tmctmt@tmctmt
tmctmt.com/posts/
Joined April 2026
21 Photos and videos
Pinned Tweet
tmctmt@tmctmt
May 15
Mullvad exit IPs are surprisingly identifying tmctmt.com/posts/mullvad-exi…

Mullvad exit IPs as a fingerprinting vector

Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the...

tmctmt.com
52
222
2,433
827,694
You can get an approximate edge-to-origin timing on most Cloudflare sites by subtracting the latency of /cdn-cgi/trace (hits edge only) from your normal requests' latency. If you have a bunch of proxies you can cycle between edges and get a good idea of the origin's geoloc
4
5
198
4,940
Demo: gist.github.com/tmctmt/3f1d2… It uses Mullvad proxies to cycle edges so you need to be connected to their VPN to use this.

Cloudflare origin geolocator

Cloudflare origin geolocator. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
17
503
I made a searchable pastebin archive since there weren't any left: pastes.zip
3
1
20
745
Fascinated by the Better Call Saul email bombing script
3
59
no promise this will stick around long-term, just testing the waters for now.
1
155
If you have Signal installed on a device you don't check often, it basically defeats the purpose of disappearing messages.
1
7
596
not sure if this applies to deleted messages or view-once media too
2
131
does anyone recognize a hash algorithm that maps strings into unsigned 32-bit ints, but stays within a 2^31 range, especially in ruby?
1
5
638
the context being that i have a target that generates deterministic identifiers like this in place of PII. i've already tried murmur2/3 across every seed with no success. figures it's something proprietary, but i wanted to see if anyone here has other ideas.
1
1
272
I was wondering why Chrome was refusing to use ECH on websites where it works just fine in Firefox. It turns out Chrome only enables ECH if your system DNS server supports DoH. If you use Mullvad, its internal DNS servers are plaintext only.
3
3
72
11,183
To clarify, the issue isn't a lack of encryption for DNS queries. The traffic is already encrypted at the tunnel layer and it stays in Mullvad's intranet. The real issue is that Chrome *thinks* it's insecure, which triggers it to turn off a privacy feature.
14
954
people in the replies have never stalked someone online and it shows😔
alpha@omarsbigsister
May 30
Stop telling me to use duckduckgo IT SUCKS
1
3
1,346
I can confirm that Mullvad's new mitigation (currently available on select servers) indeed fixes the IP position correlation flaw.
Mullvad.net
@mullvadnet
May 20
On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users. We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks. Read more here: mullvad.net/blog/exit-ip-fin…
3
44
563
57,952
The IPs are still assigned deterministically though and afaict they won't change until the pubkey rotates, which is a bit of a bummer.
12
1,954
Just released a tool for identifying domains under common ownership using Cloudflare nameserver pair correlation (with some historical data support!): tmctmt.github.io/cloudflare-…
2
3
4
1,064
For those unfamiliar with the technique, this post by Aidan Thomson describes it pretty well: interrupt.sh/blog/discoverin…

Discovering domains via NS correlation

A simple OSINT technique for discovering related domains.

interrupt.sh
2
2
526
I don't plan on keeping the database up to date, but since Cloudflare is already experimenting with randomly assigned nameservers, there may not be much point in doing so for much longer anyway.
353
tmctmt retweeted
fox ⏹️@soft_fox_lad
May 21
A novel-ish means of finding Satoshi, including a website where you can test your own guesses. All bad writing is by me. Done in collaboration with @tmctmt. foxchapelresearch.substack.c… If you're interested in funding this, please lmk.
9
9
71
9,128
how it feels to say pwned as a gen z
Herman.fun
@doomscroll_x
May 9
The Millennial falloff will be studied for generations
8
704
neat trick with mediafire: you can reveal uploader names for single files using mediafire[.]com/api/1.5/file/get_info.php?quick_key=file_id_goes_here
9
71
1,160
56,650
Load more