CIA-exposer Daniel Brandt's websites-Gone, blocked, no cache

[Hugh Manatee Wins]

Suddenly Daniel Brandt's websites are not found. No search engine caches, either. Google hates the man.

He's been creating databases of spooks for years.
Also exposing Google as a spook house while offering a way to search
without having your searches archived at Google.

Try to find-

CIA on Campus... http://www.cia-on-campus.org/
Google Watch... http://www.google-watch.org/
NameBase... http://www.namebase.org/
Scroogle... http://www.scroogle.org/
Wikipedia Watch... http://www.wikipedia-watch.org/

[AhabsOtherLeg]

"Sorry.

This URL has been excluded from the Wayback Machine."


Not good at all. Is there any news on where the man himself is? He surely has back-ups of everything, but have they raided or arrested him or something? It's frightening.

[Hugh Manatee Wins]

Right. The Wayback Archive is also purged.

This is it, folks. The internet vs the space-age Gestapo has gone to a new level.
Stop mucking about and archive what you can on the CIA (all spooks) and information control.

[Hugh Manatee Wins]

A taste of what Brandt has been doing for years online..

http://en.wikipedia.org/wiki/NameBase

NameBase is a web-based cross-indexed database of names that focuses on individuals involved in the international intelligence community, U.S. foreign policy, crime, and business. The focus is on the post-World War II era and on left of center, conspiracy theory, and espionage activities.[1]
Founder Daniel Brandt collected clippings and citations pertaining to influential people and intelligence from 500 investigative books published since 1962 and thousands of periodicals since 1973.[1]
In the 1980s, through his company Micro Associates, he sold subscriptions to this computerized database, under its original name, Public Information Research, Inc (PIR). At PIR's onset, Brandt was President of the newly formed non-profit corporation and investigative researcher, Peggy Adler, served as its Vice President. The material was described as "information on all sorts of spooks, military officials, political operators and other cloak-and-dagger types."[2] He told The New York Times at the time that "many of these sources are fairly obscure so it's a very effective way to retrieve information on U.S. intelligence that no one else indexes."[3] One research librarian calls it "a unique part of the 'Deep Web'", equally useful to investigative journalists and students.[4]
By 1992, private citizens, news organizations, and universities all were using NameBase.[5] In 1995, these efforts became the basis of the NameBase website.[6] As of 2003, the database contained "over 100,000 names with over 260,000 citations drawn from books and serials with a few documents obtained under the Freedom of Information Act."[7] The website is structured so that users can follow hyperlinked information "and thus uncover potential relationships or connections between individuals and groups".[4] The way this is formatted on the website is referred to as a social network and, though the user has to click further to actually determine the relationship between names on a given social network, as they are not specifically listed, NameBase was described by Paul B. Kantor as being the "only web-based tool readily available for visualizing social networks of terrorism researchers."[8]

[eyeno]

From what I understand you can still get to sites that have been dns de-listed if you know the exact ip numbers? How do you go about getting the exact ip numbers for a site? For instance, I would not know how to determine RI ip number if it disappeared. How does all that work?

[barracuda]

Link

Starting in the middle of December 2011, my servers got DDoSed by what I believe were Friends of Ryan Cleary (FoRC). Cleary himself is electronically tagged, under curfew at his mother's house (he must be accompanied by his mother if he leaves the house outside of curfew), and forbidden from using the Internet. Those are his bail conditions since last June. However, what if his girlfriend came over with a little laptop with a wireless Internet connection, stuffed in a backpack? What if Ryan picked up the telephone or wrote letters? I don't have much more than circumstantial evidence, but I believe it was FoRC that DDoSed my servers. Cleary or some friends of his may have hired someone to attack me.

The DDoS was heavy when it happened. All six servers were attacked at various times, and all were disconnected by my two different service providers when they were attacked. The mode of attack was a SYN flood. I caught thousands of SYN_RECV requests at various times in the TCP process table. Typically, the load would instantly jump from below 0.50 to about 90.0 and the server was out of action. Then after the DDoS subsided within an hour or so, the load would slowly recover and I could get into the box and see all the SYN_RECV I had caught via a cron job that runs once a minute. The IP addresses sending these were either from a botnet or they were spoofed. In other words, they were from all over the world, and there were hundreds of unique IP addresses. This was not one person with LOIC.

My two service providers disconnected my servers when they saw this. In December I was able to beg them to restore connectivity to me within a few days. There was one provider in Arizona with two dedicated servers that I leased, and another in Florida with four servers that I leased. I took wikipedia-watch.org down in December because I thought this was FoRC's target and they would leave me alone if it was gone.

Taking wikipedia-watch.org down did not stop the DDoS efforts. On January 17 the Florida provider disconnected all four servers, because the DDoS that just hit the four was so massive that it took down upstream switches. They had to consider their other customers on those switches who went down due to collateral damage. I tried begging, but they wouldn't reconnect my servers. They never want to hear from me again, and wouldn't refund $200 that was paid in advance on those servers. They were mad as hell.

It was clear by now that I was the target, and not just wikipedia-watch. The SYN_RECV that I captured in December showed that Scroogle IP addresses were targeted, and sometimes any other open port.

For seven years, I have been running Scroogle on those six servers. Now Scroogle is crippled because I have to run it on the two remaining servers. It's probably just a matter of time before those two are taken away from me. The thing about those six servers is that three were blocked in 2007 by Google, and the other three blocked in 2008 by Google. Each time an engineer at Google got them unblocked for me because I was running a nonprofit service and didn't show any ads. The second time he did this, he mentioned that it was getting hard for him to pull this off. (Each of my six servers appears at Google under a single IP address for that server. That's the way it works with dedicated servers for outgoing traffic. For incoming traffic, you can point them to various IPs assigned to your server.)

From 2009 to March 2011 I had no problems with Google blocks. It helped that I used up to 9,000 dedicated Google IP addresses on a random basis, spanning as many as 80 Google data centers. During that period Google had no centralized detection and throttling system. In March 2011 this changed, and after a one-minute delay, Google could detect and throttle a single IP address that had been fetching search results, even though I was randomly spreading out the requests from each server using 9,000 Google IP addresses. That throttling was not too severe — it lasted about two minutes. When it happened, I did an instant failover to a different server for those throttled requests.

At the end of last December, I leased a seventh server because I knew Scroogle was in trouble. It turned out that this new IP address was throttled much more severely than the six IP addresses from my six legacy Scroogle servers. Adding more servers is not a solution. While it takes about fifteen minutes to trip, this second form of throttling lasts for 90 minutes after the requests stop instead of just two minutes. The four servers in Florida had "legacy" IP addresses attached to them, and now they're gone forever. The load shifts to the two remaining Arizona servers with legacy IP addresses, which cannot handle the load during daytime hours.

Scroogle has gone from 350,000 searches per day to about 200,000 per day. I blame Friends of Ryan Cleary. For the attempted searches that don't go through, I show a screen blaming Google. After all, if Google hadn't started this "mild" form of throttling in March 2011, I could handle the load on two servers instead of six.

The entire Internet infrastructure is in trouble because the design did not anticipate DDoS attacks. You cannot do anything about a SYN flood attack that is halfway sophisticated, and uses many unique IPs, either from a botnet or spoofed. You need a hardware firewall in front of your server that has a huge amount of bandwidth, just so it can filter out the attack based on some sort of analysis that differentiates the malicious packets. That sort of capability costs a lot more than leasing the server itself.

[jingofever]

"Sorry.

This URL has been excluded from the Wayback Machine."

Removing Documents From the Wayback Machine. He probably did it himself.

[wordspeak2]

Why on Earth would he do that?

[jingofever]

Why on Earth would he do that?

I don't know, but he does it.

[wordspeak2]

Hmm.

I found this:

Uploaded by DanielBrandtWatch on May 25, 2011
http://wiki.lulzenterprises.org/index.p ... iel_Brandt

http://danielbrandtwikipedia.blogspot.com/

Daniel Leslie Brandt is a 1-trick pony whose specialty is doxing people who use their real name on the internet. He has excelled in the fine art of being able to dish it out, but not take it. The resident e-detective of The Wikipedia Review, Brandt has a wide range of experience in internet stalking and e-psychiatry. According to rumors on the internets, Wikipedia plans to file a lawsuit against Brandt for violating the privacy of Wikipedia admins by unearthing private information posted by those admins through the simple means of a scroogle search, and re-publishing it on other websites. Power word: Daniel Leslie Brandt Age: 63 DOB: 12/23/1947 Height: 6'0" Weight: "Some extra baggage" Address: 7791 Woodchase Apt 1508 San Antonio, TX 78240 (Richland Chase Apartments) Company name: Public Information Research Company address: PO Box 680635 San Antonio, TX 78268-0635 (Translation: I run my business from home.) Company phone number: 210-509-3160 Known e-mail addresses: pir@lavabit.com, jevers.ceo@gmail.com, dbrandt@crl.com

[jingofever]

Removing Documents From the Wayback Machine. He probably did it himself.

I assume he does the same thing with Google.

[Hugh Manatee Wins]

Removing Documents From the Wayback Machine. He probably did it himself.

I assume he does the same thing with Google.

Yes. Some posts allegedly by Daniel Brandt about staying out of the internet Archive website due to lawsuit issues.

But NOT his own front-door websites exposing spook information manipulation.
Which is what runs the planet since WWII.

AND. CIA-National Public Radio (domestic Voice of America psyops) put this show on this weekend about "disappearing" -
http://ttbook.org/book/how-disappear-completely

02.19.2012
(was 02.13.2011)
Have you ever thought about disappearing... wiping out your old identity and starting fresh, with a new name, a new life, a new self? In this hour we try to find out how to disappear completely. You too can vanish without a trace!

I've posted recently about this psynema product (keywords from Congressional hearings on Waco ATF fire murders) and National Propaganda Radio just included the FBI's witness protection program in today's show-

[Hugh Manatee Wins]

Repeating.

CIA-NPR: "You too can vanish without a trace!"

Gawd bless.

[AhabsOtherLeg]

Removing Documents From the Wayback Machine. He probably did it himself.

I assume he does the same thing with Google.

I knew he'd fought long and hard to have his personal Wikipedia entry removed, and I can sort of understand him blocking the Wayback Machine if he distrusts it for some reason - but why take down his own sites?

Google really must hate him. Encyclopedia Dramatica is now the first result for his name, and nobody would want that.

[psynapz]

From what I understand you can still get to sites that have been dns de-listed if you know the exact ip numbers? How do you go about getting the exact ip numbers for a site?

Overexplained below. In the case of Brandt's sites, he or someone has edited each domain's DNS zone to remove the "A" record that would give you an IP address for the site, so all his domains are still in existence (and all but scroogle.org had its registration renewed for another year just last month), but they're all neutered to remove the IP address.

There is a project to store historical DNS data:

http://dnshistory.org/

but for scroogle.org, the 2 IP addresses it has on record aren't working either:

http://67.199.36.108/
http://65.111.175.201/

So unless anyone happens to have noted the last IP address for scroogle.org before this happened, we're shit out of luck.

For instance, I would not know how to determine RI ip number if it disappeared. How does all that work?

Windows: Start Menu -> type "cmd" into search box, hit return. DOS window appears. Type "nslookup rigorousintuition.ca" and hit return. It's the last IP address in the output.

Mac: Cmd-space, type "Terminal", hit return to open a Terminal window. Type either "nslookup rigorousintuition.ca" or "dig rigorousintuition.ca" and look for the line with "rigorousintuition.ca. IN A [_THE_IP_ADDRESS_]".

Linux: You already know how to do this

TI-99's: Eat bran muffin. Insert cassette marked "TCP/IP stack and MC Hammer mixtape" and type "load underpants". Wait.

In all cases: the answer is 66.147.244.173, which would be a way to access the site if Jeff's were shelling out for a dedicated hosting plan, but he's on the low-cost plan of shared hosting, which means that IP address is shared with many unrelated sites, and the server relies on the web browser software to send along the name of the site you're looking for, along with the rest of the page request, in order to know which site to serve up. The browser wouldn't know what domain you're trying to get to if you just pasted that IP address in and hit return, so that's why doing so turns up a generic error message with links to the hosting control panel. This is a fundraising and justdrew-effort issue, basically.

So then, normally, when you type in a domain or click on a link to a new site, your computer looks up the name to find the IP address, then connects to the server using that IP address, and makes the request for whatever page you want. It looks up the IP address by querying its local DNS server, which is generally either your home broadband/wifi router, or the ISP's DNS server if you aren't using a router -- in any case it's supplied to your computer by the box on the other end of the wire during the auto-configuration process. They cache the answers if they can, retrieving them from the nearest root DNS server in the first place, which keep each other synced and that's how we have decentralized global DNS -- rapid, robotic folklore. Acid-tripping bearded genius, right there.

Anyway, if the DNS entry for rigorousintuition.ca were edited [by somebody] to make it useless as is the case with all of Brandt's domains, that change would propagate globally within a few hours or less, generally, and then we'd all be shit out of luck unless we add the domain to our computers' own hosts file, which is like a DNS listing specific to your machine that you control. As long as the IP doesn't change, in such an event the browser would be able to get to the site seamlessly because the system would return the hosts file entry instead of the poisoned DNS results, so it would be able to include a proper "Name:" header that would tell Jeff's host you were looking for his site.

To edit your hosts file, here's some wiki instructions: http://en.wikipedia.org/wiki/Hosts_(file)

The line to add would simply be this:

66.147.244.173 rigorousintuition.ca

That would ensure that you could still get here if the DNS were shut off, but keep in mind that DNS is only one of several possible vectors of attack in taking down a site. The hosting company is easy to lean on if they're told it's a terrist site or some such, so that's why we need backups for our backups.

I recommend dedicated hosting in a bunker or Sealand or something, and/or DNS diversification using a geo-distributed DNS service like easydns or zoneedit, and/or a backup blog not owned by Google in case the blogspot disappears and he needs to tell us where the new board is. And/or a tor hidden service with a link on the hidden wiki.