Slightly Shady SEO | Blackhat is Back, Baby.

Ok, so I finally got off my butt and finished part 2 of how to nail down Google’s stealth IPs. Keep in mind, they employ people all over the world to manually check things, but this is a good way to at least make it complicated for them.

Project Files Are Available Here - And Remember to change the SQL Settings in each file, and create the table.

Prequisites(If you Don’t have these, don’t Sweat it. I give my results at the end):

• Ranges.txt (Available in the Project Files It’s our list of IP ranges we’re checking)
• ips.txt (a dump of all the IP addresses that have accessed your site)
• A MySQL Database.
  • The Table Architecture is as Follows:
    CREATE TABLE `gip` (
    `id` int(11) NOT NULL auto_increment,
    `min` bigint(60) default NULL,
    `max` bigint(60) default NULL,
    PRIMARY KEY  (`id`)
    ) ENGINE=MyISAM AUTO_INCREMENT=84 DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci;
• A web server that can access the MySQL Server.

Ok, so you’ve got all that. Time to get scripting.

File 1: sqlInsert.php - Inserts the ranges into our database
<?php
$data=file_get_contents(”./ranges.txt”);
$data=str_replace(”\r”,”",$data);
$spl=explode(”\n”,$data);
$q=”INSERT INTO gip (min,max) VALUES “;
for($i=0; $i<sizeof($spl); $i++)
{
if(strlen($spl[$i])>3)
{
$spl2=explode(”-”,$spl[$i]);//split the IP ranges into min/max values
$min=ip2long($spl2[0]);//convert IP to long
$max=ip2long($spl2[1]);//convert IP to long
if($min===FALSE OR $max===FALSE OR $min==-1 OR $max==-1)//die on failure
{
die(”Error! At index $i”);//Isn’t die such a dramatic sounding function?
      }
else
{
$q=$q.” ($min,$max),”;//Append the new min/max onto our query
}
}
}
$q=trim($q,”,”);//Kill the trailing comma
$link=connectToSQL();
$ret=mysql_query($q);
if(mysql_error() OR !$ret)
{
echo mysql_error();
}
else
{
echo “Done!”;
}
mysql_close($link);
function connectToSQL()
{

$server=”localhost”; //CHANGE THIS TO MATCH YOUR SERVER
$user=”root”;//CHANGE THIS TO MATCH YOUR MYSQL SERVER
$dbName=”test”;//CHANGE THIS TO YOUR DB NAME
$link = mysql_connect(’$server:3306′, $user, ”);
if (!$link)
{
die(”Could not connect In Lib: ” . mysql_error());
}
mysql_select_db($dbName, $link) or die(”Could not select database.”);
return($link);
}
function getSafeString($str)
{
return(”‘”.mysql_real_escape_string($str).”‘”);
}
?>

Alright! So now we Have the IP Ranges Inserted into the Database!
Next, we have to find the ips in our database, see if they’re Google in disguise
File 2: sqlChecker.php - Finds, and outputs our IPs. Google.txt will hold our google IPs at the end.
<?php
$data=file_get_contents(”./ips.txt”);
$data=str_replace(”\r”,”",$data);
$spl=explode(”\n”,$data);
$link=connectToSQL();
$handle=fopen(”./google.txt”,”a+”);
$count=0;
for($i=0; $i<sizeof($spl); $i++)
{
if(strlen($spl[$i])>3)
{
$long=ip2long($spl[$i]);
$q=”SELECT id FROM gip WHERE max>$long AND min<$long LIMIT 1″;
$res=mysql_query($q);
if(mysql_error())
{
die(mysql_error());
}
if(mysql_num_rows($res)>0)
{
$row=mysql_fetch_row($res);
echo $spl[$i].” @”.$row[0].”<br>”;
fwrite($handle, $spl[$i].”\r\n”);
}
$count++;
}
}
echo “Executed “.$count.” Queries<br>”;
fclose($handle);
mysql_close($link);
function connectToSQL()
{
$server=”localhost”;//CHANGE THIS TO MATCH YOUR SERVER
$user=”root”;//CHANGE THIS TO MATCH YOUR SERVER
$db=”test”;//CHANGE THIS TO MATCH YOUR SERVER
$pass=”";//CHANGE THIS TO MATCH YOUR SERVER
$link = mysql_connect($server.”:3306″, $user, $pass);
if (!$link)
{
die(”Could not connect In Lib: ” . mysql_error());
}
mysql_select_db($db, $link) or die(”Could not select database.”);
return($link);
}
function getSafeString($str)
{
return(”‘”.mysql_real_escape_string($str).”‘”);
}
?>

Conclusion:
The more IPs the better. Pool IPs with your friends. Your neighbors. That creepy guy in the bathroom. Anyone with a webserver. Mine examined 18322 IPs, and produced the following list.
64.233.178.136
66.249.84.10
72.14.193.1
72.14.193.129
72.14.194.19
72.14.195.30
74.125.16.1
Those IPs have no Reverse DNS entry, and have examined sites I have owned, without announcing themselves w/ a Reverse DNS entry. They also forge their browser(or are used for manual review, and did not forge)

Have fun!

Posted on Wednesday, November 14th, 2007 at 12:09 pm in the category:cloaking, google, programming, scripts, seo. Comment RSS 2.0 feed. Comment it , or trackback this post.