We define a "Procedural AI training game" as an AI training game in which parts of the game are made with procedural generation.
Allen Mouse Brain Common Coordinate Framework by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
For the love of God, on Ubuntu install from the official AppImage downloaded from electrum.org/#download, not this random outdated Snap snapcraft.io/electrum:
Quick overview at stackoverflow.com/questions/1780599/what-is-the-meaning-of-posix/31865755#31865755
Exmples under c/posix:
- c/posix/signal_return.c: stackoverflow.com/questions/37063212/where-does-signal-handler-return-back-to
- c/posix/inet/pton.c:
inet_pton
demo. Adapted fromman inet_pton
on Ubuntu 23.04. Usage:Output:./pton.out 192.187.1.42
So we see that the strings was converted to an integer, e.g.:0xc0bb012a
See also: stackoverflow.com/questions/1680622/ip-address-to-integer-c/76520978#76520978- 0xc0 = 192
- 0xbb = 187
- 0x01 = 1
- 0x2a = 42
- c/posix/inet/ntop.c:
inet_ntop
demo. Adapted fromman inet_pton
on Ubuntu 23.04. Usage:Output:./ntop.out 0x01021AA0
./ntop.out 0x01021AA0
CIA 2010 covert communication websites Non Reuters ranges by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
CIA 2010 covert communication websites The Reuters websites by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
The Reuters article directly reported only two domains in writing:
- iraniangoals.com. Iranian language football website. As of 2023, the domain had been bought by Reuters and redirects to their website.
But by looking at the URLs of the screenshots they provided from other websites we can easily uncover all others that had screenshots, except for the Johnny Carson one, which is just generically named. E.g. the image for the Chinese one is www.reuters.com/investigates/special-report/assets/usa-spies-iran/screencap-activegaminginfo.com.jpg?v=192516290922 which leads us to domain activegaminginfo.com.
Oleg Shakirov later discovered that the Carson one had its domain written right on the screenshot, as part of a watermark present on the original website itself. Therefore the URLs of all the websites were in one way or another essentially given on the article.
The full list of domains from screenshots is:
- 2011 archive: web.archive.org/web/20110208113503/http://activegaminginfo.com/. Contains mentions of 2010.
- As of 2023, it seemed to be an actual legit photography website by German (amateur?) photographer Klaus Wägele. Archive: web.archive.org/web/20230323102504/https://www.capture-nature.com/Ciro Santilli actually sent him a message to let him know about the CIA thing in case he didn't, and he replied that he wasn't aware of it.
- 2011 archive: web.archive.org/web/20110201164741/https://www.headlines2day.com/. Dated "Copyright 2009".
fitness-dawg.com
: English fitness website.2021 archive: web.archive.org/web/20110207104044/http://fitness-dawg.com/.Domain available as of 2023.rastadirect.net
: English Rastafari culture website.Domain available as of 2023.- 2011 archive: web.archive.org/web/20110203021315/http://fightwithoutrules.com/. Contains mentions of 2009 news.Domain available as of 2023.
- 2004 archive: web.archive.org/web/20040113025122/http://alljohnny.com/.Domain available as of 2023.
CIA 2010 covert communication websites Fingerprints by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
From The Reuters websites and others we've found, we can establish see some clear stylistic trends across the websites which would allow us to find other likely candidates upon inspection:The most notable dissonance from the rest of the web is that there are no commercial looking website of companies, presumably because it was felt that it would be possible to verify the existence of such companies.
- natural sounding, sometimes long-ish, domain names generally with 2 or 3 full words. Most in English language, but a few in Spanish, and very few in other languages like French.
- shallow websites with a few tabs, many external links, sometimes many images, and few internal pages
- common themes include:
- .com and .net top-level domains, plus a few other very rare non .com .net TLDs, notably .info and .org
- each one has one "communication mechanism file": communication mechanisms
- narrow page width like in the days of old, lots of images
- split header images
- some common pattern they follow in their news lists:
ul.rss-items > li.rss-item
, e.g.: web.archive.org/web/20110202092126/http://beamingnews.com/- links with class
a.newslink
anda.newslinkalt
e.g. web.archive.org/web/20110128181622/http://profile-news.com/
Most domains are the only domain for its IP, i.e. the websites are mostly private hosted. However we have later found many exceptions to this general indicator, so it should not be used as a strong exclusion rule.
CIA 2010 covert communication websites IP range search by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
One promising way to find more of those would be with IP searches, since it was stated in the Reuters article that the CIA made the terrible mistake of using several contiguous IP blocks for those website. What a phenomenal OPSEC failure!!!
The easiest way would be if Wayback Machine itself had an IP search function, but we couldn't find one: Search Wayback Machine by IP.
viewdns.info was the first easily accessible website that Ciro Santilli could find that contained such information.
Our current results indicate that the typical IP range is about 30 IPs wide.
E.g. searching: viewdns.info/iphistory and considering only hits from 2011 or earlier we obtain:
- capture-nature.com
- 65.61.127.163 - Greenacres - United States - TierPoint - 2013-10-19
- activegaminginfo.com
- 66.175.106.148 - United States - Verizon Business - 2012-03-03
- iraniangoals.com
- 68.178.232.100 - United States - GoDaddy.com - 2011-11-13
- 69.65.33.21 - Flushing - United States - GigeNET - 2011-09-08
- rastadirect.net
- 68.178.232.100 - United States - GoDaddy.com - 2011-05-02
- iraniangoalkicks.com
- 68.178.232.100 - United States - GoDaddy.com - 2011-04-04
- headlines2day.com
- 118.139.174.1 - Singapore - Web Hosting Service - 2013-06-30. Source: viewdns.info
- 184.168.221.91 2013-08-12T06:17:39. Source: 2013 DNS Census grep
- fightwithoutrules.com
- fitness-dawg.com
Neither of these seem to be in the same ranges, the only common nearby hit amongst these ranges is the exact
68.178.232.100
, and doing reverse IP search at viewdns.info/reverseip/?host=68.178.232.100&t=1 states that it has 2.5 million hostnames associated to it, so it must be some kind of Shared web hosting service, see also: superuser.com/questions/577070/is-it-possible-for-many-domain-names-to-share-one-ip-address, which makes search hard.Ciro then tried some of the other IPs, and soon hit gold.
Initially, Ciro started by doing manual queries to viewdns.info/reversip until his IP was blocked. Then he created an account and used his 250 free queries with the following helper script: cia-2010-covert-communication-websites/viewdns-info.sh. The output of that script can be seen at: github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/viewdns-info.sh.
CIA 2010 covert communication websites TODO by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
CIA 2010 covert communication websites Data sources by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
This is a dark art, and many of the sources are shady as fuck! We often have no idea of their methodology. Also no source is fully complete. We just piece up as best we can.
- www.zone-h.org/archive/ip=208.76.80.93/page=11?hz=1 mentions
newsupdatesite.com
and mentions "defacement", the "Mass Deface III" pastebin comes to mind. No other nearby hits on quick inspection.
CIA 2010 covert communication websites Reverse engineering by
Ciro Santilli 37 Updated 2025-06-02 +Created 1970-01-01
In this section we document the outcomes of more detailed inspection of both the communication mechanisms (JavaScript, JAR, swf) and HTML that might help to better fingerprint the websites.
Unlisted articles are being shown, click here to show only listed articles.