Ciro Santilli @cirosantilli 37

Impossible?

A beautiful quote fom Edward Titchmarsh:^[ref]Ciro Santilli believes that it is perhaps for this reason that simple to state but hard to prove theorems are so attractive.

This quote was brought to Ciro Santilli's attention at: www.quantamagazine.org/recounting-the-history-of-maths-transcendental-numbers-20230627/

I have come to realize that a few of the websites do seem to use virtual hosting, i.e. multiple domains per IP, and I put a bit more manual effort into looking at known possible IPs that had a relatively small number of domains in them.

This led either to finding a few new domains, or placing existing domains in the same IP as another domains.

From now on I'll consider any IP with more than two hits to be an "IP range".

The new finds around other pre-existing domains are:

Furthermore, I now found new hits on nearby IPs of 209.162.192.49 rastadirect.net which was given by Reuters, thus establishing a new IP range there. Apparently I had simply failed to check IPs around one of the possible reverse IPs for it. The new finds are:

"Sources and methods" seems to be an official CIA/NSA terminology to talk about the main categories things that whistleblowers were not supposed to whistleblow.

It came to Ciro Santilli's attention in the Reality film about Reality Winner, and are words she apparently used extensively and which are quoted e.g. at www.theguardian.com/us-news/2022/jul/25/reality-winner-leaked-file-on-russia-election-hacking-because-public-was-being-lied-to

The term is more broadly used however outside of the NSA, e.g. it is also present on this website which talks about the CIA 2010 covert communication websites fiasco.

This seems to be a bit like CC BY-NC-SA but with the NC slightly relaxed in which you can use for commercial, just you have to give back.

This is a cool project that attempts to make it easy to emulate any of the three operating systems on QEMU.

Homepage: github.com/quickemu-project/quickemu

Introductor tutorial by Ciro Santilli: askubuntu.com/questions/884534/how-to-run-ubuntu-desktop-on-qemu/1545712#1545712 intro

Unofrtunately as of 2025 the project was falling a bit back on support, and the latest versions of the two closed source systems were buggy, tested as of quickemu 4.9.7 on Ubuntu 25.04:

Interesting, especially Peer Production License.

Bibliography:

I'm not sure about this and it's not very useful, but the following were cute.

216.105.98.132 europeantravelcafe.com is a very likely hit that:This suggests that this was an internal site management link for the site operators which was later noticed and removed across versions, leaking the management method in the process.

199.187.208.12 webofcheer.com has an exceedingly weird HTML page title:which feels like it could be a leak of an internal identifier for this website, or perhaps even worse, for the CIA program itself.

I also started to better note down the IP owner and location of each IP range from viewdns.info at Hits with nearby IP hits, as this is an important information which could offer further clues. All IPs in each range belong to the same provider, since IPs are generally bought in blocks. For example:These don't necessarily tell us directly who the CIA hosted with, since in some cases hosting providers can indirectly rent out IPs from other providers, e.g. Heroku uses AWS. But it does suggest that some nearby IP ranges were done on the same hosting provider while others weren't.

I also squeezed whoisXMLAPI harder but nothing much came out.

The vast majority of domains use domainsbyproxy.com privacy which does not seem to leak any information on their whois except dates which appear well spread out.

I did notice however that some of the sites are registered with Network Solutions, LLC and a few others in Godaddy without domainsbyproxy.com. These have names of people on them, and I did as many whoisXMLAPI searches for those names as I had the patience for.

A few had another known hit on the results, and a new hit domain came out of this: rolling-in-rapids.com which as it turns out has no Wayback machine archive, but does have a CQ Counter archive which allowed me to confirm the hit page style. That one was found by reverse searching for the registrant of alljohnny.com, "Glaze, L." on tools.whoisxmlapi.com/reverse-whois-search and its IP matches 65.218.91.9 from welcometonyc.net.

If anyone would like to donate 140 USD to dump into whoisXMLAPI I could dump all the known hit histories and have a look at them to see if anything else comes out on reverse search.