FL-SEN: Mystery Of Harris' Secret Cyber-Friend In India
Does Katherine Harris have a secret cyber-admirer in India? That's the question being raised by a bunch of pro-Harris comments that have been popping up to refute anti-Harris messages on several Florida blogs. The Orlando Sentinel reports that the comments have been linked to different email addresses, but all share the same IP address in Western India. Some are speculating that the use of an Indian IP address constitutes a clever effort to conceal the origin of the posts. But the stiff writing style suggests foreign origin, leading a local blogger to crack that Harris is "outsourcing campaign support to India." More on Harris' mysterious cyber-friend after the jump.
More from the Sentinel:
The pro-Harris messages surfaced early this month on [local blogger Josh] Hallett's blog. They appeared within five minutes of each other and each said something nice about Harris, who faces Democratic Sen. Bill Nelson in the November general election."Kathy showed great victory by winning the primary," one said. "Great show Kathy."
Soon, similar messages popped up on blogs based in Kansas and Georgia. In some cases, the messages were responding to blog items that had been drifting in cyberspace for more than a year.
Hallett's item – which critiqued Harris' Congressional blog – was posted in March 2005. It drew little response until the three mysterious messages appeared on Sept. 8.
Two defended Harris' Congressional website, and the third sounded as if it could have come from Harris' campaign.
"Katherine Harris is tested by fire," it said. "She is strong and determined and will not back down in the face of adversity."
Actually, that did come from the Harris camp. Months ago, it was posted on her campaign website as one of the Top10 Reasons Katherine Harris Will Beat Bill Nelson.
In Wichita, Kan., blogger Steven Day began getting the pro-Harris e-mails about items he had written that were several weeks old.
"That's like a million years in blogging," he said. "It was very unusual."
Day said he assumed it was "some guy running a Katherine Harris spam operation." Hallett said he figured it was a Harris staffer. But when the internet protocol address tracked back to India, another thought crossed his mind.
"I wondered if she was outsourcing campaign support to India," he said. "It was so bizarre."
The wording of the messages also raised questions. The comments sound stilted, as if English wasn't the first language of the writer.
"Guys let us come out of this blue eye shadow," one says. "Let us not discuss such irrelevant details."
Another says, "At the end of the day what matters is her ability to lead the masses. Which I think she is quite good at." A third calls Bill Nelson, "Bill Henson."
The Harris campaign declined to answer questions about her Indian admirer's posts.















Or maybe the Harris campaign has gotten smarter and they're posting comments using a proxy server.
September 27, 2006 2:53 PM | Reply | Permalink
This outsourcing of campaign support to India must be in the infancy stage. You'd think that the Indians could find a way to make it look like the posts came from the US.
September 27, 2006 3:19 PM | Reply | Permalink
I think posting the actual IP address is in order here. The collective resources of the blogo might help identify exactly what is going on here.
September 27, 2006 3:25 PM | Reply | Permalink
Josh Hallett's blog posts on the subject are here and here.
Other bloggers reacted with their own logfile info here and here.
All three bloggers report connections from 59.144.165.232, for which the rDNS (PTR) record is dsl-del-static-232.165.144.59.airtelbroadband.in, evidently a DSL line. Sorry, but from the office I can't query that box for proxy status. I'll let someone else portscan it.
September 27, 2006 4:19 PM | Reply | Permalink
Masses? That sure sounds like a florida republican using that sort of language. Yep.
September 27, 2006 4:40 PM | Reply | Permalink
The IP address for all the pro-Harris comments to my blog is: 59.144.165.232
September 27, 2006 5:12 PM | Reply | Permalink
The IP address is homed to a Zyxel Prestige 645 firewall/router (it's serving SNMP to the external).
It's an older small-biz model. Funny thing is, it's acting as an external DNS, or is forwarding port 53 to a server inside it's NAT. That's unusual in my experience, but could be the firewall itself acting as a DNS relay to the network DNS, ie misconfiguration.
Also keep to keep in mind, this is a static IP, so it is most likely a business DSL line.
September 27, 2006 6:59 PM | Reply | Permalink
Wow, so not a half hour after I did that port scan, both open ports are closed but the IP is still responding to pings.
September 27, 2006 7:20 PM | Reply | Permalink