CIA 2010 covert communication websites / Possible HTML information leaks Created 2025-05-07 Updated 2026-10-23
View more
This section is about possible "real-world" information leaks found in the HTML of the pages. Domain DNS metadata may of course expose more, and is more likely to do so, this section is only about in-page findings, notably in the HTML.
We haven't found anything too mind-blowying so far, but the ones we have are curious.
The HTML <title> of webofcheer.com is cryptically set as:
pg1c
rather than a more natural title like "Web of cheer" as is the case for the other website. That identifier also appears as a comment at the start of the HTML file:
<!-- ImageReady Slices (pg1c.psd) -->
This feels like a forgotten placeholder for an internal page identifier, e.g. "page 1C" sounds plausible. At Section "HTML title element" we riefly inspected the <title> of every other hit with a wayback machine archive, and unfortunately none other seemed to have any such interesting title.
The 2010 archive of europeantravelcafe.com has a "plan your trip" link links to a different domain: secure-cert.net/~etc/transport.html. This appears to have been a link to the system used by CIA operators to manage the website. Furthermore, the link then was later removed from the 2011 version, so it was almost certainly a leak! "secure-cert.net" is obscure, the only other surviving online mention of it is www.leewillis.co.uk/wordpress-plugins/#comment-6513 to
secure-cert.net/~sayitint/products-page/bags-totes/duffel-bag/ We've grepped all the HTML downloaded as HTML analysis but no other links to it were found.
Figure 1.
2010 Wayback Machine archive of www.europeantravelcafe.com with "plan your trip" highlighted by us
. Source.
A similar thing happened to alljohnny.com Starting December 2004 the "Submit your favorite carlson quote" was mind blowingly switched to point to https://washington.serversecured.net/~alljohnn/cgi-bin/memlog.cgi thus likely leaking the control site URL. Beauty. It previously pointed to the more sensible: web.archive.org/web/20040901162621/https://secure.alljohnny.com/cgi-bin/memlog.cgi
GPT-6 noticed that at lesummumdelafinance.com the "Outils de trading" (Trading tools) bottom right section has links to file:// URLs:
  • file:///\\Gambit\charts\graphique-forex-en-temps-réel: Graphique Forex en temps réel
  • file:///\\Gambit\forex-tools\convertisseur-de-devises: Convertisseur de devises
  • file:///\\Gambit\forex-tools\calculatrice-fibonacci: Calculatrice Fibonacci
  • file:///\\Gambit\forex-tools\calculateur-de-points-pivots-forex: Calculateur de points pivots Forex
but it is unclear if this is an operational leak of if they just copy pasted it from somewhere else... Interesting though.
Read the full article