ꖅⰙ⛋⦻Ⓞ✢𖧷✢Ⓞ⦻⛋Ⱉꖅ🗄ꖅⰙ⛋⦻Ⓞ✢𖧷✢Ⓞ⦻⛋Ⱉꖅ

Archives: [ b / bant ] Boards: [ talk ]

/b/ - Random

Index
NSFW
Ghost
Gallery
Frequently Asked Questions
DMCA
Donate
Stats

[6 / 2] 150KiB, 911x654, Screenshot from 2024-09-19 20-22-11.png View SameGoogleImgOpsiqdbSauceNAO Strange "O/O" repository all over the web, not able to find explanation. Anonymous Fri 20 Sep 2024 03:26:10 No.924700770 ViewReplyOriginalReport Ive been using git for a long time to organize my projects. I set up my own server for it so me and my friends can use it. Recently i have noticed a weird unknown user creating an account. The users name was simply "O". They have one repository: "O". At first I just assumed this was your average spam bot or exploit attempt but as I looked into it, i found hundreds of copies of this repository all over the internet, all from a user simply named "O". Now, the strangest part about it is the content. Example of a file name, this one contained strange numbers and multiplication heavy equations: TXT..𖣠ᗩᗩᑐᑕ⊙옷⊚ᗩᕼ∣ᙁᗝ⊚⊙ᙏᗱᗴߦ𒾨𔗢𔗢𒾨ߦᗱᗴᙏ⊙⊚ᗝᙁ∣ᕼᗩ⊚옷⊙ᑐᑕᗩᗩ𖣠..TXT

This mainly seems like pure nonsense but if you keep looking into it, there are copies of seemingly random websites, strange imagery, but it all follows a similar pattern. Additionally, one of the folders contained these strange images of the letter O and various circles:

I so far have not been able to decode the strange symbols, all that i was able to figure out is that the file names appear to be written twice, once mirrored and once in the right direction.

Any help on solving this would be greatly appreciated. Anonymous Fri 20 Sep 2024 03:34:38 No.924701173 Report Likely you will git (lol) a better answer on /sci. But good luck! Probably the AI preparing something sinister. Anonymous Fri 20 Sep 2024 03:57:14 No.924702120 Report Quoted By: >>924702324 Update: A Youtube channel associated with this repo has been found: https://www.youtube.com/channel/UCGV51gh3hcPh1FKx4ZxvJ2g/VIDEOS

This channel links to various other websites, including pinterest. The user is called O everywhere.

The only video on the channel has the same audio as this strange MP3 file which is mirrored in the middle: https://private.coreboot.org/O/O/src/branch/%E2%A0%80/%F0%9F%9E%8B/%F0%96%A5%95/%F0%9F%8E%A7 Anonymous Fri 20 Sep 2024 04:02:02 No.924702324 Report

924702120 I suggest running the mp3 into a steganography tool. Likely there is a message or imagine within the sound View SameGoogleImgOpsiqdbSauceNAO Screenshot from 2024-09-19 21-10 (...).png, 117KiB, 1728x454 Anonymous Fri 20 Sep 2024 04:10:58 No.924702698 Report I have put it in audacity before, there sadly wasn't much of interest to find inside it, here is a screenshot for anyone who wants to see it: Anonymous Fri 20 Sep 2024 04:56:12 No.924704548 Report https://exopoliticsinstitute.org/ http://exopoliticshongkong.com/uploads/Alien_Interview.pdf

https://en.wikipedia.org/wiki/LEDA_1000714 Subject Name E-mail Password FoolFuuka Imageboard 2.2.0 - Asagi Fetcher Change Theme Change Language Frequently Asked Questions - DMCA

archive.today webpage capture

Saved from

no other snapshots from this url

8 Jan 2025 14:55:32 UTC All snapshots from host warosu.org WebpageScreenshot sharedownload .zipreport bug or abuseBuy me a coffee [ 3 / biz / cgl / ck / diy / fa / ic / jp / lit / sci / vr / vt ] [ index / top / reports ] [ become a patron ] [ status ] /sci/ - Science & Math Text search [?]
[ Advanced ] View post
File: 149 KB, 911x654, Screenshot from 2024-09-19 20-22-11.png [View same] [iqdb] [saucenao] [google] 16388074 Strange "O/O" repository all over the web, not able to find explanation. Anonymous Thu, Sep 19, 2024 18:50:02 No.16388074 [Reply] [Original] Quoted by: >>16388247 >>16388264 >>16388280 >>16388283 >>16388345 >>16388897 >>16391655

Ive been told on /b/ to try reposting this here so here we go,

Ive been using git for a long time to organize my projects. I set up my own server for it so me and my friends can use it. Recently i have noticed a weird unknown user creating an account. The users name was simply "O". They have one repository: "O".
At first I just assumed this was your average spam bot or exploit attempt but as I looked into it, i found hundreds of copies of this repository all over the internet, all from a user simply named "O".
Now, the strangest part about it is the content. Example of a file name, this one contained strange numbers and multiplication heavy equations:
TXT..𖣠ᗩᗩᑐᑕ⊙옷⊚ᗩᕼ∣ᙁᗝ⊚⊙ᙏᗱᗴߦ𒾨𔗢𔗢𒾨ߦᗱᗴᙏ⊙⊚ᗝᙁ∣ᕼᗩ⊚옷⊙ᑐᑕᗩᗩ𖣠..TXT

This mainly seems like pure nonsense but if you keep looking into it, there are copies of seemingly random websites, strange imagery, but it all follows a similar pattern. Additionally, one of the folders contained these strange images of the letter O and various circles:
[](https://git.muellers-software.org/O/O/src/commit/c78f92526bdbc2c06b917cbe1215a44053a42145/%F0%9F%9E%8B))

I so far have not been able to decode the strange symbols, all that i was able to figure out is that the file names appear to be written twice, once mirrored and once in the right direction.

Any help on solving this would be greatly appreciated.

DoctorGreen !DRgReeNusk Thu, Sep 19, 2024 21:17:00 No.16388247

>>OP
spoopy

Anonymous Thu, Sep 19, 2024 21:20:07 No.16388251

Quoted by: >>16388319

It's just schizo shit

Anonymous Thu, Sep 19, 2024 21:30:46 No.16388264

>>OP
Weird.
If you visit muellers-software.org there's a bunch of hex code at the end of the page.

When translated it says

[ERR] Error when starting mdxl04.service: Unexpected " in line 3592: "i am different.
/\

Anonymous Thu, Sep 19, 2024 21:42:31 No.16388280

>>OP
https://www.youtube.com/channel/UCvMWYB7_6T4XTrf22awjO8Q
https://www.youtube.com/watch?v=AK8jyzVLYmM
http://o.iboards.ru/
https://soundcloud.com/000088880000
https://vk.com/club167414957
I found these. Poster seems to be Russian, probably a schizo or artist.
http://o.iboards.ru/viewtopic.php?f=381&t=227
http://o.iboards.ru/viewtopic.php?f=382&p=265
Also found these two links

Anonymous Thu, Sep 19, 2024 21:46:24 No.16388283

Quoted by: >>16388319

>>OP
It’s an online AI that is obfuscating it’s code repo by using weird symbols so it appears as nonsense to a human.

Or some gay art project / ARG

Anonymous Thu, Sep 19, 2024 22:11:01 No.16388319

>>16388283
>>16388251
ARG or schizo shit
(same thing if we're being QUITE honest)

Anonymous Thu, Sep 19, 2024 22:23:13 No.16388345

>>OP
Try switching switching from Wingdings to Arial

Anonymous Fri, Sep 20, 2024 06:21:05 No.16388897

Quoted by: >>16388900 >>16388922 >>16388982

>>OP
Looks like Korean or at least some of it

옷

https://korean.dict.naver.com/koendict/#/entry/koen/ec1fe1092815453288812f924bb62dc6

Anonymous Fri, Sep 20, 2024 06:25:14 No.16388900

Quoted by: >>16388922

>>16388897
This one is Carrier syllabary

ᗩ

https://www.omniglot.com/writing/carrier.htm

Anonymous Fri, Sep 20, 2024 06:43:22 No.16388922

Quoted by: >>16388956 >>16388982

>>16388897
>>16388900
ᗩᗩᑐᑕ =Boboduda
ᗩᕼ∣ᙁᗝ = bohlzo (there is no symbol for H or l so just using H and l)

https://www.translitteration.com/transliteration/en/carrier/canadian-aboriginal-syllabics/

Anonymous Fri, Sep 20, 2024 06:58:54 No.16388956

Quoted by: >>16388975 >>16388982

>>16388922
⊚

https://en.m.wiktionary.org/wiki/%E2%8A%9A
Or
https://symbology.wiki/symbol/circumpunct/

𖣠
Bamum Letter Phase-C Keuseux

https://unicodeplus.com/script/Bamu/4

Anonymous Fri, Sep 20, 2024 07:03:14 No.16388967

File: 1.49 MB, 8164x8164, g59nW5AW_o.jpg [View same] [iqdb] [saucenao] [google] 16388967

HTTP://TRANSLATE.GGLE.GR/translate?sl=AUTO&tl=MY&u=HTTP%3A%2F%2FBIBLI%E2%93%84TECAPLEYADES.NET%2FVIDA_ALIEN%2FALIENINTERVIEW%2FALIENINTERVIEW.HTM
Here is a link that is in one of the PDFs. Seems like he just translates to some weird language. Also I found some pngs and some links that resemble some sounds in that PDF. Probably some schizo playing around with Google translate. And also an petition on change org. https://www.change.org/p/%E1%80%9E%E1%80%AC%E1%80%B8%E1%80%A1%E1%80%9B%E1%80%B1%E1%80%B8%E1%80%A1-%E1%80%80%E1%80%BB%E1%80%81%E1%80%BB%E1%80%AD%E1%80%AF%E1%80%B8%E1%80%A1-%E1%80%A1%E1%80%81%E1%80%BB%E1%80%AD%E1%80%AF%E1%80%B8%E1%80%80%E1%80%BB-%E1%80%A1%E1%80%9B%E1%80%B1%E1%80%B8%E1%80%A1%E1%80%9E%E1%80%AC%E1%80%B8?recruiter=979721249&utm_source=share_petition&utm_medium=copylink&utm_campaign=share_petition

Anonymous Fri, Sep 20, 2024 07:07:21 No.16388975

Quoted by: >>16388979 >>16388982

>>16388956
𔗢 = tana

https://codepoints.net/U+145E2
https://en.m.wikipedia.org/wiki/Anatolian_hieroglyphs#Sign_inventory

Anonymous Fri, Sep 20, 2024 07:10:29 No.16388979

Quoted by: >>16388982

>>16388975
ߦ = y

https://www.omniglot.com/writing/nko.htm

Anonymous Fri, Sep 20, 2024 07:11:53 No.16388982

Quoted by: >>16388994

The whole string is made up of these.
>>16388897
>>16388922
>>16388956
>>16388975
>>16388979

Anonymous Fri, Sep 20, 2024 07:21:25 No.16388994

>>16388982
Missed one

𒾨

https://unicode-explorer.com/c/12FA8

Anonymous Sat, Sep 21, 2024 16:11:17 No.16391499

Bump for interest

Anonymous Sat, Sep 21, 2024 16:13:41 No.16391505

Microplastics in the brain caused it

Anonymous Sat, Sep 21, 2024 18:08:10 No.16391655 [DELETED]

File: 115 KB, 575x323, notation.jpg [View same] [iqdb] [saucenao] [google] 16391655

>>OP
That is just a programming language used by magical girls to program non deterministic turing machines.

0%  

10%  

20%  

30%  

40%  

50%  

60%  

70%  

80%  

90%  

100% ⚪ ARCHIVE.PH ◌

archive.today webpage capture

Saved from

no other snapshots from this url

8 Jan 2025 14:02:59 UTC All snapshots from host t.me WebpageScreenshot sharedownload .zipreport bug or abuseBuy me a coffee Download i iGNUranza iGNUranza https://ooooooooooooooooooooooooooo.carrd.co/ ci stiamo chiedendo pure noi chi è sto tizio e perchè fa ste cose

https://www.instagram.com/oooo_oooo.oooo_oooo https://soundcloud.com/88888088888 https://www.youtube.com/channel/UCGV51gh3hcPh1FKx4ZxvJ2g t.me/ignuranza/2034 9.1K viewsedited
Aug 2, 2024 at 22:25 Context Embed View In Channel 0%  

10%  

20%  

30%  

40%  

50%  

60%  

70%  

80%  

90%  

100% ⚪ ARCHIVE.PH ◌

archive.today webpage capture

Saved from

no other snapshots from this url

1 Oct 2024 23:06:29 UTC All snapshots from host fosstodon.org WebpageScreenshot sharedownload .zipreport bug or abuseBuy me a coffee Mastodon Login May 23 [email protected] Karcsesz :bh_s_u: @[email protected] The strangest thing just appeared on my Forgejo instance. Can't tell if it's an ARG hook or someone in serious need of mental help. Anyone interested in helping to investigate? https://code.thishorsie.rocks/O/O Me and @ryze have found so much random stuff. Apparently this is someone from Belarus thinking they're some sort of god? We've found aliens, conspiracy theories, fascinating stuff... Also all the filenames are palindromes of illegible characters. It's also a mirror of a mirror with recent updates. Any other #Gitea or #Forgejo admins familiar with this?  This Horsie Codes O O May 23 [email protected] Karcsesz :bh_s_u: @[email protected] Found a file linking to https://oooooooooooooooo.carrd.co/ then followed that to this list of every instance they've mirrored to: https://dev.to/oooooooooooooooo/thotha…thotha-21o2 This is extremely widespread  𖣠⚪𔗢⚪🞋⚪𔗢⚪𖣠 𖣠⚪𔗢⚪🞋⚪𔗢⚪𖣠 𖣠⚪𖢌𐧼𐧾ⵔ∶⸭❋ⵔⵔ𐧾❋❋ⵔ❋·𐧾❋❋ⵈ𐧾❋ⵔ𐧾❋∶ⵔⵔⵔ·𐧾ⵔ∶𐧾ⵔ𐧼··𐧾𐧾❋❋⠿𐧼ⵔⵈⵔ⁘⸭𐧾𐧾❋⸭∶∶ⵔ⠿ⵔ⁘◌⁘❋⚪𔗢⚪🞋⚪𔗢⚪❋⁘◌⁘ⵔ⠿ⵔ∶∶⸭❋𐧾𐧾⸭⁘ⵔⵈⵔ𐧼⠿❋❋𐧾𐧾··𐧼ⵔ𐧾∶ⵔ𐧾·ⵔⵔⵔ∶❋𐧾ⵔ❋𐧾ⵈ❋❋𐧾·❋ⵔ❋❋𐧾ⵔⵔ❋⸭∶ⵔ𐧾𐧼𖢌⚪𖣠 avghelper Average @[email protected] @Karcsesz That cross shape is kinda... could this be some sort of religious thing for them? Jun 05, 2024, 18:19 ·  · 0 · 0 Jun 5 [email protected] Karcsesz :bh_s_u: @[email protected] @avghelper That's my current hunch. They seem to have a love of reflections. The palindromic filenames, and the Blender files with kaleidoscopic patterns Jun 5 [email protected] Karcsesz :bh_s_u: @[email protected] @avghelper This is a creative way to circumvent ContentID :rainbowlaugh: https://www.youtube.com/watch?v=5tTaBVLF8B…4 Definitely a religious thing  YouTube ⠀ By ᙁᴥꖴᗩ⊚ᗩꖴᴥᙁ Explore Live feeds About 0%  

10%  

20%  

30%  

40%  

50%  

60%  

70%  

80%  

90%  

100% ⚪ ARCHIVE.PH [email protected] [email protected] [email protected]

archive.today webpage capture

Saved from

history←priornext→

19 May 2024 20:30:36 UTC All snapshots from host www.reddit.com

discussions in r/selfhosted

GIT ManagementMy Gitea (Forgejo) got hacked - some strange user, a very large repo (self.selfhosted) submitted 2 days ago * by DontBuyMeGoldGiveBTC Background: A few hours ago, while doing a routine Google search for my domain to check if I had inadvertently exposed any details online, I stumbled upon an unexpected mention of my git domain. Intrigued and alarmed, I dug deeper and discovered that an unknown user had created an account on my Gitea server. Update: maybe not hacked, take with a pinch of salt; registrations were open with e-mail verification, but my password didn't work. The Hack (simple account creation):

User Creation: The user, named 'O', somehow managed to activate their account in late April as if I had approved it myself. (They just verified their e-mail address.)
Repository Upload: This user uploaded a massive 4.3 GB repository with a lot update history. It was allegedly forked from https://gitea.lolumi.com/O/O (this was last updated 2 hours ago)
Password Tampering: I also found that my admin password had been changed, forcing me to reset it to log in and delete the user/repo. (Idk if it was changed, it didn't work)

On further inspection, I traced back a network of repositories all linked to this mysterious user 'O', hosted across different domains like https://git.pack.house/O/O and https://dagshub.com/O/O. Each repository is similarly structured under /O/O, and I can't for the life of me figure out why or how this user appeared in my system (seems it's just a matter of registering with the open access I didn't close). Storage network? Botnet? Full server & gitea user takeover? Security Measures:

After resetting my password, I deleted the unauthorized user and the large repository.
I did a reverse lookup on the email address [email protected] used by 'O', which suggested this wasn't their first rodeo—there seems to be a pattern of hopping onto many domains with similar setups. I encourage you to google it yourself

Moving Forward:

I've contacted a few other site owners who might be affected based on my findings.
I'm considering purging my Forgejo instance. I don't use it much, and it seems to have been compromised.

Has anyone here experienced something similar? Any advice on further preventive measures would be greatly appreciated. I'm especially curious about any insights into stopping such sophisticated intrusions at the server level. Thanks for any help or insights you can offer! edit: My repository was in a list such as this one where they post all the repositories they have forked onto open access gitea instances: https://repos.itabas.com/O/O/commit/22dcc8bd6702fda980134df7c55962eea01e4156 Conclusion: don't allow ppl to register if you don't want strange people to register. Also enable e-mail notifications and stuff for events if possible.

66 comments

all 66 comments sorted by: new [–]macojoel13 1 point 1 day ago Bro. I'm genuinely curious now about more info for it, like, what does it mean? If anything at all? Schizo programming? Bot? What is it!? Will we never know???

[–]DontBuyMeGoldGiveBTC[S] 2 points 23 hours ago If you check his Instagram and a bunch of what he's posted, I think he may just be autistic or schizophrenic with an obsession with certain concepts like astral objects, photons, etc. It's pretty hard to decipher. Honestly idk what's going on through his head but yeah it seems to just be some dude going through something or doing an art project that involves uploading his shit to hundreds if not thousands of machines.

[–]thornyfunkpuppet 1 point 6 hours ago His repo is giving me some real “Toynbee Tiles” vibes, if you’re familiar with them.

[–]macojoel13 1 point 23 hours ago Fucking crazy, this is the kind of shit that will forever remain a mistery to the internet unless the guy comes forward himself 🤣 Crazy to think this guy has planted himself in lord knows how many machines.

[–]phein4242 1 point 1 day ago Your network is compromised. Start with rebuilding (from scratch) everything which you cannot guarantee to be safe.

[–]PersonalSafe 4 points 1 day ago This user also signed up on my gitea server in April! With the same email address. They didn't create the repository and nothing has happened with my password. Erased their account just now

[–]DontBuyMeGoldGiveBTC[S] 1 point 1 day ago Aha! I was sure if I made this post here if I'd fish out a few other cases. I'm also planning to contact a bunch of people who got this repo on their server. Read these comments and close registrations hahah

[–]toxic_headshot132 2 points 1 day ago Don't really understand what the ooo is but this is kind of cool if he is using multiple repos as a storage and obfuscating it in such way making it look like a alien transcript 🤣

[–]sslnx 5 points 1 day ago Client certificate is a must if you expose your service to the internet. Just keep your root CA credentials safe, and only allowed parties will be able to establish a connection. You will definitely sleep better.

[–]DontBuyMeGoldGiveBTC[S] 3 points 1 day ago I need to read more about this. First time I see a mention.

[–]urinesamplefrommyass 1 point 1 day ago NetworkChuck Will probably have all tutorials you need. Here's a beginning

[–]DontBuyMeGoldGiveBTC[S] 1 point 1 day ago* I even set up some FRP tunnels to my computer's navidrome and shit and it turns out cloudflare provides it heh. Guess I don't need a VPS after all for this.

[–]urinesamplefrommyass 1 point 1 day ago NetworkChuck and Wolfgangs channel will probably provide most of your needs in content. I find NetworkChuck to be best for learning... Well... Network stuff, as he explains a lot like the the video provided. Wolfgangs is good for finding a better scale on your server needs and setting it up. He's got a very interesting video about what is he running on his server, with a great chapter (23:50 Yeeting my bootdrive and reinstalling from scratch) about an automation to reset everything and build his server from scratch with automations to bring everything back up.

[–]TurbulentGene694 1 point 1 day ago What the fuck are those security measures? Where are your passkeys? Why is it open to the world God I don't even wanna know what other security holes you have...

[–]DontBuyMeGoldGiveBTC[S] 1 point 1 day ago This is my only self hosted thing lol. And a closed navidrome.

[–]yeewhothis 3 points 1 day ago* def want to turn off self registration (enable the disable self registration) might want to add all this behind a reverse proxy and then add authentication on the reverse proxy level with something like authentik so anyone accessing the site has to authenticate through this before even hitting gitea/any service on cloudflare you can also block out entire continents, likely bots, and restrict access to only certain IPs to your site so you can block anyone on the cloudflare level before even touching your server

[–]AdrianTeri 3 points 1 day ago

Any advice on further preventive measures would be greatly appreciated.Any advice on further preventive measures would be greatly appreciated.

Anything that doesn't need public access do NOT avail it via 0.0.0.0/0. This includes ssh access! Since we're in a tinkerers sub at least spin up a VPN server out of your home. If you really need to expose things do your research, expose & prod them in a "sanitized" env(accessible via VPN or Localhost only), deploy them to their own sandbox & keep up/subscribe(and I mean 1st thing you wake up to) to news about the project & security bulletins.

[–]lucassou 6 points 1 day ago Based on his fantastic Instagram account he seems Russian https://www.instagram.com/oooo_oooo.oooo_oooo?igsh=NG5sOHhwbHZ3NTZu I wonder if he used some weird encoding format for his texts which the websites he uploaded his stuff to didn't like much

[–]neroeterno 16 points 1 day ago* Wtf is this Edit: and this Edit: is it possible to decode these audios and videos? Probably has some hidden messages.

[–]dibu28 -2 points 1 day ago Chat GPT-4O hiding itself encrypted 🤣🤣🤣

[–]Raupe_Nimmersatt 2 points 1 day ago Da fuq? Strong r/surrealmemes vibes

[–]Bekar_vai 5 points 1 day ago* hijacking this comment; it seems quite a lot of forgeo instance's have the same repo, by simply googling this for forgeo: inurl:O/O/src/branch gitea: inurl:O/O/commit there should be other similar repo Edit: Found more by searching 𖣠⚪𔗢⚪𖡼⚪𔗢⚪🞋⚪𔗢⚪𖡼⚪𔗢⚪𖣠

[–]neroeterno 10 points 1 day ago* What I understand is that this guy is bad at python and css. Uses firefox and is familiar with firefoxcss. Have no idea about 0.0.0.0 . Most likely created the weird symmetrical images with python. And he is making these shaders using sin, tan and cos in blender. He uses JetBrain products. And there is lot more details. Edit: His influence.co profile says he is from Belarus.

[–]liggerbreek 4 points 1 day ago There is a book about alien interviews in there as well, and some document on how to "free yourself from Microsoft and the NSA", which both seem to fit perfectly into a repo like this

[–]Djdhshsus5737 3 points 1 day ago Super bizarre. I think he's mentally ill. Check out his linktree style site. https://oooo.bio.link/

[–]neroeterno 3 points 1 day ago Probably hiding some messages. Got a lot of images and videos that looks similar and audio files with wierd beeps(or something)

[–]FactoryOfShit 35 points 1 day ago This is why Gitlab now requires credit card details to make an unrestricted account. People created bots that took user files, encrypted them, obfuscated them and then scattered them across huge gitlab repositories (with replication, so that if a bot gets banned the files aren't lost), utilizing gitlab.com's free tier as a free cloud storage (and then reselling this to people as a service).