Previously it was unclear if there were any .org hits, until we found the first one with clear comms: web.archive.org/web/20110624203548/http://awfaoi.org/hand.jar
Later on, two more clear ones were found with expired domain trackers:
further settling their existence. Later on newimages.org also came to light.
Others that had been previously found in IP ranges but without clear comms:
  • 65.61.127.177: material-science.org
  • 212.4.17.61: tech-stop.org
  • 74.116.72.244 arborstribune.org
.org is very rare, and has been excluded from some of our search heuristics. That was a shame, but likely not much was missed.
Not in other sections:
Cell projection Updated 2025-07-16
One of several things that can stick out of a cell, e.g. flagellum or an axon.
Euro Updated 2025-07-16
Video 1.
The Euro Has Never Been More Problematic by Yanis Varoufakis (2018)
Source. Talk given at the Oxford Union. youtu.be/cCA68U3P_Z8?t=1288 describes the problem with the Uero a bit better.
Evil demon Updated 2025-07-16
Genesis block message Updated 2025-07-16
Inscription added by Satoshi Nakamoto on the Genesis block containing:
The Times 03/Jan/2009 Chancellor on brink of second bailout for banks
which is a reference to: www.thetimes.co.uk/article/chancellor-alistair-darling-on-brink-of-second-bailout-for-banks-n9l382mn62h wihch is fully titled:
Chancellor Alistair Darling on brink of second bailout for banks
The "Alistair" was slikely removed due to limited payload concerns.
Through the newspaper reference, the message proves a minimal starting date for the first mine.
And it hints that one of Bitcoin's motivation was the financial crisis of 2007-2008, where banks were given bailouts by the government to not go under, which many people opposed as the crisis was their own fault in the first place. A notable related stab is taken at Len Sassaman tribute.
We can extract the image from the blockchain ourselves by starting from: blockchain.info/block-height/0?format=json.
From that page we manually extract the hash 000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f and then:
wget -O 0.hex https://blockchain.info/block/000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f?format=hex
xxd -p -r 0.hex
and that does contain the famous genesis block string:
EThe Times 03/Jan/2009 Chancellor on brink of second bailout for banks
The JSON clarifies that the data is encoded in the script field of the transaction input:
{
      {
         "script":"04ffff001d0104455468652054696d65732030332f4a616e2f32303039204368616e63656c6c6f72206f6e206272696e6b206f66207365636f6e64206261696c6f757420666f722062616e6b73"
The extra E (0x45 in ASCII) in EThe Times is just extra noise required by the script, we can break things up as:
04ffff001d0104 45 5468652054696d65732030332f4a616e2f32303039204368616e63656c6c6f72206f6e206272696e6b206f66207365636f6e64206261696c6f757420666f722062616e6b73
where:
  • 54 is T
  • the 04ffff001d0104 part just doesn't show up on the terminal because it is not made of any printable characters.
The initial 04 is OP_RETURN.
TODO what is actual the meaning of the ffff001d010445 part? @defango twitter.com/defango/status/1642750851134652417 comments:
04ffff001d0104 is a hexadecimal string. It is commonly used in the Bitcoin network as a part of the mining process. Specifically, it is used as the target value for a block to be considered valid by the Bitcoin network.
This value represents the level of difficulty required for a miner to generate a block that meets the network's criteria. The first four bytes, 04ffff, represent the maximum possible target value. The next three bytes, 001d01, represent the current difficulty level
while the final byte, 04, is a padding byte. In summary, this value sets the difficulty level for mining a new block in the Bitcoin network.
TODO the output of the transaction has a jumbled script, likely just a regular output to get things going, can't be arbitrary like input.
Neon lamp Updated 2025-07-16
X-ray diffraction Updated 2025-07-16
Often used as a synonym for X-ray crystallography, or to refer more specifically to the diffraction part of the experiment (exluding therefore sample preparation and data processing).
We've come across a few shallow and stylistically similar websites on suspicious ranges with this pattern.
No JS/JAR/SWF comms, but rather a subdomain, and an HTTPS page with .cgi extension that leads to a login page. Some names seen for this subdomain:
  • secure.: most common
  • ssl.: also common
  • various other more creative ones linked to the website theme itself, e.g.:
    • musical-fortune.net has a backstage.musical-fortune.net
The question is, is this part of some legitimate tooling that created such patterns? And if so which? Or are they actual hits with a new comms mechanism not previously seen?
The fact that:
  • hits of this type are so dense in the suspicious ranges
  • they are so stylistically similar between on another
  • citizenlabs specifically mentioned a "CGI" comms method
suggests to Ciro that they are an actual hit.
In particular, the secure and ssl ones are overused, and together with some heuristics allowed us to find our first two non Reuters ranges! Section "secure subdomain search on 2013 DNS Census"
The impact of the work is greater when you examine what one single new technology would do to existing society, as in Primer (2004), rather than "start on a society with severl new technologies", like in Star Wars.

Unlisted articles are being shown, click here to show only listed articles.