CIA 2010 covert communication websites / Possible HTML information leaks Created 2025-05-07 Updated 2026-10-23
View more
This section is about possible "real-world" information leaks found in the HTML of the pages. Domain DNS metadata may of course expose more, and is more likely to do so, this section is only about in-page findings, notably in the HTML.
We haven't found anything too mind-blowying so far, but the ones we have are curious.
The HTML <title> of webofcheer.com is cryptically set as:
pg1c
rather than a more natural title like "Web of cheer" as is the case for the other website. That identifier also appears as a comment at the start of the HTML file:
<!-- ImageReady Slices (pg1c.psd) -->
This feels like a forgotten placeholder for an internal page identifier, e.g. "page 1C" sounds plausible. At Section "HTML title element" we riefly inspected the <title> of every other hit with a wayback machine archive, and unfortunately none other seemed to have any such interesting title.
The 2010 archive of europeantravelcafe.com has a "plan your trip" link links to a different domain: secure-cert.net/~etc/transport.html. This appears to have been a link to the system used by CIA operators to manage the website. Furthermore, the link then was later removed from the 2011 version, so it was almost certainly a leak! "secure-cert.net" is obscure, the only other surviving online mention of it is www.leewillis.co.uk/wordpress-plugins/#comment-6513 to
secure-cert.net/~sayitint/products-page/bags-totes/duffel-bag/ We've grepped all the HTML downloaded as HTML analysis but no other links to it were found.
Figure 1.
2010 Wayback Machine archive of www.europeantravelcafe.com with "plan your trip" highlighted by us
. Source.
A similar thing happened to alljohnny.com Starting December 2004 the "Submit your favorite carlson quote" was mind blowingly switched to point to https://washington.serversecured.net/~alljohnn/cgi-bin/memlog.cgi thus likely leaking the control site URL. Beauty. It previously pointed to the more sensible: web.archive.org/web/20040901162621/https://secure.alljohnny.com/cgi-bin/memlog.cgi
GPT-6 noticed that at lesummumdelafinance.com the "Outils de trading" (Trading tools) bottom right section has links to file:// URLs:
  • file:///\\Gambit\charts\graphique-forex-en-temps-réel: Graphique Forex en temps réel
  • file:///\\Gambit\forex-tools\convertisseur-de-devises: Convertisseur de devises
  • file:///\\Gambit\forex-tools\calculatrice-fibonacci: Calculatrice Fibonacci
  • file:///\\Gambit\forex-tools\calculateur-de-points-pivots-forex: Calculateur de points pivots Forex
but it is unclear if this is an operational leak of if they just copy pasted it from somewhere else... Interesting though.
Read the full article
CIA 2010 covert communication websites / Possible media leaks 2026-10-23
View more
GPT-6 noticed the following not so mind-blowing facts about some media present in some of the websites
33 images on stickshiftnews.com record Photoshop saves on 2010-08-24, 14:16:41–14:17:50 at UTC-4 (Langley): a 69-second batch. This supports batch asset preparation possibly from ImageReady, and also gives us the exact Photoshop version used and operating system: Adobe Photoshop CS4 (released 2008). They used Windows. That's the real reason the network went down!
exiftool -r -q -if '$HistoryWhen' -p '$HistoryWhen | $HistoryAction | $HistorySoftwareAgent | $Directory/$FileName' stickshiftnews.com | sort
gives:
2010:08:24 14:16:41-04:00 | created | Adobe Photoshop CS4 Windows | stickshiftnews.com/20110207233507/images/199.jpg
2010:08:24 14:16:44-04:00 | saved | Adobe Photoshop CS4 Windows | stickshiftnews.com/20110207232515/images/2.jpg
...
2010:08:24 14:17:50-04:00 | created | Adobe Photoshop CS4 Windows | stickshiftnews.com/20110207232233/images/9.jpg
Four graphics across ballbatstumpsandbails.com and myhealthlibrary.net share uuid:B48CC374F6E2DC1193D6E593F704EF94:
exiftool -r -q -if '$OriginalDocumentID eq "uuid:B48CC374F6E2DC1193D6E593F704EF94"' -p '$Directory/$FileName | $OriginalDocumentID' ballbatstumpsandbails.com www.myhealthlibrary.net
gives:
ballbatstumpsandbails.com/20110202033048/images/bbsb-logo.jpg | uuid:B48CC374F6E2DC1193D6E593F704EF94
ballbatstumpsandbails.com/20110202033025/images/cornerimg.jpg | uuid:B48CC374F6E2DC1193D6E593F704EF94
www.myhealthlibrary.net/20111015023625/images/back.gif | uuid:B48CC374F6E2DC1193D6E593F704EF94
www.myhealthlibrary.net/20111015023519/images/top.jpg | uuid:B48CC374F6E2DC1193D6E593F704EF94
However that same UUID also appears on a few unrealted Google hits e.g.:
so it cannot reliably establish a connection between their operators. TODO how did that come about. LLMs say that this UUID comes from PhotoShop and depends on the exact version, but they are not fully clear on the details of how they come about.
Read the full article