There are two types of JavaScript found so far. The ones with SHA and the ones without. There are only 2 examples of JS with SHA:Both files start with precisely the same string:
- iraniangoals.com: web.archive.org/web/20110202091909/http://iraniangoals.com/journal.js Commented at: iraniangoals.com JavaScript reverse engineering
- iranfootballsource.com: web.archive.org/web/20110202091901/http://iranfootballsource.com/futbol.js
- kukrinews.com: web.archive.org/web/20100513094909/http://kukrinews.com/news.js
- todaysnewsandweather-ru.com: web.archive.org/web/20110207094735/http://todaysnewsandweather-ru.com/blacksea.js
var ms="\u062F\u0631\u064A\u0627\u0641\u062A\u06CC",lc="\u062A\u0647\u064A\u0647 \u0645\u062A\u0646",mn="\u0628\u0631\u062F\u0627\u0632\u0634 \u062F\u0631 \u062C\u0631\u064A\u0627\u0646 \u0627\u0633\u062A...\u0644\u0637\u0641\u0627 \u0635\u0628\u0631 \u0643\u0646\u064A\u062F",lt="\u062A\u0647\u064A\u0647 \u0645\u062A\u0646",ne="\u067E\u0627\u0633\u062E",kf="\u062E\u0631\u0648\u062C",mb="\u062D\u0630\u0641",mv="\u062F\u0631\u064A\u0627\u0641\u062A\u06CC",nt="\u0627\u0631\u0633\u0627\u0644",ig="\u062B\u0628\u062A \u063A\u0644\u0637. \u062C\u0647\u062A \u062A\u062C\u062F\u064A\u062F \u062B\u0628\u062A \u0635\u0641\u062D\u0647 \u0631\u0627 \u0628\u0627\u0632\u0622\u0648\u0631\u06CC \u06A9\u0646\u064A\u062F",hs="\u063A\u064A\u0631 \u0642\u0627\u0628\u0644 \u0627\u062C\u0631\u0627. \u062E\u0637\u0627 \u062F\u0631 \u0627\u062A\u0651\u0635\u0627\u0644",ji="\u063A\u064A\u0631 \u0642\u0627\u0628\u0644 \u0627\u062C\u0631\u0627. \u062E\u0637\u0627 \u062F\u0631 \u0627\u062A\u0651\u0635\u0627\u0644",ie="\u063A\u064A\u0631 \u0642\u0627\u0628\u0644 \u0627\u062C\u0631\u0627. \u062E\u0637\u0627 \u062F\u0631 \u0627\u062A\u0651\u0635\u0627\u0644",gc="\u0633\u0648\u0627\u0631 \u06A9\u0631\u062F\u0646 \u062A\u06A9\u0645\u064A\u0644 \u0634\u062F",gz="\u0645\u0637\u0645\u0626\u0646\u064A\u062F \u06A9\u0647 \u0645\u064A\u062E\u0648\u0627\u0647\u064A\u062F \u067E\u064A\u0627\u0645 \u0631\u0627 \u062D\u0630\u0641 \u06A9\u0646\u064A\u062F\u061F"
Good fingerprint present in all of them:
throw new Error("B64 D.1");};if(at[1]==-1){throw new Error("B64 D.2");};if(at[2]==-1){if(f<ay.length){throw new Error("B64 D.3");};dg=2;}else if(at[3]==-1){if(f<ay.length){throw new Error("B64 D.4")
feedsdemexicoyelmundo.com JavaScript reverse engineering Updated 2025-02-26 +Created 1970-01-01
The JavaScript of each website appears to be quite small and similarly sized. They are all minimized, but have reordered things around a bit.
For example consider: web.archive.org/web/20110202190932/http://feedsdemexicoyelmundo.com/mundo.js
First we have to know that the Wayback Machine adds some stuff before and after the original code. The actual code there starts at:and ends in:
ap={fg:['MSXML2.XMLHTTP
ck++;};return fu;};
We can use a JavaScript beautifier such as beautifier.io/ to be abe to better read the code.
It is worth noting that there's a lot of
<script>
tags inline as well, which seem to matter.Further analysis would be needed.
Marc Verdiell is a French electrical engineer born in 1963 or 1964[ref] and best known for being the creator and host of the CuriousMarc YouTube channel where he does mind blowing repairs and reverse engineering of vintage computers and other electronic equipment.
Marc made $58.4m from the sale of LightLogic, an optoelectronics company he founded, to Intel in April 2001. This was just after the dot-com crash, but Intel apparently still correctly believed that the networking and the Internet would continue to grow and was investing in the area. His associate Frank Shum sued claiming he should be credited for some of the inventions sold but lost and Marc got it all.[ref][ref][ref]. Marc was then almost immediately appointed an Intel fellow at the extremelly early age of 37, and then stayed for a few years at Intel until 2006 according to his LinkedIn.[ref][ref]
Marc's LinkedIn profile: www.linkedin.com/in/marc-verdiell-9742795/
Marc's full name is actualy Jean-Marc Verdiell, but Ciro Santilli remembers there was one YouTube video where he mentions he gave up on "Jean" partly because anglophones would murder its pronounciation all the time.
ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20160274316 also suggests he may have a seldom used middle name "André", though that would be unusual in French custom
Marc's PhD thesis is listed at: theses.fr/1990PA112048 and it is entitled:which is translated into English as:but the full text is not available online.
Mise en phase de reseaux de lasers a semi-conducteur
Phase locking of semiconductor laser arrays
Marc appears to be have had a small court battle with some building contractors led by the Yip family, Cynthia Yip and Wai Yip, as Javelin Construction Inc.. TODO what was that about? There are various online records and the appeals just seem to drag on and on and on:
- unicourt.com/case/ca-sca1-casebs75f41d4e0c56-225236
- trellis.law/doc/216647972/2024-09-09-pos-re-sat-jdgmt-file This mentions e.g. the existence of the "Verdiell Family Trust" entity. I guess that's how richer people go about it.
- 2021 Verdiell et al. v. Superior Court for the County of San Mateo unicourt.com/case/ca-sca1-verdiell-et-al-v-superior-court-for-the-county-of-san-mateo-153300
Profile of Marc Verdiell by Gizmodo (2018)
Source. youtu.be/tJ2-kkhghD4?t=74 gives his house's location Atherton, California, part of Silicon Valley. youtu.be/tJ2-kkhghD4?t=279 shows his amazing garden a bit more.
radaris.com/p/Jean-Marc/Verdiell/ and many other sources list the exact address as:On Google Maps: maps.app.goo.gl/LM2iN9fz6YBteggp8
48 Linden Ave, Atherton, CA 94027
www.realtyhop.com/property-records/search/hoang-oanh-verdiell mentions that the property was bought on 2013-11-07 for $8,650,000 and lists other properties they've bought and sold and possibly inhabited:
- 2002-03-21: sold 4159 El Camino Way, Palo Alto, CA Unit B
- 2001-06-18: bought 763 Florales Dr, Palo Alto, CA
www.youtube.com/watch?v=gEcnjh0lSsY give a tour of the house given by the real state agent Ken DeLeon. The dude has a very suspicious Wikipedia page: en.wikipedia.org/wiki/Ken_DeLeon He is mentioend e.g. at www.forbes.com/sites/erincarlyle/2013/12/20/ken-deleon-top-silicon-valley-sales-agent-why-chinese-buyers-love-palo-alto/ as selling a lot to the Chinese.
A quick look on Google Maps show that that area is full of some incredible mansions. They managed to keep the entire place green and every house has a pool. Wikipedia comments web.archive.org/web/20220906010554/https://www.forbes.com/home-improvement/features/most-expensive-zip-codes-us/:and Forbes confirms it for 2022: web.archive.org/web/20220906010554/https://www.forbes.com/home-improvement/features/most-expensive-zip-codes-us/, by far on top.
Atherton is known for its wealth; in 1990 and 2019, Atherton was ranked as having the highest per capita income among U.S. towns with a population between 2,500 and 9,999, and it is regularly ranked as the most expensive ZIP Code in the United States [(94027)]. The town has very restricting zoning, only permitting one single-family home per acre and no sidewalks. The inhabitants have strongly opposed proposals to permit more housing construction
youtu.be/ZgAreiFXhJk?t=253 lists some famous people who live there. It's like a micro heaven.
And a person who makes open educational content like Marc, truly deserves it.
Soyuz Clock Part 4: How accurate is it? by CuriousMarc (2020)
Source. The timestamp youtu.be/HKsjwT53yXw?t=580 mentions that his wife is called "Lori", and that she escaped the Soviet Union, and two of her brothers went to jail in the escape process.
The name is kind of hard to hear, but Google resolves it for us e.g. she and Marc were donnors to the Computer History Museum d1yx3ys82bpsa0.cloudfront.net/core/core-2019.pdf
A waste of time like the rest of the knowledge olympiads.
This section talks about solvers/simulators dedicated solving the wave equation. Of course, any serious solver will likely be able to solve a wider range of PDE, so this section contains mostly fun toys. For more serious stuff see: Section "PDE solver".
JavaScript toy solvers:
- jtiscione.github.io/webassembly-wave/index.html circular domain, create waves with mouse click
- dionyziz.com/graphics/wave-experiment/ with useless 3D WebGL visualization :-), waves with mouse click. Solving itself done on CPU, not GPU.
CommonMark is a good project. But its initial release method was not very nice, they first developed everything behind closed doors with the big adopters like GitHub and Stack Overflow, and only later released the thing read, thus wasting the time of people who were working on alternative in the meanwhile, e.g. github.com/karlcow/markdown-testsuite which Ciro contributed to: Ciro Santilli's minor projects.
Previously it was unclear if there were any .org hits, until we found the first one with clear comms: web.archive.org/web/20110624203548/http://awfaoi.org/hand.jar
Later on, two more clear ones were found with expired domain trackers:further settling their existence. Later on newimages.org also came to light.
- azerinews.org
- autism-news.org
Others that had been previously found in IP ranges but without clear comms:
- 65.61.127.177: material-science.org
- 212.4.17.61: tech-stop.org
Others in IP ranges by unarchived:
- 74.116.72.244 arborstribune.org
.org is very rare, and has been excluded from some of our search heuristics. That was a shame, but likely not much was missed.
Grepping the 2013 DNS Census first by overused CGI comms subdomains
secure.
and ssl.
leaves 200k lines. Grepping for the overused "news" led to hits:- secure.worldnewsandent.com,2012-02-13T21:28:15,208.254.40.117
- ssl.beyondnetworknews.com,2012-02-13T20:10:13,66.104.175.40
Also tried but failed:
sports
:- secure.motorsportdealers.com,2012-04-10T20:19:09,64.73.117.38 web.archive.org/web/20110501000000*/motorsportdealers.com
OK, after the initial successes in New results: only one...
secure.
, we went a bit more data intensive:- took all
secure.*
ssl.*
URLs in the 2013 DNS Census, 70k entries - cleaned up a bit, e.g. only
.com
or.net
. this left only, 30k entries only - lopped over all of them in archive CDX: Wayback Machine CDX scanning, searching for those that also end in
.cgi
web.archive.org/cdx/search/cdx?url=$domain&matchType=domain&filter=urlkey:.*.cgi&to=20140101000000. Took an afternoon, but no rate limit block. - this leaves about 1000, so we loop over all of them manually on web archive with a script, and opened any that had the pattern of very vew hits between 2010 and 2013 only, and on those check for visual/thematic style match. Careful not to make more than 15 requests per minute or else 5 min blacklist!
- 208.254.42.205 secure.driversinternationalgolf.com,2012-02-13T10:42:20,
After 2013 DNS Census virtual host cleanup heuristic keyword searches we later understood why there were so few hits here: the 2013 DNS Census didn't capture the
secure.
subdomains of many domains it had for some reason. Shame, because if it had, this method would have yielded many more results.You can never have enough Wayback Machine tabs open
. Two ways to see it:
- a ring that is commutative
- a field where inverses might not exist
Holy Hand Grenade demo from Worms Armageddon by kycbkycb (2009)
Source. Edit: Carson was found Oleg Shakirov's findingsby Oleg Shakirov:
alljohnny.com
, communicated at: twitter.com/shakirov2036/status/1746729471778988499, earliest archive from 2004 (!): web.archive.org/web/20040113025122/http://alljohnny.com/, The domain was hidden in plain sight, it was present in a not very visible watermark visible in the Reuters article screenshot! The watermark was added to the CIA to the background image, it is actually present on the website. In retrospect, it was actually present at on the expired domain trackers dataset, but the mega discrete all
second word made Ciro Santilli miss it: github.com/cirosantilli/expired-domain-names-by-day-2015/blob/9d504f3b85364a64f7db93311e70011344cff788/07/05/02#L15722004 Wayback Machine archive of alljohnny.com
. What follows is the previous
The fact that the Reuters article has a screenshot of it, and therefore a Wayback Machine link, plus the specificity of the website topic, will likely keep Ciro awake at night for a while until someone finds that domain.
Some text visible on the Reuters screenshot:It is unclear however if this text is plaintext or part of a an image.
Johnny Carson and The Tonight Show
Your Favorite Host and Comedic Genius
Submit Your Favorite Carson Moment
Heeere's Johnny!
Holy crap, the "Here's Johnny" line from The Shining (1980) is a reference to Johnny Carson: www.youtube.com/watch?v=WDpipB4yehk, www.youtube.com/watch?v=aYnyPAkgyvc, Ciro never knew that... but every American would have understood it at the time.
Some failed attempts, either dry guesses or from DNS grepping dataset searches:
- johnnycarson.com: official
- johnnycarson.net: fan site: web.archive.org/web/20010501225614/http://johnnycarson.net/
- johnnycarsontonight.com
- carson-johnny.com: legit
- johnnycarsonshow.com: web.archive.org/web/20110208005558/http://johnnycarsonshow.com/captcha/index.php?d=johnnycarsonshow.com your IP has been blocked
- tributetojohnnycarson.com: only one archive web.archive.org/web/20180805132430/http://tributetojohnnycarson.com/
- bestofjohnnycarson.com: web.archive.org/web/20130525035938/http://bestofjohnnycarson.com/ Lived past 2013.
- bestofjohnny.com/: web.archive.org/web/20130506011824/http://bestofjohnny.com/ empty
- johnnycarsonvideo.com: dead early 2000s web.archive.org/web/20130605152818/http://johnnycarsonvideo.com/
- johnnycarsontv.com: web.archive.org/web/20230000000000*/johnnycarsontv.com
- thejohnnycarsonshow.com: web.archive.org/web/20230000000000*/thejohnnycarsonshow.com
- carsonsbest.com: web.archive.org/web/20230000000000*/carsonsbest.com
- johnnycarsonfans.com: web.archive.org/web/20230000000000*/johnnycarsonfans.com
- web.archive.org/web/20230000000000*/carsonified.com
- night:
- amazing:
- johnnyamazing.com: broken archives: web.archive.org/web/*/http://johnnyamazing.com/*
- carson
- johnneycarson.com: no archives
- johnnycarson.co: no archives
- johnnycarsons.info
- johnnycarsons.com
- johnnycarson.org
- johnnycarsonsdesk.com
- johnny-carson-video.com
- johnnycarsondvd.org
- johnnycarsondvds.org
- johnnycarsondvd.net
- johnnycarsondvd.tv
- johnnycarsondvds.net
- johnnycarsondvds.tv
- johnnycarson.tv
- johnnyguitarcarson.com
- johnnycarsonmovie.com
- hookedonjohnnycarson.com
- johnnycarsonbook.com
- licensingjohnnycarson.com
- johnnnycarson.com
- johnnycarson360.com
- koalajohnnycarson.com
- johnny-carson.com
- johnnycarsonbirthplace.com
- johnnycarsonbirthplace.net
- johnny:
- heres:
- heresjohnnyfilm.com: web.archive.org/web/20131011115733/http://www.heresjohnnyfilm.com/ legit
- hereisjohnny.net: no archives
- heresjohnnyradioshow.com: web.archive.org/web/20130509042107/http://heresjohnnyradioshow.com/, Legit most likely: web.archive.org/web/20140517103512/http://heresjohnnyradioshow.com/
- wherejohnnylives.net: broken archives
- heresjohnny.com: squat web.archive.org/web/20130607145841/http://heresjohnny.com/ Many other TlD like .net, .co.uk
- heeeeresjohnny.com: web.archive.org/web/20130612211448/http://heeeeresjohnny.com/: legit
- night:
- johnnylatenight.com: web.archive.org/web/20150801132622/http://johnnylatenight.com/ Legit broken
- web.archive.org/web/20110208161513/http://www.johnnysnight.com/
- heres:
- johnnycarson.org: squatted past 2013, nothing before
- carsonshow.com: squat: web.archive.org/web/20110224211714/http://carsonshow.com/
- tonightshow247.net: web.archive.org/web/20101226190209/http://tonightshow247.net/: squat
- tonightshow.tv: web.archive.org/web/20141221222442/http://www.tonightshow.tv/: legit
Searching the Wayback Machine proved fruitless. There is no full text search: Wayback Machine full text search, and a heuristic web.archive.org/web/20230000000000*/Johnny%20Carson search has relevant hits but not the one we want.
Another attempt was to search for "carson" on webmasterhome.cn which lists expired domains in bulk by expiration day, and it search engine friendly. It contains most of the domains we've found so far. Google either doesn't support partial word search or requires you to be a God to find it
so we settle for DuckDuckGo which supports it: duckduckgo.com/?q=site%3Awebmasterhome.cn+%22carson%22&t=h_&ia=web Adding years also helps: duckduckgo.com/?q=site%3Awebmasterhome.cn+%22carson%22+2011&ia=web with this we might be getting all possible results. Ciro went through all in 2011, 2012 and 2013 but no luck. Also fuck en.wikipedia.org/wiki/Carson_City,_Nevada and en.wikipedia.org/wiki/Carson,_California :-)
Let's search tools.whoisxmlapi.com/reverse-whois-search for "carson" contained in any historic domain name. 10,001 lines. Grepping those, no good Wayback machine hits for those that also contain "johnny" or "show". Data at: raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/tools.whoisxmlapi.com_reverse-whois-search_carson.csv in case anyone want to try and dig...
Let's also search the fortuitously timed 2013 DNS Census.
Our definition: first generation to be born in country parent immigrated to.
We go forward by Owlturd
. Source. Being a first generation immigrant, this cartoon does make Ciro think about the future of his children.
Immigrating is incredibly time consuming and direclty limits what you can do in life later on. One can only hope that their children will take advantage of the new opportunities provided to them.
The author apparently self deleted his site at some point unfortnately: www.reddit.com/r/OutOfTheLoop/comments/7dyslp/apparently_shen_from_owlturd_is_going_on_hiatus/
Unlisted articles are being shown, click here to show only listed articles.