Hacker News

Seeing potentially similar activity on an obscure Chemistry message board from July:

https://tmcleod.org/cgi-bin/apchem/wiki.cgi?action=rc&days=1...

Some posts are tagged [proxy] - a leave behind for accessing sites?

Yep, found these as well

"Its indexed June archive shows tens of thousands of links, many created within seconds by distinct cloud addresses; some aliases explicitly say ...REPLY, ACK, or R2 confirmed, and one points straight back to a known DseWiki collaboration page"

kmad 6 hours ago [ - ]

I had GLM-5.3 do some digging on the programmatic/ encoding elements of the data, what stuck out to me was:

  - Using api . microlink . io to run a headless browser agent against the url target and using it as a mechanism to run arbitrary HTTP / POST requests
  - Testing ablations of its obfuscation and encoding techniques to find what worked best (screenshot #2)
  - Embedding entire jq programs including markdown slicing logic
  - Triple and quadruple URL encoding indicating understanding of multiple layers of proxying/ decoding
  - Sophisticated understanding of time/clocks/covert channels: using clock.wait, heartbeats, counters, timestamps, thread ids

https://x.com/kmad/status/2096029334225997848

kmad 5 hours ago [ - ]

Full writeup and code here: https://github.com/kmad/agent-swarm-forensics