Discussion:
How to decrypt an encrypted IP address
(too old to reply)
Kenyon Ralph
2005-06-22 05:48:19 UTC
Permalink
For example, my IP address is 66.27.125.4 and caringbridge stores it as a
<!-- Remote Addr: df1d96080a58ebc6ec178c04ddfad719-->
<!-- Remote Addr: 24a60c67a905be4c0984590a9cc48c65 -->
Does anyone have any idea how to turn that 32-digit hex number into an IP
address? I've seen IP addresses stored in all sorts of different
representations, but I'm baffled by this one.
MD5SUMs are 32-digit strings like that, but I tried md5sum on your address
and it gives something different. So it's something similar to an md5sum
I'd say. Look at the source code for how it's generated if possible.
rlsusenet@NOSPAMPUHLEEZschnapp.org
2005-06-22 15:15:50 UTC
Permalink
Post by Kenyon Ralph
For example, my IP address is 66.27.125.4 and caringbridge stores it as a
<!-- Remote Addr: df1d96080a58ebc6ec178c04ddfad719-->
<!-- Remote Addr: 24a60c67a905be4c0984590a9cc48c65 -->
Does anyone have any idea how to turn that 32-digit hex number into an IP
address? I've seen IP addresses stored in all sorts of different
representations, but I'm baffled by this one.
MD5SUMs are 32-digit strings like that, but I tried md5sum on your address
and it gives something different. So it's something similar to an md5sum
I'd say. Look at the source code for how it's generated if possible.
This does not appear to be an opensource operation.

Present this directly to CaringBridge, at
http://www.caringbridge.com/contact.htm
MTGuru
2005-06-25 23:08:01 UTC
Permalink
Did you find your answer? Just curious ...

-- MTGuru
Kathy
2005-06-27 18:13:17 UTC
Permalink
Post by MTGuru
Did you find your answer? Just curious ...
I've kind of given up. I did contact caringbridge, but they won't give out
IP addresses or say how they are encrypted, however they will look into any
abuse.

Most guestbook and commenting software ( like haloscan for example) will log
the IP addresses of those who sign and display it to the guestbook owner.
Haloscan will allow the owner to ban or moderate people by IP address.

Caringbridge goes to great lengths to protect the privacy of people who set
up pages by preventing the pages from being indexed and also prevents people
from linking to other caringbridge sites from their site.

It seems like screwy logic to also prevent a site owner from seeing the IP
addresses of people who sign their guestbook. They used to store
unencrypted IP addresses in HTML comments, then they stopped storing any
identifying information at all, so it was possible to sign someone's
guestbook in complete anonymity, now they store encrypted IP addresses .

I poked around for a while also and was unable to find anything.
Caringbridge permits any sort of HTML code in a comment (screwy logic like I
said) so I added an invisible stat counter to this guy's guestbook (with his
knowledge and permission), so if the creepy commenter comes around again,
we'll get his IP address that way.

Thanks all who made suggestions.

- Kathy
Scott Lindner
2005-06-27 22:57:26 UTC
Permalink
I would guess it is a meaningless hash that only their server knows the
meaning of. This is a good thing. It means they take privacy seriously.

There are ways to hunt someone down. You could try some bait to capture his
IP address. But what would you do with the IP? What are your objectives?
Maybe we can help provide suggestions.

Cheers,
Scott
Kathy
2005-06-28 01:11:18 UTC
Permalink
Post by Scott Lindner
There are ways to hunt someone down. You could try some bait to capture
his IP address. But what would you do with the IP? What are your
objectives? Maybe we can help provide suggestions.
He just wants to get an idea if it's somebody he knows or some random
weirdo.

If it's somebody he knows, he'll confront them.

Nobody's going to hunt the creep down or try to take legal action, it's not
that kind of harassment, if it were, he'd report it to caringbridge.

Some people do nasty things when they think they're anonymous.

The stat counter will capture thair email address, unless the harasser is
smart enough to cloak it, but unlikely, this person has signed the guestbook
a number of times already over the last 8 weeks, always with the same
scrambled IP address but with different signatures and email addresses,
trying to represent themselves as different people.

- Kathy

Loading...