375

[jurann]

Um... I think he meant pi*e, not plain pi. ;D Then again, his equation's not entirely clear, and I'm not sure what liking an equation has to do with expression or practical use of any equation. ;)