Personalized PDFs

19.3.2022

Finally, I found a Wiley PDF that is different when downloaded at the same time using different proxies proxy. Text and layout is identical and even the binary structure when downloading within 5 sec from the same IP. Using a different proxy, however, gives different strings at the end of the document.

binary comparison of the same document

So far I don’t know what these strings indicate, 32 letters are too short for something executable, but long enough to store some identifier or geolocation. Frequency analysis shows mainly e,d,c,a,f and digits eg hex code. Is it an IP6 IP address?

German Proxy
630d:577e:0c28:fe7c:3934:f08c:6ddb:a93e
a3f4:840c:9efe:87b9:af97:df5c:2bf4:d9e6
Japanese Proxy
db53:6013:615e:902a:805a:815c:229d:20da
7f46:ee57:fa4a:e3a9:33c2:c1db:37e3:ebb8
Dutch Proxy
f2a7:8db4:dd89:2c4c:dfeb:d352:87e0:5c18
e606:c2e1:383a:bc21:ef35:58a1:6c54:a991

The length would fit an IP6 address. TBC.