dnshistory.org contains historical domain -> mappings.
We have not managed to extract much from this source, they don't have as much data on the range of interest.
But they do have some unique data at least, perhaps we should try them a bit more often, e.g. they were the only source we've seen so far that made the association: headlines2day.com -> 212.209.74.126 which places it in the more plausible globalbaseballnews.com IP range.
TODO can it do IP to domain? Or just domain to IP? Asked on their Discord: discord.com/channels/698151879166918727/968586102493552731/1124254204257632377. Their banner suggests that yes:
With our new look website you can now find other domains hosted on the same IP address, your website neighbours and more even quicker than before.
Owner replied, you can't:
At the moment you can only do this for current not historical records
In principle, we could obtain this data from search engines, but Google doesn't track that entire website well, e.g. no hits for
site:dnshistory.org "62.22.60.48" presumably due to heavy IP throttling.Homepage dnshistory.org/ gives date starting in 2009:and it is true that they do have some hits from that useful era.
Here at DNS History we have been crawling DNS records since 2009, our database currently contains over 1 billion domains and over 12 billion DNS records.
Any data that we have the patience of extracting from this we will dump under github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/hits.json.
To test it, let's get two computers on the same local area network, e.g. connected to Wi-Fi on the same home modem router.
On computer B:
- find computer IP with the
ipCLI tool. Suppose it is 192.168.1.102 - then run Ciro's
ncHTTP test server
Output on terminal 1:TODO understand them all! Possibly correlate with Wireshark, or use
17:14:22.017001 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [S], seq 2563867413, win 64240, options [mss 1460,sackOK,TS val 303966323 ecr 0,nop,wscale 7], length 0
17:14:22.073957 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [S.], seq 1371418143, ack 2563867414, win 65160, options [mss 1460,sackOK,TS val 171832817 ecr 303966323,nop,wscale 7], length 0
17:14:22.074002 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 303966380 ecr 171832817], length 0
17:14:22.074195 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [P.], seq 1:82, ack 1, win 502, options [nop,nop,TS val 303966380 ecr 171832817], length 81
17:14:22.076710 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [P.], seq 1:80, ack 1, win 510, options [nop,nop,TS val 171832821 ecr 303966380], length 79
17:14:22.076710 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [.], ack 82, win 510, options [nop,nop,TS val 171832821 ecr 303966380], length 0
17:14:22.076727 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [.], ack 80, win 502, options [nop,nop,TS val 303966383 ecr 171832821], length 0
17:14:22.077006 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [F.], seq 82, ack 80, win 502, options [nop,nop,TS val 303966383 ecr 171832821], length 0
17:14:22.077564 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [F.], seq 80, ack 82, win 510, options [nop,nop,TS val 171832821 ecr 303966380], length 0
17:14:22.077578 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [.], ack 81, win 502, options [nop,nop,TS val 303966384 ecr 171832821], length 0
17:14:22.079429 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [.], ack 83, win 510, options [nop,nop,TS val 171832824 ecr 303966383], length 0-A option to dump content. CIA 2010 covert communication websites 2013 DNS census SOA records by 
Ciro Santilli 40 Updated 2025-07-16
Ciro Santilli 40 Updated 2025-07-16Same as 2013 DNS census NS records basically, nothing came out.
Amazing tool that captures packets and disassembles them. Allows you to click an interactive tree that represents Ethernet, TCP/IP and application layer like HTTP.
Start capture immediately from CLI, capture packets to/from 192.168.1.102:
sudo wireshark -f 'host 192.168.1.102' -kwww-pnp.physics.ox.ac.uk/~barra/teaching.shtml As of 2023, contains some good 2015 materials: web.archive.org/web/20220525094139/http://www-pnp.physics.ox.ac.uk/~barra/teaching.shtml It was called "Subatomic physics" back then.
2015 professor: Alan J. Barr.
Possible 2022 professor: Guy Wilkinson (unconfirmed): www.chch.ox.ac.uk/staff/professor-guy-wilkinson
Capture by instead:
sudo wireshark -f http -k
sudo wireshark -f icmp -kFilter by both protocol and host:
sudo wireshark -f 'host 192.168.1.102 and icmp' -kFor application layer capture filtering, the best you can do is by port:There is an
sudo wireshark -f 'tcp port 80'http filter but only for as a wireshark display filter CIA 2010 covert communication websites 2013 DNS census MX records by Ciro Santilli 40 Updated 2025-07-16
Ciro Santilli 40 Updated 2025-07-16Let' see if there's anything in records/mx.xz.
mx.csv is 21GB.
They do have
" in the files to escape commas so:mx.pyWould have been better with csvkit: stackoverflow.com/questions/36287982/bash-parse-csv-with-quotes-commas-and-newlines
import csv
import sys
writer = csv.writer(sys.stdout)
with open('mx.csv', 'r') as f:
reader = csv.reader(f)
for row in reader:
writer.writerow([row[0], row[3]])then:
# uniq not amazing as there are often two or three slightly different records repeated on multiple timestamps, but down to 11 GB
python3 mx.py | uniq > mx-uniq.csv
sqlite3 mx.sqlite 'create table t(d text, m text)'
# 13 GB
time sqlite3 mx.sqlite ".import --csv --skip 1 'mx-uniq.csv' t"
# 41 GB
time sqlite3 mx.sqlite 'create index td on t(d)'
time sqlite3 mx.sqlite 'create index tm on t(m)'
time sqlite3 mx.sqlite 'create index tdm on t(d, m)'
# Remove dupes.
# Rows: 150m
time sqlite3 mx.sqlite <<EOF
delete from t
where rowid not in (
select min(rowid)
from t
group by d, m
)
EOF
# 15 GB
time sqlite3 mx.sqlite vacuumLet's see what the hits use:
awk -F, 'NR>1{ print $2 }' ../media/cia-2010-covert-communication-websites/hits.csv | xargs -I{} sqlite3 mx.sqlite "select distinct * from t where d = '{}'"At around 267 total hits, only 84 have MX records, and from those that do, almost all of them have exactly:with only three exceptions:We need to count out of the totals!which gives, ~18M, so nope, it is too much by itself...
smtp.secureserver.net
mailstore1.secureserver.netdailynewsandsports.com|dailynewsandsports.com
inews-today.com|mail.inews-today.com
just-kidding-news.com|just-kidding-news.comsqlite3 mx.sqlite "select count(*) from t where m = 'mailstore1.secureserver.net'"Let's try to use that to reduce where
av.sqlite from 2013 DNS Census virtual host cleanup a bit further:time sqlite3 mx.sqlite '.mode csv' "attach 'aiddcu.sqlite' as 'av'" '.load ./ip' "select ipi2s(av.t.i), av.t.d from av.t inner join t as mx on av.t.d = mx.d and mx.m = 'mailstore1.secureserver.net' order by av.t.i asc" > avm.csvavm stands for av with mx pruning. This leaves us with only ~500k entries left. With one more figerprint we could do a Wayback Machine CDX scanning scan.Let's check that we still have most our hits in there:At 267 hits we got 81, so all are still present.
grep -f <(awk -F, 'NR>1{print $2}' /home/ciro/bak/git/media/cia-2010-covert-communication-websites/hits.csv) avm.csvsecureserver is a hosting provider, we can see their blank page e.g. at: web.archive.org/web/20110128152204/http://emmano.com/. security.stackexchange.com/questions/12610/why-did-secureserver-net-godaddy-access-my-gmail-account/12616#12616 comments:
secureserver.net is the name GoDaddy use as the reverse DNS for IP addresses used for dedicated/virtual server hosting
CIA 2010 covert communication websites 2013 DNS Census virtual host cleanup heuristic keyword searches by Ciro Santilli 40 Updated 2025-07-16
Ciro Santilli 40 Updated 2025-07-16There are two keywords that are killers: "news" and "world" and their translations or closely related words. Everything else is hard. So a good start is:
grep -e news -e noticias -e nouvelles -e world -e globaliran + football:
- iranfootballsource.com: the third hit for this area after the two given by Reuters! Epic.
3 easy hits with "noticias" (news in Portuguese or Spanish"), uncovering two brand new ip ranges:
- 66.45.179.205 noticiasporjanua.com
- 66.237.236.247 comunidaddenoticias.com
- 204.176.38.143 noticiassofisticadas.com
Let's see some French "nouvelles/actualites" for those tumultuous Maghrebis:
- 216.97.231.56 nouvelles-d-aujourdhuis.com
news + global:
- 204.176.39.115 globalprovincesnews.com
- 212.209.74.105 globalbaseballnews.com
- 212.209.79.40: hydradraco.com
OK, I've decided to do a complete Wayback Machine CDX scanning of
news... Searching for .JAR or https.*cgi-bin.*\.cgi are killers, particularly the .jar hits, here's what came out:- 62.22.60.49 telecom-headlines.com
- 62.22.61.206 worldnewsnetworking.com
- 64.16.204.55 holein1news.com
- 66.104.169.184 bcenews.com
- 69.84.156.90 stickshiftnews.com
- 74.116.72.236 techtopnews.com
- 74.254.12.168 non-stop-news.net
- 193.203.49.212 inews-today.com
- 199.85.212.118 just-kidding-news.com
- 207.210.250.132 aeronet-news.com
- 212.4.18.129 sightseeingnews.com
- 212.209.90.84 thenewseditor.com
- 216.105.98.152 modernarabicnews.com
"headline": only 140 matches in 2013-dns-census-a-novirt.csv and 3 hits out of 269 hits. Full inspection without CDX led to no new hits.
www-thphys.physics.ox.ac.uk/people/AndreiStarinets/sr_mt_2022.html (archive) contains 2022 problem sets and notes, well done Mr Andrei Starinets!
- foreign keys are capitalized:
- you must give
foreignKeywhen using aliases, otherwise it fails subtely. That would be derived automatically. - stackoverflow.com/questions/41502699/return-flat-object-from-sequelize-with-association can't auto-flatten to reuse the database's
ORDER limitandoffsetdon't work withoutsubQuery: falsewhen doing includes! It is just too buggy. Examples of this can be found e.g. under nodejs/sequelize/many_to_many_same_model.js.- stackoverflow.com/questions/34059081/how-do-i-reference-an-association-when-creating-a-row-in-sequelize-without-assum hard to not duplicate foreign keys values everywhere
- stack traces permanently broken or requiring non-obvious configs:
- does not automatically update fields on hooks: github.com/sequelize/sequelize/issues/8586#issuecomment-422877555
- cannot change columns when other columns have constraints due to the backup table?
- you have to use
.get()forattributealiased fields, why? stackoverflow.com/questions/32649218/how-do-i-select-a-column-using-an-alias/69890944#69890944 .idgets added toSELECTno matter what, breakingGROUP BYunless you do horrible workarounds:- no simple built-in mechanism for transaction retries: Sequelize transaction retries
- impossible to do subqueries in general. Docs just tell you to use literals. This in particular prevents single query deletes with join as done at nodejs/sequelize/raw/many_to_many.js:Also, you can't get query strings either: github.com/sequelize/sequelize/issues/2325
- sequelize.org/master/manual/sub-queries.html: the docs actually just tell you to use literals, lol
- stackoverflow.com/questions/45354001/nodejs-sequelize-delete-with-nested-select-query
- migrations. Generally speaking, anything but the simplest migrations are exceedingly hard to get right, as you have to go very low level when doing migrations. Syntax can be very different from regular DB operations.
- no way to do (non-raw) queries during migrations, e.g. to update fields based on other fields in a complex way?
- github.com/sequelize/cli/issues/862
- stackoverflow.com/questions/18742962/add-data-in-sequelize-migration-script
- stackoverflow.com/questions/38671483/sequelize-migration-update-model-after-updating-column-attributes
- stackoverflow.com/questions/38998397/can-i-use-sequelize-models-in-migration-scripts
- stackoverflow.com/questions/45286429/custom-query-on-sequelize-seeder
queryInterface.sequelize.modelscontains onlySequelizeMeta. Not sure why they have this limitation. - stackoverflow.com/questions/56043246/node-js-sequelize-no-primary-keys-when-migrating/56046101#56046101
- SQLite
changeColumnmigrations do on delete cascades of other tables. SQLite does not have change column statements, so they have to drop and recreate tables, but they don't temporarily remove cascades, so you lose data: stackoverflow.com/questions/62667269/sequelize-js-how-do-we-change-column-type-in-migration/70486686#70486686 - associations require full explicit index construction: stackoverflow.com/questions/39651853/how-to-create-join-table-with-foreign-keys-with-sequelize-or-sequelize-cli
- ability to iterate over a large result without blowing up memory and without using limit + offset (which is inneficient e.g. when looping over recursive queries). This is also known as cursor or streaming interfaces:E.g. the Python SQLite interface supports this just fine: stackoverflow.com/questions/29582736/python3-is-there-a-way-to-iterate-row-by-row-over-a-very-large-sqlite-table-wi
- stack overflow
- stackoverflow.com/questions/28787889/how-can-i-set-up-sequelize-js-to-stream-data-instead-of-a-promise-callback
- stackoverflow.com/questions/43964067/how-to-implement-cursor-pagination-using-sequelize
- stackoverflow.com/questions/57164242/perform-sequelize-findall-in-a-huge-array
- stackoverflow.com/questions/55191891/how-to-loop-through-result-in-sequelize generic loop
- issue tracker
- stack overflow
- empty
attributes: []breaks some nested queries: github.com/sequelize/sequelize/issues/16436 - does not expose a iteration API that supports large arrays?E.g. Python SQLite does: stackoverflow.com/questions/29582736/python3-is-there-a-way-to-iterate-row-by-row-over-a-very-large-sqlite-table-wi
TODO didn't manage to get it working with TP Link ARCHER VR2800 even though it shows DHCP as enabled and it also shows MAC addresses and corresponding hostnames in the router management interface.
CIA 2010 covert communication websites 2013 DNS Census virtual host cleanup by Ciro Santilli 40 Updated 2025-07-16
Ciro Santilli 40 Updated 2025-07-16We've noticed that often when there is a hit range:and that this does not seem to be that common. Let's see if that is a reasonable fingerprint or not.
- there is only one IP for each domain
- there is a range of about 20-30 of those
Note that although this is the most common case, we have found multiple hits that viewdns.info maps to the same IP.
First we create a table The
u (unique) that only have domains which are the only domain for an IP, let's see by how much that lowers the 191 M total unique domains:time sqlite3 u.sqlite 'create table t (d text, i text)'
time sqlite3 av.sqlite -cmd "attach 'u.sqlite' as u" "insert into u.t select min(d) as d, min(i) as i from t where d not like '%.%.%' group by i having count(distinct d) = 1"not like '%.%.%' removes subdomains from the counts so that CGI comms are still included, and distinct in count(distinct is because we have multiple entries at different timestamps for some of the hits.Let's start with the 208 subset to see how it goes:OK, after we fixed bugs with the above we are down to 4 million lines with unique domain/IP pairs and which contains all of the original hits! Almost certainly more are to be found!
time sqlite3 av.sqlite -cmd "attach 'u.sqlite' as u" "insert into u.t select min(d) as d, min(i) as i from t where i glob '208.*' and d not like '%.%.%' and (d like '%.com' or d like '%.net') group by i having count(distinct d) = 1"This data is so valuable that we've decided to upload it to: archive.org/details/2013-dns-census-a-novirt.csv Format:The numbers of the first column are the IPs as a 32-bit integer representation, which is more useful to search for ranges in.
8,chrisjmcgregor.com
11,80end.com
28,fine5.net
38,bestarabictv.com
49,xy005.com
50,cmsasoccer.com
80,museemontpellier.net
100,newtiger.com
108,lps-promptservice.com
111,bridesmaiddressesshow.comTo make a histogram with the distribution of the single hostname IPs:Which gives the following useless noise, there is basically no pattern:
#!/usr/bin/env bash
bin=$((2**24))
sqlite3 2013-dns-census-a-novirt.sqlite -cmd '.mode csv' >2013-dns-census-a-novirt-hist.csv <<EOF
select i, sum(cnt) from (
select floor(i/${bin}) as i,
count(*) as cnt
from t
group by 1
union
select *, 0 as cnt from generate_series(0, 255)
)
group by i
EOF
gnuplot \
-e 'set terminal svg size 1200, 800' \
-e 'set output "2013-dns-census-a-novirt-hist.svg"' \
-e 'set datafile separator ","' \
-e 'set tics scale 0' \
-e 'unset key' \
-e 'set xrange[0:255]' \
-e 'set title "Counts of IPs with a single hostname"' \
-e 'set xlabel "IPv4 first byte"' \
-e 'set ylabel "count"' \
-e 'plot "2013-dns-census-a-novirt-hist.csv" using 1:2:1 with labels' \
;users.physics.ox.ac.uk/~lvovsky/B3/ contain assorted PDFs from between 2015 and 2019
Syllabus reads:
- Multi-electron atoms: central field approximation, electron configurations, shell structure, residual electrostatic interaction, spin orbit coupling (fine structure).
- Spectra and energy levels: Term symbols, selection rules, X-ray notation, Auger transitions.
- Hyperfine structure; effects of magnetic fields on fine and hyperfine structure. Presumably Zeeman effect.
- Two level system in a classical light field: Rabi oscillations and Ramsey fringes, decaying states; Einstein
- A and B coefficients; homogeneous and inhomogeneous broadening of spectral lines; rate equations.
- Optical absorption and gain: population inversion in 3- and 4-level systems; optical gain cross section; saturated absorption and gain.
Professor in 2000s seems to beBut as of 2023 marked emeritus, so who took over?
- en.wikipedia.org/wiki/Paul_Ewart. He actually fought not to be dismissed by age and won!
- www.physics.ox.ac.uk/our-people/ewart
Ewart is actually religious:This dude is pure trouble for Oxford!
- www.youtube.com/watch?v=aulL-Qa65i0 Paul Ewart, Chance, Science and Spirituality by Faraday Institute for Science and Religion. Oh, he is/was actually chairman of that crap
- www.youtube.com/watch?v=PVX2F4XvGYo Chaos and the Character of God by Prof. Paul Ewart
Undated materials Ewart:
- users.physics.ox.ac.uk/~ewart/index.htm
- users.physics.ox.ac.uk/~ewart/Atomic%20Physics%20lecture%20notes%20C%20port.pdf
- slides: users.physics.ox.ac.uk/~ewart/Atomic%20Physics%20Lecture%20PPT%20slides%201_8.pdf. Also under: www2.physics.ox.ac.uk/sites/default/files/2011-10-19/atomic_physics_lectures_1_8_09_pdf_pdf_18283.pdf. The course was previously B1, they just change the IDs randomly from time to time to fit the B1-7 numbering.
Connect two computers directly without a router with an Ethernet cable by Ciro Santilli 40 Updated 2025-07-16
Ciro Santilli 40 Updated 2025-07-16For IP-level communication, askubuntu.com/questions/22835/how-to-network-two-ubuntu-computers-using-ethernet-without-a-router/116680#116680 just worked between P51 and P14s both on Ubuntu 23.10 connected with a regular Cat 5e cable.
On both machines, first we found the Ethernet cable interface name with the which outputs on the P41s:so the interface was
ip CLI tool:ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp1s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether fc:5c:ee:24:fb:b4 brd ff:ff:ff:ff:ff:ff
3: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 04:7b:cb:cc:1b:10 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.123/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp2s0
valid_lft 61284sec preferred_lft 61284sec
inet6 fe80::3597:15d8:74ff:e112/64 scope link noprefixroute
valid_lft forever preferred_lft foreverenp1s0f0, because wlp is wireless and lo is localhost.So on the P14s we assign an IP of 10.0.0.10 to the P51:
sudo ip address add 10.0.0.10/24 dev enp1s0f0Then on the P51 analogously, giving IP of 10.0.0.20 to the P14s:
sudo ip address add 10.0.0.20/24 dev enp0s31f6And after that, P14s can:and P51 can:
ping 10.0.0.10ping 10.0.0.20 Pinned article: Introduction to the OurBigBook Project
Welcome to the OurBigBook Project! Our goal is to create the perfect publishing platform for STEM subjects, and get university-level students to write the best free STEM tutorials ever.
Everyone is welcome to create an account and play with the site: ourbigbook.com/go/register. We belive that students themselves can write amazing tutorials, but teachers are welcome too. You can write about anything you want, it doesn't have to be STEM or even educational. Silly test content is very welcome and you won't be penalized in any way. Just keep it legal!
Intro to OurBigBook
. Source. We have two killer features:
- topics: topics group articles by different users with the same title, e.g. here is the topic for the "Fundamental Theorem of Calculus" ourbigbook.com/go/topic/fundamental-theorem-of-calculusArticles of different users are sorted by upvote within each article page. This feature is a bit like:
- a Wikipedia where each user can have their own version of each article
- a Q&A website like Stack Overflow, where multiple people can give their views on a given topic, and the best ones are sorted by upvote. Except you don't need to wait for someone to ask first, and any topic goes, no matter how narrow or broad
This feature makes it possible for readers to find better explanations of any topic created by other writers. And it allows writers to create an explanation in a place that readers might actually find it.
Figure 1. Screenshot of the "Derivative" topic page. View it live at: ourbigbook.com/go/topic/derivativeVideo 2. OurBigBook Web topics demo. Source. - local editing: you can store all your personal knowledge base content locally in a plaintext markup format that can be edited locally and published either:This way you can be sure that even if OurBigBook.com were to go down one day (which we have no plans to do as it is quite cheap to host!), your content will still be perfectly readable as a static site.
- to OurBigBook.com to get awesome multi-user features like topics and likes
- as HTML files to a static website, which you can host yourself for free on many external providers like GitHub Pages, and remain in full control
Figure 3. Visual Studio Code extension installation.
Figure 4. Visual Studio Code extension tree navigation.
Figure 5. Web editor. You can also edit articles on the Web editor without installing anything locally.Video 3. Edit locally and publish demo. Source. This shows editing OurBigBook Markup and publishing it using the Visual Studio Code extension.Video 4. OurBigBook Visual Studio Code extension editing and navigation demo. Source. 
- Infinitely deep tables of contents:
All our software is open source and hosted at: github.com/ourbigbook/ourbigbook
Further documentation can be found at: docs.ourbigbook.com
Feel free to reach our to us for any help or suggestions: docs.ourbigbook.com/#contact