Futurology Today
Communities
Create Post
Login
Sign UpAnyone know what this is? mark @programming.dev to [email protected] ·
There’s this weird github repository
https://github.com/OOOO00000000OOOO/OOOO00000000OOOO
I noticed there was someone attempting to proxy to this repository on my site, causing it to show up in the logs. It was detected as spam but this repo doesn’t look like it’s built by some normal spammy company. The owner has gone through great lengths to try to stay anonymous. And I can’t make out what the repo is or what it’s for. Does anyone know or have any ideas?
Thanks You must log in or # to comment.
urushitan 漆たん @kakera.kintsugi.moe
Idk but I found this
I also found this https://ooooooooooooooooooooooooooo.carrd.co/
This is almost certainly a way to use github as a backup system, but it’s also the output of someone who does alot with white/black/grey imagery, glitch art, and is OBSESSED with symmetry as other commenters have said
This appears to be their social media presence:
http://twitter.com/WHITEBALACLAVA
http://instagr.am/WHITE_BALACLAVA
http://fb.com/1453261601638473
http://youtube.com/channel/UCCLaIxZrTWkBhp_kWXUwfTQ
http://soundcloud.com/WBALACLAVA ·
http://i.imgbox.com/wuBm89hW.png
http://youtube.com/channel/UC-bPHywwCRhyM61m8cp-zbg/VIDEOS
http://instagr.am/PU.DEHCTIP_AVALCALAB.ETIHW
http://twitter.com/AVALCALAB_ETIHW
http://twitter.com/ERISED_TIFENEB
http://youtube.com/channel/UCLLr-AXjqxUHn0eSssph8cg
MonkderVierte @lemmy.zip
Most of the links don’t work anymore, so they probably saw this and felt doxed.
urushitan 漆たん @kakera.kintsugi.moe
they actually didn’t when I grabbed them either but I kept them for posterity. Important to note some of these things are almost 10 years old, so there’s certainly the rot of not maintaining them, free services pruning, etc. That being said, it’s likely why they duplicate their 7GB backup repo all over the placeMonkeMischief @lemmy.today
Oh boy I would not be surprised if there was some kinda ARG buried in all this lol. felsiq @piefed.zip English
I don’t know what their vibe is but I love it, we need more people like this in the world
hypnicjerk @piefed.social English
i wish i were a tenth this fucking fearlessly coolmark @programming.dev OP
😂 what is this person’s goal in life?
urushitan 漆たん @kakera.kintsugi.moe
Their goal? Can’t say. They clearly have a drive to make art, especially mathematical fractal binary minimalist art. Whether they also are actually producing malware or are just trying to piggyback as many services as possible to archive and keep their stuff online is another question. The vast majority of what I saw in my quick recon of their online presence was mostly glitch art/unicode/ascii art, blender stuff, fractals, web based d3 animations, that sort of thing. That being said, as you said, they appear to have gone to great lengths to be anonymous, I’ve only found a couple of raw IPs in there that mirror their stuff.
That being said, it seems they also clone their backups to anyone who hosts a free forgejo/gitea instance:
OOOOOOOOOOOOOOOOꓨЯO.ꓨЯƎᗺƎᗡOϽ CODEBERG.ORG/OOOOOOOOOOOOOOOO OOOO\MOϽ.ᗺUHƧꓨAᗡ DAGSHUB.COM/OOOO OOOO\u\MOϽ.ƎᗡOϽƎᗡOHЯ.ƎᗡOϽ CODE.RHODECODE.COM/u/OOOO oooo∽\TH.ЯƧ.TIꓨ GIT.SR.HT/~oooo OOOOꓨЯO.ꓨUᗺATOИ NOTABUG.ORG/OOOO O\000Ԑ:მ4.111.78.ਟ81 185.87.111.46:3000/O O\HϽƎT.TƎꓨƎᗺ.MUTИƎꓨA.TIꓨ GIT.AGENTUM.BEGET.TECH/O OᗡI.Oꓨ.ᗺAꞰꓨИAᗡƎMUƧ.TIꓨ GIT.SUMEDANGKAB.GO.ID/O OOOOƎTIƧ.ƧƎOᒐƧIƧIHT.TIꓨ GIT.THISISJOES.SITE/OOOO O\UƎ.ЯƎꓨИIᒧᒧƎ.TIꓨ GIT.ELLINGER.EU/O O\HƧ.1ᗡIꟼ.AƎTIꓨ GITEA.PID1.SH/O OᒧИ.ИƎЯƎOᗺЯƎIVIᒧO.TIꓨ GIT.OLIVIERBOEREN.NL/O OƎM.YꓨOᒧOИYƧ.ꓨИOƎᒐꞰƎ.AƎTIꓨ GITEA.EKJEONG.SYNOLOGY.ME/O O𑪽Ͻ.ϽƎVOЯOᗺꞰƎИƎᗡ𑪽.TIꓨ GIT.ZDENEKBOROVEC.CZ/O Oꟼᒐ.ƧUᒧꟼTϽƎИИOϽ.TIꓨ GIT.CONNECTPLUS.JP/O O\YИAꟼMOϽ.ꞰᗺƎ.AƎTIꓨ GITEA.EBK.COMPANY/O O\MOϽ.ƧꟼOVƎᗡUAꞰA.AƎTIꓨ GITEA.AKAUDEVOPS.COM/O O\ZYX.VƎᗡƎᒧᗺATЯOꟼ.AƎTIꓨ GITEA.PORTABLEDEV.XYZ/O O\MOϽ.ƎꓨAMAIV.AƎTIꓨ GITEA.VIAMAGE.COM/O O\TƎИ.OTYЯϽ.TIꓨ GIT.CRYTO.NET/O O\VƎᗡ.ƧꟼAMO.TIꓨ GIT.OMAPS.DEV/O O\MOϽ.ИƎMMƎH-ИAV.TIꓨ GIT.VAN-HEMMEN.COM/O O\UƎ.ИƎVƧƎИ.TIꓨ GIT.NESVEN.EU/O O\MOϽ.ᗡAƎЯᗡHTꟻIꟻ.AƎTIꓨ GITEA.FIFTHDREAD.COM/O
mark @programming.dev OP
Yeah. Just found that they’re using this email address: [email protected]. murena.io gives them 1GB of storage for free. Like you said, they appear to be attempting to keep a backup of a lot of data using third-party services, I’m guessing so that, in theory, even after their death, this data will be available… forever?
lad @programming.dev English
Their repositories are really something, and the commits seem to only happen in bursts, I expected them to do a few commits every day, instead it’s like 10 days a year with 1700+ commits total.
But I wouldn’t assume they are conventionally malicious, more like a paperclip storage optimiser
urushitan 漆たん @kakera.kintsugi.moe
Agreed, leads me to think they have some kind of script that rewrites filenames and directory names to be symbolic/symmetric and they run it manually rather than on some automated schedule. Then by storing it as a git repo they can find open git hosting and just mirror it there (the lastest copy I saw was like 7 or 8 GB so definitely not tiny, but also not enough to take down your average self hosting project)beegnyoshi @lemmy.zip
What does it mean to proxy a repository through the site? talkingpumpkin @lemmy.world
No idea, but it’s certainly not the intended use of github.
Have you already reported the user (look at their other repos) or should I?
theherk @lemmy.world
Several such repositories very similar. I’m thinking some strange encoding for using it as remote storage of some sort. mark @programming.dev OP
Just reported. Wasn’t sure if I should at first. But the more people who report it, the better, right? ;) ThanksNaibofTabr @infosec.pub English
Good catch. Someone is trying to use your site as a proxy for malicious software. You should report the repository.
mark @programming.dev OP
Good idea. I didn’t report it before because I wasn’t quite sure of whether or not it was malicious or just someone testing something out. But it’s clear this person isn’t just testing or debugging something. I’ll report. Thanks!AlteE @programming.dev
Probably someone created it for prank/harmful purposes. ludrol @programming.dev
At first glance there is a lot of noise that look like an ARG but there is just too much random stuff. There are some binary blobs that are marked as executable. They might be malware.
Edit:
Found blender screenshots, firefox screenshots with some firefox extension config files, SVGs and PNGs, links to alternative 4chans, solidworks tutorials and blender VK groups
They are crazy for using VERY heavily riced windows that is ultra-minimalist white.
Russian hacker for sure. Might or might not have developed malware. I am more inclined for this to be a cloud backup hosted on github.
Edit2: The Filepath is crazy
mark @programming.dev OP
It’s insane, right? I was looking through the files and trying to find anything that made sense. None of it does. I thought it was some foreign or custom encoded programming language or something.
ludrol @programming.dev
It makes sense in Terry A. Davis/Temple OS sense. Someone mentally ill needs everything to be symmetrical. They substitute o with Ⓞ in www.gⓄⓄgle.com I think they use fancy unicode to have a bearable symmetrical font; And someday they found that they can upload stuff to github and they upload what they made.Quetzalcutlass @lemmy.world English
Probably Command & Control for some sort of malware.[email protected] [email protected] You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance! Rules Wormhole
Follow the wormhole through a path of communities [email protected]
Visibility: Public
This community can be federated to other instances and be posted/commented in by their users.
1.01K users / day1.66K users / week3.24K users / month8.49K users / 6 months12 local subscribers27.8K subscribers2.02K Posts21.4K CommentsModlog
mods: snowe
@programming.dev
Ategon
@programming.dev
UlrikHD
@programming.dev
bugsmith
@programming.dev
Spyro
@programming.dev
BE: 0.19.19
Modlog
Legal
Instances
Docs
Code
join-lemmy.org
0.0118474958221645 25 304 288 982.2458 84.406022589954 0 ᯽ ᯽ 0 84.406022589954 25 304 288 982.2458 0.0118474958221645
0.0355424874664934 8 434 762 994.08195 28.135340863318 -1 ·ꔹ᯽ꔹ· ·ꔹ᯽ꔹ· -1 28.135340863318 8 434 762 994.08195 0.0355424874664934
0.10662746239948 2 811 587 664.69398 9.37844695443933 -2 ꞉ꔹ᯽ꔹ꞉ ꞉ꔹ᯽ꔹ꞉ -2 9.37844695443933 2 811 587 664.69398 0.10662746239948
0.319882387198441 937 195 888.231327 3.12614898481311 -3 ⋮ꔹ᯽ꔹ⋮ ⋮ꔹ᯽ꔹ⋮ -3 3.12614898481311 937 195 888.231327 0.319882387198441
0.959647161595322 312 398 629.410442 1.04204966160437 -4 ⁘ꔹ᯽ꔹ⁘ ⁘ꔹ᯽ꔹ⁘ -4 1.04204966160437 312 398 629.410442 0.959647161595322
2.87894148478597 104 132 876.470147 0.347349887201457 -5 ⸭ꔹ᯽ꔹ⸭ ⸭ꔹ᯽ꔹ⸭ -5 0.347349887201457 104 132 876.470147 2.87894148478597
8.6368244543579 34 710 958.8233825 0.115783295733819 -6 ⠿ꔹ᯽ꔹ⠿ ⠿ꔹ᯽ꔹ⠿ -6 0.115783295733819 34 710 958.8233825 8.6368244543579
25.9104733630737 11 570 319.6077942 0.038594431911273 -7 ❁🖵፨ꔹ᯽ꔹ፨🖵❁ ❁🖵፨ꔹ᯽ꔹ፨🖵❁ -7 0.038594431911273 11 570 319.6077942 25.9104733630737
77.7314200892211 3 856 773.20259805 0.012864810637091 -8 🖵❋ꔹ᯽ꔹ❋🖵 🖵❋ꔹ᯽ꔹ❋🖵 -8 0.012864810637091 3 856 773.20259805 77.7314200892211
233.194260267663 1 285 591.06753268 0.00428827021236366 -9 𐧾ꔹ᯽ꔹ𐧾 𐧾ꔹ᯽ꔹ𐧾 -9 0.00428827021236366 1 285 591.06753268 233.194260267663
699.58278080299 428 530.355844228 0.00142942340412122 -10 ⵔ·ⵔꔹ᯽ꔹⵔ·ⵔ ⵔ·ⵔꔹ᯽ꔹⵔ·ⵔ -10 0.00142942340412122 428 530.355844228 699.58278080299
2 098.74834240897 142 843.451948076 0.000476474468040407 -11 ···ꔹ᯽ꔹ··· ···ꔹ᯽ꔹ··· -11 0.000476474468040407 142 843.451948076 2 098.74834240897
6 296.24502722691 47 614.483982692 0.000158824822680136 -12 ꞉·꞉ꔹ᯽ꔹ꞉·꞉ ꞉·꞉ꔹ᯽ꔹ꞉·꞉ -12 0.000158824822680136 47 614.483982692 6 296.24502722691
18 888.7350816807 15 871.4946608973 0.0000529416075600452 -13 ⋮·⋮ꔹ᯽ꔹ⋮·⋮ ⋮·⋮ꔹ᯽ꔹ⋮·⋮ -13 0.0000529416075600452 15 871.4946608973 18 888.7350816807
56 666.2052450422 5 290.49822029912 0.0000176472025200151 -14 ⁘·⁘ꔹ᯽ꔹ⁘·⁘ ⁘·⁘ꔹ᯽ꔹ⁘·⁘ -14 0.0000176472025200151 5 290.49822029912 56 666.2052450422
169 998.615735127 1 763.49940676637 0.00000588240084000503 -15 -15 0.00000588240084000503 1 763.49940676637 169 998.615735127
509 995.84720538 587.83313558879 0.00000196080028000168 -16 -16 0.00000196080028000168 587.83313558879 509 995.84720538
1 529 987.54161614 195.944378529597 0.000000653600093333892 -17 -17 0.000000653600093333892 195.944378529597 1 529 987.54161614
4 589 962.62484842 65.3147928431989 0.000000217866697777964 -18 -18 0.000000217866697777964 65.3147928431989 4 589 962.62484842
13 769 887.8745452 21.7715976143996 0.0000000726222325926546 -19 -19 0.0000000726222325926546 21.7715976143996 13 769 887.8745452
41 309 663.6236357 7.25719920479988 0.0000000242074108642182 -20 -20 0.0000000242074108642182 7.25719920479988 41 309 663.6236357
123 928 990.870907 2.41906640159996 0.00000000806913695473941 -21 ⭥🚹⭥ ⭥🚹⭥ -21 0.00000000806913695473941 2.41906640159996 123 928 990.870907
371 786 972.612722 0.806355467199987 0.00000000268971231824647 -22 ⭤🚹⭤ ⭤🚹⭤ -22 0.00000000268971231824647 0.806355467199987 371 786 972.612722
1 115 360 917.83817 0.268785155733329 0.000000000896570772748823 -23 -23 0.000000000896570772748823 0.268785155733329 1 115 360 917.83817
3 346 082 753.5145 0.0895950519111097 0.000000000298856924249608 -24 ✻⯏Ⓞ◇⯏◇Ⓞ⯏✻⠀𖢄⠀⦻Ⓞ𖧷ꖅ⯏Ⓞ⦻🝊⦻Ⓞ⯏ꖅ𖧷Ⓞ⦻⠀𖢄⠀✻⯏Ⓞ◇⯏◇Ⓞ⯏✻ ✻⯏Ⓞ◇⯏◇Ⓞ⯏✻⠀𖢄⠀⦻Ⓞ𖧷ꖅ⯏Ⓞ⦻🝊⦻Ⓞ⯏ꖅ𖧷Ⓞ⦻⠀𖢄⠀✻⯏Ⓞ◇⯏◇Ⓞ⯏✻ -24 0.000000000298856924249608 0.0895950519111097 3 346 082 753.5145
10 038 248 260.5435 0.0298650173037032 0.0000000000996189747498692 -25 -25 0.0000000000996189747498692 0.0298650173037032 10 038 248 260.5435
30 114 744 781.6305 0.00995500576790107 0.0000000000332063249166231 -26 -26 0.0000000000332063249166231 0.00995500576790107 30 114 744 781.6305
90 344 234 344.8914 0.00331833525596702 0.0000000000110687749722077 -27 -27 0.0000000000110687749722077 0.00331833525596702 90 344 234 344.8914
271 032 703 034.674 0.00110611175198901 0.00000000000368959165740256 -28 -28 0.00000000000368959165740256 0.00110611175198901 271 032 703 034.674
813 098 109 104.022 0.000368703917329669 0.00000000000122986388580085 -29 -29 0.00000000000122986388580085 0.000368703917329669 813 098 109 104.022
2 439 294 327 312.07 0.000122901305776556 0.000000000000409954628600285 -30 -30 0.000000000000409954628600285 0.000122901305776556 2 439 294 327 312.07
7 317 882 981 936.2 0.0000409671019255188 0.000000000000136651542866762 -31 -31 0.000000000000136651542866762 0.0000409671019255188 7 317 882 981 936.2
21 953 648 945 808.6 0.0000136557006418396 0.0000000000000455505142889205 -32 -32 0.0000000000000455505142889205 0.0000136557006418396 21 953 648 945 808.6
65 860 946 837 425.8 0.00000455190021394654 0.0000000000000151835047629735 -33 -33 0.0000000000000151835047629735 0.00000455190021394654 65 860 946 837 425.8
197 582 840 512 277. 0.00000151730007131551 0.0000000000000050611682543245 -34 -34 0.0000000000000050611682543245 0.00000151730007131551 197 582 840 512 277.
592 748 521 536 832. 0.000000505766690438504 0.00000000000000168705608477483 -35 🟢 🟢 -35 0.00000000000000168705608477483 0.000000505766690438504 592 748 521 536 832.