# Injected IPs

As mentioned in [Section 3.2](https://www.usenix.org/system/files/foci20-paper-anonymous_0.pdf#page=3) of the work, the GFW has been mainly injecting type A DNS records, with one exception where the GFW injects CNAME records for a single domain (www.sunporno.com). 

This directory includes the distinct injected IP addresses before and after a change at November 23, 2019: dropping from 1,510 IPs (associated with 41 ASes) to only 216 IPs (associated with 21 ASes).

For better reproducibility, the two files are generated by:

```sh
head -n200000 ../all_more_fields.csv | tail -n +2 | cut -d";" -f 4 | sort | uniq > ips_before_drop.txt
tail -n100000 ../all_more_fields.csv | cut -d";" -f 4 | sort | uniq > ips_after_drop.txt
```