INDC Journal

« Quick Debate Reaction | Main | Movie Day »

October 06, 2004
Factcheck 'dot.com' Redirected to George Soros After the Debate

(UPDATED - Verdict: 'redirect via the apache server')

Posted by Bill

Dick Cheney erred tonight by citing "Factcheck.com" instead of "Factcheck.org" as a reference for the debunking of Halliburton charges. Immediately after the debate, "dot-com" pointed to an education site. Within an hour, it was redirected to GeorgeSoros.com - possibly millions of people are finding information that's vastly different than what they expected ...

UPDATE: Upon reflection, I think that this makes the Dems look bad. Eh, maybe not. I would have chosen a site that made specific accusations about Halliburton, but very quick response to an opportunity, nonetheless.

UPDATE: A commenter points out:

Bill: I hate to point this out, but ... You must not do any of your own DNS management, because web addresses cannot be commandeered in an hour.

I have no knowledge of DNS servers, but I do know that I went to "factcheck.com" immediately after the debate in order to verify Cheney's error, and it led to a mortgage or domain name sales site (I can't recall). Now it points to www.georgesoros.com. Headline amended. See for yourself - www.factcheck.com. It's possible that I mistyped the address, I suppose, but what are the odds that "factcheck.com" was a mirror for George Soros prior to the debate?

UPDATE: I wasn't hallucinating - Claire comments:

I had the same experience -- it was an educational domain registration site when I checked it about 15 minutes after the debate ended.

UPDATE: Commenter "Anonymous Scientist:"

It could be a javascript or server redirect. If it is either of these two, then it was most likely not put in place by George Soros. It was most likely put in place by the owner of the web address listed above. Quick thinking really, but not the doing of George Soros (most likely).

Whether it's an independent action by the domain's owner or a move by Soros's organization, the destination site was changed almost immediately after the debate in adaptation to Cheney's error.

UPDATE: Earlier tonight, the destination site was listed as "the leading education site on the net." (Thanks Claire) A Google search reveals a whole host of listings, including:

factcheck.com: The Leading Education Site on the Net
factcheck.com/ - 1k - Oct 5, 2004 - Cached - Similar pages

Tricky. Text updated.

UPDATE: Awptimus:

I’ve concluded through my test that it is redirect via the apache server. Congrats to who had access to do that with such speed. Look for ["lastredirectaddr"]=>string(26) “http://www.georgesoros.com”

Posted by Bill at October 6, 2004 12:39 AM | TrackBack (8)

Comments

The big Dick finally got something right!

Posted by: postit at October 6, 2004 12:48 AM

"Within an hour, it's been commandeered by George Soros"

Bill: I hate to point this out, but ... You must not do any of your own DNS management, because web addresses cannot be commandeered in an hour. It takes approximately 24-72 hours from the time a domain name service (DNS) record is changed, to the time the changes are in place and active. In my experience, the changes are closer to 72 hours. Besides the whois record for factcheck.com shows that the record has not been updated since 12-Sep-04. Below is the record in case you don't feel like looking it up.

----------------
Name Administration Inc. (BVI)
Box 10518 A.P.O.
Grand Cayman, Cayman Islands B.W.I.
KY

Domain name: FACTCHECK.COM

Administrative Contact:
Domain, Administrator admin@nameadmininc.com
Box 10518 A.P.O.
Grand Cayman, Cayman Islands B.W.I.
KY
+1.345.946.6879

Technical Contact: (same as above)

Registrar of Record: DomainNameSales
Record last updated on 12-Sep-2004.
Record expires on 04-Feb-2007.
Record created on 04-Feb-2004.
----------------

Posted by: Anonymous Scientist at October 6, 2004 01:03 AM

Anonymous Scientist: I agree, I mentioned that in my blog. However, it is possible that there is a javascript redirect....I'm trying to find out.

Posted by: awptimus at October 6, 2004 01:08 AM

Dear INDC,
If it takes 24 to 72 hours to get access to a domain, how did George Soros manage to gain access to that particular domain just after Dick Cheney spoke it in the debate. Am I missing something here.

Posted by: James Kidder at October 6, 2004 01:09 AM

How the hell should I know? See update.

Posted by: Bill (NOT INDC JOURNAL) at October 6, 2004 01:10 AM

Some raw HTTP info

GET http://factcheck.com/ HTTP/1.1
User-Agent: gFTP 2.0.14
Host: factcheck.com
HTTP/1.1 302 FoundDate: Wed, 06 Oct 2004 05:10:03 GMTServer: Apache/1.3.28 (Unix) PHP/4.3.8X-Powered-By: PHP/4.3.8Location: http://www.georgesoros.comConnection: closeTransfer-Encoding: chunkedContent-Type: text/html

Looks like it might just be hardcorded into the apache server for redirect

Posted by: awptimus at October 6, 2004 01:12 AM

Anonymous Scientist, that's not quite true.

Since the factcheck.com domain simply points to Soros' server, all he had to do was get the nameserver pointers changed at ns1.15x.net and ns2.15x.net, which are authoritative for the domain. The registrar data, to which you refer above, isn't applicable for anything other than ownership - it doesn't point to any websites.

Nevertheless, it was a sneaky, shitty trick, and I, for one, am both quite impressed and a bit jealous of that level of deviousness.

Posted by: Patton at October 6, 2004 01:12 AM

I had the same experience -- it was an educational domain registration site when I checked it about 15 minutes after the debate ended.

Needs more checking, I would say...

Posted by: Claire at October 6, 2004 01:13 AM

Minor addendum: the nameserver changes to which I refer are immediate, and have no 24 or 72 hour delay.

Posted by: Patton at October 6, 2004 01:13 AM

awptimus offers a likely explanation. It could be a javascript or server redirect. If it is either of these two, then it was most likely not put in place by George Soros. It was most likely put in place by the owner of the web address listed above. Quick thinking really, but not the doing of George Soros (most likely).

Posted by: Anonymous Scientist at October 6, 2004 01:14 AM

Quite likely Soros owned it prior to the debate or negotiated with the owner to add the redirect this evening, knowing that sooner or later it would come in handy. Many people forget that there are different suffixes to domain names, so going to "whitehouse.com" instead of "whitehouse.gov" used to lead to a porn site. When the owner's kids got old enough to surf the net, he changed it or sold it with the stipulation that content had to be changed (...don't remember all the details, but you get the point). If people make the error of going to "factcheck.com" instead of "factcheck.org", they land on Soros' site.

Posted by: TEWSPilot at October 6, 2004 01:18 AM

Patton: the point you are missing is that the DNS record has not been altered since Sep-04. Even if these are the authoritative DNS servers for the domain, the record would show a date change. I think it's a redirect on the Apache server. Again, I don't think this is the work of George Soros.

Posted by: Anonymous Scientist at October 6, 2004 01:18 AM

A.S.: That's not the DNS record referred to, that's the domain registration, which is a very different thing.

You're correct in agreeing with awptimus, above, however: the factcheck.com web site is not on the same server as georgesoros.com. (Soros' site is housed in the same datacenter that one of my servers is). It's a redirection by whoever controls the factcheck.com site, and I repeat:

I'm slackjawed at the audacity, ingenuity, and speed of the redirection. Complete hats off to whoever did it - it was quite the cute thing to do. Sneaky bastards.

Posted by: Patton at October 6, 2004 01:22 AM

From earlier tonite, my history cache has the 'dot com' site listed as "the leading education site on the net"

Posted by: Claire at October 6, 2004 01:22 AM

Patton: I don't want to argue this into the ground, but I just checked out one of the web addresses that I manage. It has been in existence for years, but I just changed the DNS server record in August. Sure enough, the "Record last updated on" reads "26-aug-2004".

The server redirect is a perfectly plausible (and most probable) answer to how the site went from real estate offerings to George Soros in under an hour. This is my personal business and day job Patton - you gotta trust me on something.

Posted by: Anonymous Scientist at October 6, 2004 01:30 AM

Well, I told my wife right after , it was .org, not .com, But hopefully people will figure it out, but I doubt many will take the time to even do the search.

I even use that site from time to time to back facts.

Regards,
Sonar5

Posted by: Sonar5 at October 6, 2004 01:37 AM

Solved. Even though the HTTP header data I showed said it, here is the conclusive proof of the Apache Redirect.
http://www.awptimus.com/blog/index.php?p=16

Posted by: awptimus at October 6, 2004 01:39 AM

If you are interested, this is what factcheck.com looked like on 02-Feb-2003. Waybackmachine.org didn't cache anything after 19-Nov-2003 on this site. Bummer, I wanted to see the education/real estate/what have you, site.

Posted by: Anonymous Scientist at October 6, 2004 01:39 AM

awptimus: good job sir!

Posted by: Anonymous Scientist at October 6, 2004 01:40 AM

Someone probably ran the whois info, hypothetically called the guy and paid him through paypal or something, and all he had to do was submit the redirect.

Not very complicated. Offer the guy some cash, give him the ftp host passwords, and walla, done deal, hypothetically of course, easily done within 30 minutes or so. Simple stuff, folks.

Regards,
Sonar5

Posted by: Sonar5 at October 6, 2004 01:45 AM

Sonar5: Technically simple, yes, but the speed that it happened....fascinating.

Posted by: awptimus at October 6, 2004 01:46 AM

Unless someone answered the phone and said sure, why not, right away.

Interesting google doesn't show any cache info either.

hmmmm.....

the Pajamahadeen is on the case, huh?

Posted by: Sonar5 at October 6, 2004 01:49 AM

Fact Checking MSNBC: Cheney did NOT link 9/11 and Iraq

http://www.freerepublic.com/focus/news/1236524/posts

Posted by: Rock at October 6, 2004 02:01 AM

Look at the Page Source:

tells the browser to pretend that the current page is located at some URL other than where the browser found it.
A very fast way to redirect.

Posted by: tiby5 at October 6, 2004 02:05 AM

Sorry, this is the line

base href="http://www.georgesoros.com:80/"

Posted by: tiby5 at October 6, 2004 02:07 AM

Here's the source of the web page at www.factcheck.com:


{META HTTP-EQUIV="Pragma" CONTENT="no-cache"}

{base href="http://www.georgesoros.com:80/"}

This says that the person who owns www.factcheck.com (66.197.187.168) simply redirected your browser to www.georgesoros.com (65.168.95.245). If you were to put this code on your own web page, the effect would be immediate, and your viewers would be sent to soros' web site. No DNS changes are required, since neither web site has changed its ip address.

This is probably not unethical, but it does seem a little sleazy. As I believe that Soros is even more of a 'force against truth' than even Michael Moore, I hope this grab for attention bites him in the butt.

Posted by: Kevin at October 6, 2004 03:52 AM

I'm guessing that's one of the perks of being a billionaire.

Posted by: Bruce at October 6, 2004 04:47 AM

It's late night/early morning here on the West Coast, and I can't access the factcheck.com page. But I tried typing the direct url for georgesoros.com in a different browser window, and it comes up lickety-split.

I don't know much about the tech behind the internet, so I don't know what this really means. Just thought I'd mention it.

Posted by: Sean M. at October 6, 2004 06:17 AM

I fetched the index.html file. This is it:

[bracket] META HTTP-EQUIV="Pragma" CONTENT="no-cache" [end bracket]

[bracket]base href="http://www.georgesoros.com:80/"[end bracket]

It's the page not the DNS. Conclusion.

Posted by: JasonN at October 6, 2004 12:17 PM

A very classy disclaimer is now up at http://www.georgesoros.com.
_____________________________

FactCheck.com Correction
We do not own the FactCheck.com domain name and are not responsible for it redirecting to GeorgeSoros.com. We are as surprised as anyone by this turn of events. We believe that Vice President Cheney intended to direct viewers to FactCheck.org.

Posted by: The Comedian at October 6, 2004 03:42 PM

GeorgeSoros.com is now disallowing the redirect from FactCheck.com. You get a connection refused (error 111) now. Interestingly honest of Soros. Either that was damage control, or just just oddly nice of him.

Posted by: awptimus at October 6, 2004 05:44 PM

I too do websites. If I owned factcheck.com and heard Cheney and wanted to forward people elsewhere, it would take me a minute. It's a simple redirect option from the host server and takes effect very quickly. For the owner of FactCheck (whoever they are) to say they don't know how that happened and they are surprised is such a huge lie. I would have to give up log ins and passwords, etc. to have someone do it, and certainly I could UN-do it in a minute, too! How funny. I'd say Cheney bit himself in the butt, or bit Bush in the butt at least!

Posted by: Linda Gaskill at October 7, 2004 05:51 PM

P.S. Bye the way, Awptimus, I am still redirected to George's site and it's 2:55 p.m. Pacific Standard time. I'd say Mr. Soros is not, as you said, disallowing the redirect at all. You must have gotten a "busy server" signal due to the mass interest in the site and that's more real than the weapons of "mass" destruction!

Posted by: Linda Gaskill at October 7, 2004 05:56 PM

-
av

Search

Extras
PDA

RSD
Atom
RSS 2.0
RSS 1.0

Credits
Movable Type