New articles - OurBigBook.com

Four-vector by

Ciro Santilli 40 Updated 2025-07-16

Light cone by

Ciro Santilli 40 Updated 2025-07-16

A subset of Spacetime diagram.

The key insights that it gives are:

future and past are well defined: every reference frame sees your future in your future cone, and your past in your past cone
Otherwise causality could be violated, and then things would go really bad, you could tell your past self to tell your past self to tell your past self to do something.
You can only affect the outcome of events in your future cone, and you can only be affected by events in your past cone. You can't travel fast enough to affect.
Two spacetime events with such fixed causality are called timelike-separated events.
every other event (to right and left, known as spacelike-separated events) can be measured to happen before or after your current spacetime event by different observers.
But that does not violate causality, because you just can't reach those spacetime points anyways to affect them.

Figure 1.
Animation showing how space-separated events can be observed to happen in different orders by observers in different frames of reference
. Source.

CIA 2010 covert communication websites / Reverse engineering by

Ciro Santilli 40 Updated 2025-07-16

In this section we document the outcomes of more detailed inspection of both the communication mechanisms (JavaScript, JAR, swf) and HTML that might help to better fingerprint the websites.

CIA 2010 covert communication websites / CGI comms by

Ciro Santilli 40 Updated 2025-07-16

We've come across a few shallow and stylistically similar websites on suspicious ranges with this pattern.

No JS/JAR/SWF comms, but rather a subdomain, and an HTTPS page with .cgi extension that leads to a login page. Some names seen for this subdomain:

secure.: most common
ssl.: also common
various other more creative ones linked to the website theme itself, e.g.:
- musical-fortune.net has a backstage.musical-fortune.net

The question is, is this part of some legitimate tooling that created such patterns? And if so which? Or are they actual hits with a new comms mechanism not previously seen?

The fact that:

hits of this type are so dense in the suspicious ranges
they are so stylistically similar between on another
citizenlabs specifically mentioned a "CGI" comms method

suggests to Ciro that they are an actual hit.

In particular, the secure and ssl ones are overused, and together with some heuristics allowed us to find our first two non Reuters ranges! Section "secure subdomain search on 2013 DNS Census"

Some currently known URLs

If we could do a crawl search for secure.*com/cgi-bin/*.cgi that might be a good enough fingerprint, maybe even *.*com/cgi-bin/*.cgi. Edit: it is not perfect, but we kind of did it: Section "secure subdomain search on 2013 DNS Census".

CIA 2010 covert communication websites / JavaScript with SHAs by

Ciro Santilli 40 Updated 2025-07-16

There are two types of JavaScript found so far. The ones with SHA and the ones without. There are only 2 examples of JS with SHA:

iraniangoals.com: web.archive.org/web/20110202091909/http://iraniangoals.com/journal.js Commented at: iraniangoals.com JavaScript reverse engineering
iranfootballsource.com: web.archive.org/web/20110202091901/http://iranfootballsource.com/futbol.js
kukrinews.com: web.archive.org/web/20100513094909/http://kukrinews.com/news.js
todaysnewsandweather-ru.com: web.archive.org/web/20110207094735/http://todaysnewsandweather-ru.com/blacksea.js

Both files start with precisely the same string:

var ms="\u062F\u0631\u064A\u0627\u0641\u062A\u06CC",lc="\u062A\u0647\u064A\u0647 \u0645\u062A\u0646",mn="\u0628\u0631\u062F\u0627\u0632\u0634 \u062F\u0631 \u062C\u0631\u064A\u0627\u0646 \u0627\u0633\u062A...\u0644\u0637\u0641\u0627 \u0635\u0628\u0631 \u0643\u0646\u064A\u062F",lt="\u062A\u0647\u064A\u0647 \u0645\u062A\u0646",ne="\u067E\u0627\u0633\u062E",kf="\u062E\u0631\u0648\u062C",mb="\u062D\u0630\u0641",mv="\u062F\u0631\u064A\u0627\u0641\u062A\u06CC",nt="\u0627\u0631\u0633\u0627\u0644",ig="\u062B\u0628\u062A \u063A\u0644\u0637. \u062C\u0647\u062A \u062A\u062C\u062F\u064A\u062F \u062B\u0628\u062A \u0635\u0641\u062D\u0647 \u0631\u0627 \u0628\u0627\u0632\u0622\u0648\u0631\u06CC \u06A9\u0646\u064A\u062F",hs="\u063A\u064A\u0631 \u0642\u0627\u0628\u0644 \u0627\u062C\u0631\u0627. \u062E\u0637\u0627 \u062F\u0631 \u0627\u062A\u0651\u0635\u0627\u0644",ji="\u063A\u064A\u0631 \u0642\u0627\u0628\u0644 \u0627\u062C\u0631\u0627. \u062E\u0637\u0627 \u062F\u0631 \u0627\u062A\u0651\u0635\u0627\u0644",ie="\u063A\u064A\u0631 \u0642\u0627\u0628\u0644 \u0627\u062C\u0631\u0627. \u062E\u0637\u0627 \u062F\u0631 \u0627\u062A\u0651\u0635\u0627\u0644",gc="\u0633\u0648\u0627\u0631 \u06A9\u0631\u062F\u0646 \u062A\u06A9\u0645\u064A\u0644 \u0634\u062F",gz="\u0645\u0637\u0645\u0626\u0646\u064A\u062F \u06A9\u0647 \u0645\u064A\u062E\u0648\u0627\u0647\u064A\u062F \u067E\u064A\u0627\u0645 \u0631\u0627 \u062D\u0630\u0641 \u06A9\u0646\u064A\u062F\u061F"

Good fingerprint present in all of them:

throw new Error("B64 D.1");};if(at[1]==-1){throw new Error("B64 D.2");};if(at[2]==-1){if(f<ay.length){throw new Error("B64 D.3");};dg=2;}else if(at[3]==-1){if(f<ay.length){throw new Error("B64 D.4")

CIA 2010 covert communication websites / Non Reuters ranges by

Ciro Santilli 40 Updated 2025-07-16

CIA 2010 covert communication websites / IP and DNS metadata by

Ciro Santilli 40 Updated 2025-07-19

Some dumps from us looking for patterns, but could not find any.

Sources of whois history include:

whois-history.whoisxmlapi.com/ from whoisXMLAPI. Notably they also have historical reverse WHOIS... tools.whoisxmlapi.com/reverse-whois-search but it needs credits. TODO we need to squeeze this a but further at some point.

When that data comes in JSON format as from whoisXMLAPI, we are going to just dump it in github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/whois.json

The vast majority of domains seem to be registered either via domainsbyproxy.com which likely intgrates with Godaddy and is widely used, and seems to give zero infromation at all about the registrar.

A much smaller number however uses other methods, some of which sometimes leak a little bit of data:

Network Solutions, LLC. These sometimes give a tiny bit of information: one name. Other times they are hidden behind Perfect Privacy, LLC. Examples>
- alljohnny.net: L. Glaze. tools.whoisxmlapi.com/reverse-whois-search "Glaze, L." has
  - webstorageforme.com. web.archive.org/web/20130917230604/http://webstorageforme.com/ broken, cqcounter.com/whois/www/webstorageforme.com.html blank
  - welcometonyc.net. Hit!
  - international-smallbusiness.com. Same IP as alljohnny.net and quite possibly hit..
  - alljohnny.com. Hit!
  - locateontheweb.com. cqcounter.com/whois/www/locateontheweb.com.html broken/test page
  - rolling-in-rapids.com. web.archive.org/web/20111101080224/rolling-in-rapids.com no archives but cqcounter.com/whois/www/rolling-in-rapids.com.html hit style! viewdns.info/iphistory/?domain=rolling-in-rapids.com puts it at:
    208.91.197.132 British Virgin Islands CONFLUENCE-NETWORK-INC 2014-01-31
    65.218.91.9 United States UUNET 2013-12-20 so matchwith welcometonyc.com but not listed at viewdns.info/reverseip/?t=1&host=65.218.91.9 because of the viewdns.info reverse IP bug!
- differentviewtoday.com: tools.whoisxmlapi.com/whois-history-search kind of empty no name
Pulley, Tammy
- golf-on-holiday.com: Pulley, Tammy. No tools.whoisxmlapi.com/whois-history-search reverse hits.
- intoworldnews.com: Benjamin McGrew. Only that hit for reverse name at tools.whoisxmlapi.com/reverse-whois-search
- magneticfieldnews.com: Sarah Lowell tools.whoisxmlapi.com/reverse-whois-search has 9 domains
  - sarahlowell.com: web.archive.org/web/20110208130657/http://sarahlowell.com/ Yoga instructor.
  - puppychallengesacademy.com
  - sarahlowelldogtraining.com
  - puppychallenges.com. web.archive.org/web/20130517151924/http://puppychallenges.com/ wordpress.
  - puppychallenges.net
  - realwomensduathlon.com. No archives of era: web.archive.org/web/20180808101430/http://realwomensduathlon.com/
  - magneticfieldnews.com. Hit.
  - highflyingagility.com. Legit? Service offer.
  - ropies.com. web.archive.org/web/20111101080224/http://ropies.com/
- medicatechinfo.com: Jason Noll. Has the following hits at tools.whoisxmlapi.com/reverse-whois-search
  - dreamschemedesigns.com. Legit
  - dreamschemedesigns.net
  - aviationturbinesinternational.com. No relevant archives.
  - garysluhan.com. Seems legit.
  - cjlogic.com: registrar Godaddy (not Network Services!) and contact:
    Noll, Jason noll.jason@gmail.com 104 Southridge Ct. Marthasville, Missouri 63357 United States (660) 441-0780 Fax --
    This image is his Gmail's current profile image as of 2025: openclipart.org/detail/19437/high-wing-airplane
  - medicatechinfo.com. Hit.
  - health-men-today.com. Hit. Holy fuck it has two hits out of 7!!!
- mydailynewsreport.com: Rebecca Melancon on tools.whoisxmlapi.com/reverse-whois-search:
  - rebecca-melancon.com. web.archive.org/web/20180808172531/http://rebecca-melancon.com/ pilates teacher
  - swlabuyahome.net
  - swlalistmyhome.net
  - rebeccaworking4yousite.com
  - mylakecharlescityguide.com
  - swlalistmyhome.com
  - rebeccaworking4you.com
  - swlabuyahome.com
  - calcasieuhouses.com web.archive.org/web/20111013212502/http://calcasieuhouses.com/. Wordpress. Copyright Rebecca Melancon, Equal Housing Opportunity.
    Message from Rebecca
    Welcome to Calcasieu Houses! Here you will find not only information about Real Estate in Calcasieu Parish & the Lake Charles area, but also information about the area itself. I am constantly adding content so please check back often. I can help you with relocation, buying, selling, as well as looking for a great restaurant or a new activity to do! There will be information on Lake Charles, Sulphur, Westlake, & Moss Bluff. If you have something you would like to see added to the website, please feel free to contact me!
  - mydailynewsreport.com. Hit.
- plugged-into-news.net: Godfrey Hubbard. Searching tools.whoisxmlapi.com/reverse-whois-search for two terms "Godfrey" "Hubbard" gives a small list of 20 domains including plugged-into-news.net. They all appear to have both words in them. Searching just "Hubbard, Godfrey" has only 3 hits:
  - hubbardgodfrey.online
  - plugged-into-news.net
  - hubbardgodfrey.com
  so it seems to match the strings exactly!
but presumably these are the names of employees of the company? We are yet to see two identical names however, which also suggests fake names. Network Solutions appears to offer both hosting and domain registration, and the CIA seems to have used this service combo a lot.
godaddy without domainsbyproxy.com: a few of the websites are registered in Godaddy without domainsbyproxy. These might be the ones that gives out the most information:
- baocontact.com

Big question: webmasters.stackexchange.com/questions/13237/how-do-you-view-domain-whois-history DomainTools also has it.

How on Earth did did Citizen Labs find what seems to be a DNS fingerprint??? Are there simply some very rare badly registered domains? What did they see!

Fast travel by

Fast travel is a gameplay mechanic commonly found in video games, particularly in open-world and role-playing games (RPGs). It allows players to quickly move between locations on the game map without needing to travel the distance in real-time. This feature is often implemented to save time and enhance the gaming experience by allowing players to focus on other aspects of the game, such as quests or exploration.

Ship load by

"Ship load" typically refers to the quantity of goods, cargo, or materials that a ship is designed to carry. It can relate to various measurements, including: 1. **Deadweight Tonnage (DWT)**: This is the maximum weight a ship can safely carry, including cargo, fuel, crew, provisions, and any other items. 2. **Cargo Capacity**: This specifically refers to the volume or weight of goods that can be loaded onto the ship for transport.

James Clerk Maxwell by

Ciro Santilli 40 Updated 2025-07-16

Phosphorescence by

Ciro Santilli 40 Updated 2025-07-16

Dot-com bubble by

Ciro Santilli 40 Updated 2025-07-16

Body mass index by

Body Mass Index (BMI) is a numerical value derived from a person's weight and height, used as a screening tool to categorize individuals into different weight status categories.

Encyclopedia of Triangle Centers by

The Encyclopedia of Triangle Centers is a comprehensive resource dedicated to the study of various notable points associated with triangles, known as triangle centers. These include well-known centers such as the centroid, orthocenter, circumcenter, and incenter, among many others. The encyclopedia aims to catalog these centers, providing their mathematical properties, relationships, formulas, and sometimes historical contexts. The work typically includes both theoretical aspects and practical applications, offering insights that could be beneficial for mathematicians, educators, and students.

Inspec by

Inspec is an open-source testing framework primarily used for infrastructure as code (IaC) compliance and security auditing. Developed by the company Chef, Inspec allows users to write automated tests for their applications and infrastructure, validating that they meet specific compliance and security requirements. Key features of Inspec include: 1. **Human-Readable DSL**: Inspec uses a domain-specific language (DSL) that is easy for both developers and non-developers to understand, enabling clear and concise test definitions.

Computational economics by

Computational economics is an interdisciplinary field that utilizes computational methods and techniques to analyze economic models, conduct simulations, and solve complex economic problems. It combines elements from economics, computer science, mathematics, and statistics to better understand economic systems and behavior. Key features of computational economics include: 1. **Modeling Complexity**: Economic systems are often complex, involving multiple agents with diverse behaviors and interactions.

Contract theory by

Contract theory is a field of study in economics and legal studies that examines how individuals and organizations formulate contracts and agreements in the presence of uncertainty and varying information. It focuses on the design, enforcement, and implications of contracts in various contexts, considering factors such as incentives, moral hazards, and the allocation of risks among contracting parties.

Ergodicity economics by

Ergodicity economics is an approach to understanding economic systems that emphasizes the difference between time averages and ensemble averages in the context of decision-making under uncertainty. The term "ergodicity" comes from statistical mechanics, where it refers to systems that exhibit the same statistical properties over time as they do across different states or configurations.

Mean-field game theory by

Mean-field game theory (MFG) is a mathematical framework used to analyze strategic interactions among a large number of agents, each of whom makes decisions based on their own objectives while considering the collective impact of all agents on the system. The essential idea of MFG is that as the number of players becomes very large, the effect of any individual player on the overall dynamics becomes negligible. Instead, each player interacts with the statistical distribution of all other players.