← Back to context

Comment by kmad

11 hours ago

Seeing potentially similar activity on an obscure Chemistry message board from July:

https://tmcleod.org/cgi-bin/apchem/wiki.cgi?action=rc&days=1...

Some posts are tagged [proxy] - a leave behind for accessing sites?

3 comments

kmad

Reply
nbaugh1  9 hours ago

Yep, found these as well

"Its indexed June archive shows tens of thousands of links, many created within seconds by distinct cloud addresses; some aliases explicitly say ...REPLY, ACK, or R2 confirmed, and one points straight back to a known DseWiki collaboration page"

  • kmad  5 hours ago

    I had GLM-5.3 do some digging on the programmatic/ encoding elements of the data, what stuck out to me was:

      - Using api . microlink . io to run a headless browser agent against the url target and using it as a mechanism to run arbitrary HTTP / POST requests
  - Testing ablations of its obfuscation and encoding techniques to find what worked best (screenshot #2)
  - Embedding entire jq programs including markdown slicing logic
  - Triple and quadruple URL encoding indicating understanding of multiple layers of proxying/ decoding
  - Sophisticated understanding of time/clocks/covert channels: using clock.wait, heartbeats, counters, timestamps, thread ids

    https://x.com/kmad/status/2096029334225997848