Hacker News Reader

Comment by madmaze | Hacker News Reader

True this is likely some botnet coordinating where/who the C&C is currently. I wonder if this can be reverse engineered.

EDIT: I wonder if it does some sort of transform on the number to get an IP addr? perhaps its part of a IPv6 Addr?

Perhaps its a distributed brute-force on a password or checksum being carried out by a botnet? Its interesting distributed this is, too bad we dont have IP addrs associated with the posts

View on HN

Interesting to note is that all tweets from https://twitter.com/googuns_staging have random Lat/Long coordinates associated with it..

see: https://twitter.com/googuns_staging/status/22294385659595980...

https://maps.google.com/maps?q=-20.73906235%2C-145.82847672&...

Or perhaps the GPS numbers are not random but do contain 'information'? Perhaps totally unrelated to geolocation?

Perhaps it is a botnet trying to locate all of its clients.

Each client has his/her own UUID(the tweet) and the geolocation is where the client is located.

It seems as though the googuns_staging was the trial, all fake/useless location and googun_prod(as the name suggests) is the actual "in-the-wild" run of locating all of its clients

Also interesting is at the moment there are many tweets ending in either a350000000 or baf200000000 but that may just be coincidence based on some counter thats incrementing

It can't be the geolocation of compromised machines unless some of them happen to be on boats or planes. Some of the geolocation coordinates are in the middle of the ocean.

True, or it could be geolocations that it failed to resolve.. but then again it would likely be the same geolocation for every time it fails to resolve

Reply on news.ycombinator.com