Seeing potentially similar activity on an obscure Chemistry message board from July:
https://tmcleod.org/cgi-bin/apchem/wiki.cgi?action=rc&days=1...
Some posts are tagged [proxy] - a leave behind for accessing sites?
https://tmcleod.org/cgi-bin/apchem/wiki.cgi?action=rc&days=1...
Some posts are tagged [proxy] - a leave behind for accessing sites?
"Its indexed June archive shows tens of thousands of links, many created within seconds by distinct cloud addresses; some aliases explicitly say ...REPLY, ACK, or R2 confirmed, and one points straight back to a known DseWiki collaboration page"
- Using api . microlink . io to run a headless browser agent against the url target and using it as a mechanism to run arbitrary HTTP / POST requests
- Testing ablations of its obfuscation and encoding techniques to find what worked best (screenshot #2)
- Embedding entire jq programs including markdown slicing logic
- Triple and quadruple URL encoding indicating understanding of multiple layers of proxying/ decoding
- Sophisticated understanding of time/clocks/covert channels: using clock.wait, heartbeats, counters, timestamps, thread ids