[HN Gopher] "Boobs check" - Technique to verify if sites behind ...
       ___________________________________________________________________
        
       "Boobs check" - Technique to verify if sites behind CDN are hosted
       in Iran
        
       https://xcancel.com/hkashfi/status/1995109785679573167
        
       Author : defly
       Score  : 118 points
       Date   : 2025-11-30 20:54 UTC (2 hours ago)
        
 (HTM) web link (twitter.com)
 (TXT) w3m dump (twitter.com)
        
       | ThePowerOfFuet wrote:
       | https://xcancel.com/hkashfi/status/1995109785679573167
        
         | Boogie_Man wrote:
         | Thanks for posting this. I mostly gave up on viewing the one or
         | two Twitter feeds that interest me after nitter stopped
         | working. It wasn't ideological, I just wasn't able to reliably
         | view and navigate without an account, and when I made an
         | account it just kept showing me like "black HS football player
         | bad sportsmanship".
         | 
         | Look like I've got about two years of James Cage White story
         | arcs to check in on.
        
           | skeledrew wrote:
           | This has been so useful to me that I've created a filter in
           | URLCheck[0] that automatically converts all X-related links.
           | 
           | [0] https://github.com/TrianguloY/URLCheck
        
       | KiranRao0 wrote:
       | Does anyone have sample sites that return this?
        
         | phgn wrote:
         | Also interested in a sample site where the request successfully
         | resolves ;)
        
       | lovegrenoble wrote:
       | Why not?
        
       | Aloisius wrote:
       | So presumably Iran has a reverse proxy in front of the entire
       | internet for HTTP?
       | 
       | I really want to know what's on the webpage for the iframe.
        
         | mschuster91 wrote:
         | > So presumably Iran has a reverse proxy in front of the entire
         | internet for HTTP?
         | 
         | Standard DPI firewalls can do that for you. Absolutely no
         | issue.
        
       | Yokolos wrote:
       | I'm wondering for what purpose one would be interested in finding
       | out if a site is hosted in Iran or not.
        
         | asdefghyk wrote:
         | Im guessing - its for some protest action? ... but really I
         | have NO IDEA.
        
         | nostrademons wrote:
         | Would assume it's to check if a site is foreign propaganda. A
         | lot of the lesser-known news sites that you see linked on
         | social media are actually psy-ops pushing an agenda, many of
         | them foreign-based. Follow the technique in the article and you
         | can easily blacklist Iranian ones.
        
         | delichon wrote:
         | I'd rather not do business there.
        
       | shishcat wrote:
       | This behavior only works when the reverse proxy or CDN is
       | configured like this:
       | 
       | Proxy/CDN: HTTPS (443) - Origin server: plain HTTP (80)
       | 
       | (example: Cloudflare in Flexible mode)
       | 
       | If the origin server uses any proper TLS configuration, even a
       | self-signed certificate, this method stops working. It only
       | succeeds when the upstream connection to the origin is unsecured.
       | 
       | If you want to test this on a random site without Cloudflare or
       | reverse proxy in general on HTTP: curl
       | http://www.digiboy.ir/boobs.jpg -v
        
       | cluckindan wrote:
       | Wow. The screenshot had the IP address exactly where I placed my
       | finger to scroll, and iOS Safari briefly opened a popup window
       | where it started connecting to that IP.
       | 
       | Fuck this shit, I'm moving to a hovel in the woods.
        
         | pizzalife wrote:
         | It's in a private Ip range so unless you're inside Iran you're
         | fine.
        
         | rootusrootus wrote:
         | Along the same lines, I occasionally find myself cursing iOS
         | for its willingness to just bring up the dialer and call a
         | number. I really, really wish that it would confirm any dialing
         | before doing it, especially if you didn't click on a phone
         | number on a contact. Couple times I've ended up dialing a
         | recent spam caller, which is the last thing I ever want to do.
        
       | losvedir wrote:
       | How's this work with https like in the example? The hops along
       | the way shouldn't see the path.
       | 
       | Is this implying that all TLS is terminated at the Iran border
       | and proxied from there? And all Iranian sites are required to
       | host via http? That has significantly more implications than what
       | this post is about.
       | 
       | Maybe certificate authorities aren't allowed to issue private
       | certs to Iranian organizations? Even LetsEncrypt?
        
       ___________________________________________________________________
       (page generated 2025-11-30 23:00 UTC)