There’s this weird github repository

https://github.com/OOOO00000000OOOO/OOOO00000000OOOO

I noticed there was someone attempting to proxy to this repository on my site, causing it to show up in the logs. It was detected as spam but this repo doesn’t look like it’s built by some normal spammy company. The owner has gone through great lengths to try to stay anonymous. And I can’t make out what the repo is or what it’s for. Does anyone know or have any ideas?

Thanks

    • urushitan 漆たん@kakera.kintsugi.moe
      7·
      1 day ago

      Their goal? Can’t say. They clearly have a drive to make art, especially mathematical fractal binary minimalist art. Whether they also are actually producing malware or are just trying to piggyback as many services as possible to archive and keep their stuff online is another question. The vast majority of what I saw in my quick recon of their online presence was mostly glitch art/unicode/ascii art, blender stuff, fractals, web based d3 animations, that sort of thing. That being said, as you said, they appear to have gone to great lengths to be anonymous, I’ve only found a couple of raw IPs in there that mirror their stuff.

      That being said, it seems they also clone their backups to anyone who hosts a free forgejo/gitea instance:

      OOOOOOOOOOOOOOOO\ꓨЯO.ꓨЯƎᗺƎᗡOϽ CODEBERG.ORG/OOOOOOOOOOOOOOOO
OOOO\MOϽ.ᗺUHƧꓨAᗡ DAGSHUB.COM/OOOO
OOOO\u\MOϽ.ƎᗡOϽƎᗡOHЯ.ƎᗡOϽ CODE.RHODECODE.COM/u/OOOO
oooo∽\TH.ЯƧ.TIꓨ GIT.SR.HT/~oooo
OOOO\ꓨЯO.ꓨUᗺATOИ NOTABUG.ORG/OOOO
O\000Ԑ:მ4.111.78.ਟ81 185.87.111.46:3000/O
O\HϽƎT.TƎꓨƎᗺ.MUTИƎꓨA.TIꓨ GIT.AGENTUM.BEGET.TECH/O
O\ᗡI.Oꓨ.ᗺAꞰꓨИAᗡƎMUƧ.TIꓨ GIT.SUMEDANGKAB.GO.ID/O
OOOO\ƎTIƧ.ƧƎOᒐƧIƧIHT.TIꓨ GIT.THISISJOES.SITE/OOOO
O\UƎ.ЯƎꓨИIᒧᒧƎ.TIꓨ GIT.ELLINGER.EU/O
O\HƧ.1ᗡIꟼ.AƎTIꓨ GITEA.PID1.SH/O
O\ᒧИ.ИƎЯƎOᗺЯƎIVIᒧO.TIꓨ GIT.OLIVIERBOEREN.NL/O
O\ƎM.YꓨOᒧOИYƧ.ꓨИOƎᒐꞰƎ.AƎTIꓨ GITEA.EKJEONG.SYNOLOGY.ME/O
O\𑪽Ͻ.ϽƎVOЯOᗺꞰƎИƎᗡ𑪽.TIꓨ GIT.ZDENEKBOROVEC.CZ/O
O\ꟼᒐ.ƧUᒧꟼTϽƎИИOϽ.TIꓨ GIT.CONNECTPLUS.JP/O
O\YИAꟼMOϽ.ꞰᗺƎ.AƎTIꓨ GITEA.EBK.COMPANY/O
O\MOϽ.ƧꟼOVƎᗡUAꞰA.AƎTIꓨ GITEA.AKAUDEVOPS.COM/O
O\ZYX.VƎᗡƎᒧᗺATЯOꟼ.AƎTIꓨ GITEA.PORTABLEDEV.XYZ/O
O\MOϽ.ƎꓨAMAIV.AƎTIꓨ GITEA.VIAMAGE.COM/O
O\TƎИ.OTYЯϽ.TIꓨ GIT.CRYTO.NET/O
O\VƎᗡ.ƧꟼAMO.TIꓨ GIT.OMAPS.DEV/O
O\MOϽ.ИƎMMƎH-ИAV.TIꓨ GIT.VAN-HEMMEN.COM/O
O\UƎ.ИƎVƧƎИ.TIꓨ GIT.NESVEN.EU/O
O\MOϽ.ᗡAƎЯᗡHTꟻIꟻ.AƎTIꓨ GITEA.FIFTHDREAD.COM/O
      • mark@programming.devOP
        2·
        19 hours ago

        Yeah. Just found that they’re using this email address: OOOOOOOOOOOOOO@MURENA.IO. murena.io gives them 1GB of storage for free. Like you said, they appear to be attempting to keep a backup of a lot of data using third-party services, I’m guessing so that, in theory, even after their death, this data will be available… forever?

        • lad@programming.devEnglish
          1·
          17 hours ago

          Their repositories are really something, and the commits seem to only happen in bursts, I expected them to do a few commits every day, instead it’s like 10 days a year with 1700+ commits total.

          But I wouldn’t assume they are conventionally malicious, more like a paperclip storage optimiser

          • urushitan 漆たん@kakera.kintsugi.moe
            3·
            17 hours ago

            Agreed, leads me to think they have some kind of script that rewrites filenames and directory names to be symbolic/symmetric and they run it manually rather than on some automated schedule. Then by storing it as a git repo they can find open git hosting and just mirror it there (the lastest copy I saw was like 7 or 8 GB so definitely not tiny, but also not enough to take down your average self hosting project)