Ciro Santilli @cirosantilli 35

 Articles  Discussions  Comments  Follows  Received likes

 New  Updated  Top  Announced  A-Z  Liked  Followed

Histogram  Updated 2025-03-28  +Created 1970-01-01

IP range search  Updated 2025-03-28  +Created 1970-01-01

One promising way to find more of those would be with IP searches, since it was stated in the Reuters article that the CIA made the terrible mistake of using several contiguous IP blocks for those website. What a phenomenal OPSEC failure!!!

The easiest way would be if Wayback Machine itself had an IP search function, but we couldn't find one: Search Wayback Machine by IP.

viewdns.info was the first easily accessible website that Ciro Santilli could find that contained such information.

Our current results indicate that the typical IP range is about 30 IPs wide.

E.g. searching: viewdns.info/iphistory and considering only hits from 2011 or earlier we obtain:

capture-nature.com
- 65.61.127.163 - Greenacres - United States - TierPoint - 2013-10-19
activegaminginfo.com
- 66.175.106.148 - United States - Verizon Business - 2012-03-03
iraniangoals.com
- 68.178.232.100 - United States - GoDaddy.com - 2011-11-13
- 69.65.33.21 - Flushing - United States - GigeNET - 2011-09-08
rastadirect.net
- 68.178.232.100 - United States - GoDaddy.com - 2011-05-02
iraniangoalkicks.com
- 68.178.232.100 - United States - GoDaddy.com - 2011-04-04
headlines2day.com
- 118.139.174.1 - Singapore - Web Hosting Service - 2013-06-30. Source: viewdns.info
- 184.168.221.91 2013-08-12T06:17:39. Source: 2013 DNS Census grep
fightwithoutrules.com
- 204.11.56.25 - British Virgin Islands - Confluence Networks Inc - 2013-09-26
- 208.91.197.19 - British Virgin Islands - Confluence Networks Inc - 2013-05-20
- 212.4.17.38 - Milan - Italy - MCI Worldcom Italy Spa - 2012-03-03
fitness-dawg.com
- 219.90.62.243 - Taiwan - Verizon Taiwan Co. Limited - 2012-01-11

Neither of these seem to be in the same ranges, the only common nearby hit amongst these ranges is the exact 68.178.232.100, and doing reverse IP search at viewdns.info/reverseip/?host=68.178.232.100&t=1 states that it has 2.5 million hostnames associated to it, so it must be some kind of Shared web hosting service, see also: superuser.com/questions/577070/is-it-possible-for-many-domain-names-to-share-one-ip-address, which makes search hard.

Ciro then tried some of the other IPs, and soon hit gold.

Initially, Ciro started by doing manual queries to viewdns.info/reversip until his IP was blocked. Then he created an account and used his 250 free queries with the following helper script: cia-2010-covert-communication-websites/viewdns-info.sh. The output of that script can be seen at: github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/viewdns-info.sh.

Ciro then found 2013 DNS Census which contained data highly disjoint form the viewdns-info one!

Summaries of the IP range exploration done so far follows, combined data from all databases above.

 Read the full article

Wakatime redirects  Updated 2025-03-28  +Created 1970-01-01

 View more

Summary: this is just a red herring. Wakatime owner likely registered the domains just after this article was published as a publicity stunt. Fair play though.

As raised at: news.ycombinator.com/item?id=36280666, many, but not all, of the domains currently redirect to wakatime.com/ as of 2023, and apparently they were taken up in 2013 (TODO how to confirm that). TODO what is the explanation for that? Some examples that do:

But some failed resolution examples:

Even more suspiciously, according to his LinkedIn: www.linkedin.com/in/alanhamlett/, the owner of Wakatime, Alan Hamlett, worked at WhiteHat Security, Inc from Aug 2011 - Sep 2013. The company was then acquired by Synopsys in 2022. Holy crap!!! As shown at: web.archive.org/web/20131013193406/https://www.whitehatsec.com/ that company made website security tools. Did that dude use the tools to find the vulnerabilty and then just gobble up all the domains??? What a fucking legend if he did!!!

Let's try:

host.io/redirects/wakatime.com: failure
www.whatsmydns.net/redirect-checker?q=wakatime.com: failure
app.neilpatel.com/en/seo_analyzer/backlinks?domain=wakatime.com&mode=domain: failure

Running e.g.

curl -vvv dedrickonline.com

gives:

*   Trying 162.255.119.197:80...
* Connected to dedrickonline.com (162.255.119.197) port 80 (#0)
> GET / HTTP/1.1
> Host: dedrickonline.com
> User-Agent: curl/7.88.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Mon, 12 Jun 2023 20:30:19 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 55
< Connection: keep-alive
< Location: https://wakatime.com
< X-Served-By: Namecheap URL Forward
< Server: namecheap-nginx
< 
<a href='https://wakatime.com'>Moved Permanently</a>.

* Connection #0 to host dedrickonline.com left intact

so we see that he must have setup redirection with Namecheap as mentioned at: www.namecheap.com/support/knowledgebase/article.aspx/385/2237/how-to-redirect-a-url-for-a-domain/

Let's also try DNS history

whoisrequest.com/history/:
- dedrickonline.com: registered: 1 Nov, 2010, dropped: 24 Nov, 2013
- activegaminginfo.com : registered: 1 Feb, 2010, dropped: 1 Apr, 2012
tools.whoisxmlapi.com/whois-history-search
- dedrickonline.com:
  - CIA (registrar: Godaddy, registrant name: domainsbyproxy.com)
    Created Date: October 27, 2010 00:00:00 UTC
    Updated Date: October 28, 2013 00:00:00 UTC
    Expires Date: October 27, 2014 00:00:00 UTC
  - Alan (namecheap):
    Created Date: June 11, 2023 09:59:25 UTC
    Expires Date: June 11, 2024 09:59:25 UTC
- activegaminginfo.com:
  - CIA (Network Solutions, registrant name: LLC. Corral, Elizabeth|ATTN ACTIVEGAMINGINFO.COM|care of Network Solutions)
    Created Date: January 26, 2010 00:00:00 UTC
    Updated Date: November 27, 2010 00:00:00 UTC
    Expires Date: January 26, 2012 00:00:00 UTC
  - Alan:
    Created Date: June 11, 2023 09:59:40 UTC
    Expires Date: June 11, 2024 09:59:40 UTC
- iraniangoalkicks.com:
  - CIA (registrar: Godaddy, registrant name: domainsbyproxy.com)
    Created Date: April 9, 2007 00:00:00 UTC
    Updated Date: March 2, 2011 00:00:00 UTC
    Expires Date: April 9, 2011 00:00:00 UTC
  - Alan:
    Created Date: June 11, 2023 09:59:20 UTC
    Expires Date: June 11, 2024 09:59:20 UTC
- iraniangoals.com:
  - CIA (registrar: Godaddy, registrant name: domainsbyproxy.com):
    Created Date: March 6, 2008 00:00:00 UTC
    Updated Date: March 7, 2011 00:00:00 UTC
    Expires Date: March 6, 2014 00:00:00 UTC
  - Reuters:
    Created Date: September 29, 2022 11:16:09 UTC
    Updated Date: September 29, 2022 11:16:09 UTC
    Expires Date: September 29, 2023 11:16:09 UTC

So these suggest Alan might have just come along in 2023 way after the 2022 Reuters article and did the same basic IP range search that Ciro is doing now, so possibly no new tech. Let's ask... twitter.com/cirosantilli/status/1668369786865164289

The domain name history presented is however of interest, and could lead to patterns being found.

Searching tools.whoisxmlapi.com/reverse-whois-search with term "Corral, Elizabeth" gave no results unfortunately.

Basic search under tools.whoisxmlapi.com/reverse-whois-search for "Corral" also empty. They can't see their own data? Ah, need advanced. Marked "Historic" and selected "Corral, Elizabeth", ony one hit, activegaminginfo.com.

 Read the full article

IP and DNS metadata  Updated 2025-03-28  +Created 1970-01-01

 View more

Some dumps from us looking for patterns, but could not find any.

 Read the full article

Instruction pipelining  Updated 2025-03-28  +Created 1970-01-01

 View more

The first thing you must understand is the Classic RISC pipeline with a concrete example.

 Read the full article

Themes  Updated 2025-03-28  +Created 1970-01-01

 View more

In this section we document events that led to a large number of thematically related messages being added to the chain e.g. referencing some current event that happened, as opposed to the media encoding/type like images and text sections.

The "Hitler did nothing wrong" meme ^[ref] is repeated several times, e.g.: tx 41967a7d75e9e1ca8c142a45ce29ea08b451a3b55c3e33538f5cc8a389ec66ab (2015-07-20):

EW Hitler did nothing wrong.

This one is also an Eternity Wall message. The message had also been previously Base58 encoded at address 1HitLerDidNothingWrongggggghJewfv in two different instances:

tx 55654178fe601c1fbe8b52b544286962523f11ec60ef12c94bc55198bb8c405c block 216909 (2013-01-17). That one is also followed by some other niceties:
- 1NiggersNiggersNiggersNiggerwxhs77: 4x "Niggers"
- 1JewsDidTheEconomyXXXXXXXXXXbd7ZkE: "Jews Did the Economy"
tx daa7fa928b8079174a646a9456ce9dad14eac44beb2fe5a2cb1c35ce70e92916 block 310007 (2014-07-10)

Brazil:

tx 1c05bb7c0a8c9498d33a1e6d4a91bbb4c651daa5ea5a21aa5c8c600d3300b8bb Viva Brazil's Impeachment!
tx 105fb3a0be8ab50bfa36012e0319a752dee39702cb44f3904cf423eb20367d57 contains a misogenous joke:
A mulher feia so tem uma coisa a oferecer,uma boa foda(Diego Silva de Oliveira)
which translates to:
Ugly women only have one thing to offer, a good fuck
It is attributed to Diego Silva de Oliveira, possibly this football player: en.wikipedia.org/wiki/Diego_Silva_(footballer,_born_1990)

c72dc315a5504362d01f2dcdfe77826d14a9eb3411b83edd7aa782e95e4a7794 via cryptograffiti.info:

NÓS DISSEMOS SIM
AGÊNCIA TRANSITIVA 2015

Nota pública de reconhecimento do Acordo Reconformado, assinado pela Agência Transitiva e 
pela Escola de Artes Visuais do Parque Lage, em 22 de Abril de 2015.

#ENCRUZILHADA
EAV PARQUE LAGE
22.04.2015

1c05bb7c0a8c9498d33a1e6d4a91bbb4c651daa5ea5a21aa5c8c600d3300b8bb via cryptograffiti.info:
Viva Brazil's Impeachment!

Our indexer does not handle UTF-8, here's a collection of some UTF-8 messages we've stumbled upon somewhat randomly:

Arabic:

7eb561f2139761064de20033fa4843f1f3e1a9551268704b36f84d94e66fd91a
يا سلم!
شعرك جميل
و عينيك حلوة
انا عطشان
اِروني من عينيك
O peace!
Your hair is beautiful
And your eyes are beautiful
I'm thirsty
Show me from your eyes
b7376cae03b88392e5fd0292bcb43105386fbb534fc9be68c1e3d0b8f39e5ba4 via cryptograffiti.info
sjalom, salaam, peace!
الدين
7a898b7e6b2145f4f887e1ff890d0b613e3008fbe350aa92662735e3acd0c0bc
هذه رسالة من المستقبل
إلى الماضي ...
الحياة صعبة في المستقبل
رعاية العالم
وتحمل المسؤولية
/y
This is a message from the future
To the past...
Life is difficult in the future
Caring for the world
And take responsibility
/y

Russian:

1dcd62c922eb1ddbc1f58615b6271d64736bf55e83408cef02a7d0ac6707e423 via cryptograffiti.info
А на Земле Быть Добру!
And on Earth To Be Good!
596cc6e905a5fc8248cf59198a19ce5070228b302a9f3a993197e2c87ddcaf14 via cryptograffiti.info
Книга Вечно Живущих открыта
The Book of the Ever-Living is open
596cc6e905a5fc8248cf59198a19ce5070228b302a9f3a993197e2c87ddcaf14 via cryptograffiti.info
Это тест, сука блять.
This is a test, motherfucker.
ed56ef68ccbfb1d47bc159fb62fab6807ee4d7363d0ad4cded2e922a5b47362e via cryptograffiti.info
Путин хуйло лалалалалалалалалал
Putin sucks lalalalalalalalala

Chinese:

12b32b6752fbf521243c63dfb5e3fda46523dd7b572143635458f743591d3e35 via cryptograffiti.info:
中文測試
Chinese test
a3dbd6cbb8637b6bf91d22ea97db2843d995498fd62740b9ed1e9dc068f2ad2d via cryptograffiti.info
- R.I.P aaarobbie（書玄）
Ordinal ruleset inscription
- tx 8e89ce6bef85aea795f41f97a4dcd550d8cbc6d1f606f37109f6dc8b31f91bc1: Diamond Sutra in Chinese. Again at tx 0bc660cc2c6d0ec4f7dfe61bfb3a592b4a65677b16da7db35729fd43eee5323e.
- tx 7b0a0b9f18a729e905822304f9c4c05f8851d10bdc82efa902fd936ef874efeb: the first few poems from Three Hundred Tang Poems, a collection of famous Chinese poems from the Tang dynasty compiled in 1763. Each poem uses a classical Chinese poetry form with a small number of verses, usually 4, and fits into one line. Most lines contain the poem title, dynasty, author name followed by the poem, e.g. the first line:
  《春晓》唐文嘉春眠不觉晓，处处闻啼鸟。夜来风雨声，花落知多少。
  is amazingly translated by Google Translate as:
  "Spring Dawn" by Wenjia of the Tang Dynasty: When I sleep in spring, I don't realize the dawn, and I hear the singing of birds everywhere. The night comes wind and rain, Whispering Colour.

Japanese:

ac2ad7c15162a8e461387b0d0d681bb5f81f2db1138b8f200b81bbc585bd0b8f via cryptograffiti.info:
モキーのフラッシュバン許すな
Don't forgive Moky's flashbang

Hebrew:

0b32736592ce7abdd4d971bc4591544e1610ff51f498c9a14a6ba34a3abcad5d via cryptograffiti.info
חתימה טובה לכולם בכלל ולחברי ביטקוין ישראלי בפרט.
A good signature for everyone in general and Israeli Bitcoin members in particular.
d7b80c8fefc88cc3f06d74f8496e2dc6f44b5f5f0a59f9ba1ba27266848a8666 via cryptograffiti.info contains what appears to be UTF-8 Hebrew text on my terminal, but Google Translate couldn't translate it, so we are unsure.

 Read the full article

Android Open Source Project  Updated 2025-03-28  +Created 1970-01-01

 Read the full article

F-Droid  Updated 2025-03-28  +Created 1970-01-01

 Read the full article

GNU Assembler  Updated 2025-03-28  +Created 1970-01-01

 Read the full article

How to convert async to sync in JavaScript  Updated 2025-03-28  +Created 1970-01-01

 View more

God, it's impossible! You just have to convert the entire fucking call stack all the way up to async functions. It could mean refactoring hundreds of functions.

To be fair, there is a logic to this, if you put yourself within the crappiness of the JavaScript threading model. And Python is not that much better with its Global Interpreter Lock.

The problem is that async was introduced relatively late, previously we just had to use infinitely deep callback trees, which was worse:

myAsync().then(ret => myAsync2(ret).then(ret2 => myAsync3(re3)))

compared to the new infinitely more readable:

ret = await myAsync()
ret2 = await myAsync2(ret)
ret3 = await myAsync3(ret3)

But now we are in an endless period of transition between both worlds.

It is also worth mentioning that callbacks are still inescapable if you really want to fan out into a non-linear dependency graph, usually with Promise.all:

await Promise.all([
  myAsync(1).then(ret => myAsync2(ret)),
  myAsync(2).then(ret => myAsync2(ret)),
])

Bibliography:

And then, after many many hours of this work, you might notice that the new code is way, way way slower than before, because making small functions async has a large performance impact: madelinemiller.dev/blog/javascript-promise-overhead/. Real world case with a 4x slowdown: github.com/ourbigbook/ourbigbook/tree/async-slow.

Anyways, since you Googled here, you might as well learn the standard pattern to convert callbacks functions into async functions using a promise: stackoverflow.com/questions/4708787/get-password-from-input-using-node-js/71868483#71868483