this post was submitted on 21 Jul 2026
70 points (97.3% liked)

Programming

27803 readers
422 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 3 years ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
UlrikHD@programming.dev
bugsmith@programming.dev
Spyro@programming.dev
70
Anyone know what this is? (programming.dev)
submitted 1 day ago by mark@programming.dev to c/programming@programming.dev
22 comments fedilink hide all child comments
 

There's this weird github repository

https://github.com/OOOO00000000OOOO/OOOO00000000OOOO

I noticed there was someone attempting to proxy to this repository on my site, causing it to show up in the logs. It was detected as spam but this repo doesn't look like it's built by some normal spammy company. The owner has gone through great lengths to try to stay anonymous. And I can't make out what the repo is or what it's for. Does anyone know or have any ideas?

Thanks

top 22 comments
sorted by: hot top controversial new old
[–] urushitan@kakera.kintsugi.moe 26 points 1 day ago* (last edited 1 day ago) (4 children)

Idk but I found this

https://github.com/OOOO00000000OOOO/OOOO00000000OOOO/blob/%E2%A0%80/%E2%9B%8B%E2%88%A3%F0%9F%9F%97%E2%88%A3%F0%96%A2%8C%E2%88%A3%F0%9F%9F%97%E2%88%A3%E2%9B%8B/%E2%88%A3%E2%9D%81%E2%88%A3%E2%8A%9E%E2%88%A3%E2%9C%A2%F0%9F%9D%8A%E2%9B%8B%E2%9C%BB%E2%9B%8B%F0%9F%9D%8A%E2%9C%A2%E2%88%A3%E2%8A%9E%E2%88%A3%E2%9D%81%E2%88%A3/%EA%93%A8%D0%98%EA%9F%BC.%F0%96%A3%A0%E2%9A%AA%F0%92%BE%A8%E1%97%B1%E1%97%B4%E1%97%9D%E2%B5%94%F0%93%87%B3%C8%8A%CC%AE%C7%80%E2%9D%81%C7%80%E1%99%81%E1%97%B1%E1%97%B4%E2%A7%B2%E2%9A%AA%F0%94%97%A2%E2%9A%AA%F0%9F%9E%8B%E2%9A%AA%F0%94%97%A2%E2%9A%AA%E2%A7%B2%E1%97%B1%E1%97%B4%E1%99%81%C7%80%E2%9D%81%C7%80%C8%8A%CC%AE%F0%93%87%B3%E2%B5%94%E1%97%9D%E1%97%B1%E1%97%B4%F0%92%BE%A8%E2%9A%AA%F0%96%A3%A0.PNG

I also found this https://ooooooooooooooooooooooooooo.carrd.co/

This is almost certainly a way to use github as a backup system, but it's also the output of someone who does alot with white/black/grey imagery, glitch art, and is OBSESSED with symmetry as other commenters have said

This appears to be their social media presence:

http://twitter.com/WHITEBALACLAVA

http://instagr.am/WHITE_BALACLAVA

http://fb.com/1453261601638473

http://youtube.com/channel/UCCLaIxZrTWkBhp_kWXUwfTQ

http://soundcloud.com/WBALACLAVA ·

http://vk.com/club133070869

http://i.imgbox.com/wuBm89hW.png

http://youtube.com/channel/UC-bPHywwCRhyM61m8cp-zbg/VIDEOS

http://instagr.am/PU.DEHCTIP_AVALCALAB.ETIHW

http://twitter.com/AVALCALAB_ETIHW

http://twitter.com/ERISED_TIFENEB

http://youtube.com/channel/UCLLr-AXjqxUHn0eSssph8cg

[–] MonkderVierte@lemmy.zip 2 points 10 hours ago* (last edited 10 hours ago) (1 children)

Most of the links don't work anymore, so they probably saw this and felt doxed.

[–] urushitan@kakera.kintsugi.moe 2 points 9 hours ago

they actually didn't when I grabbed them either but I kept them for posterity. Important to note some of these things are almost 10 years old, so there's certainly the rot of not maintaining them, free services pruning, etc. That being said, it's likely why they duplicate their 7GB backup repo all over the place

[–] MonkeMischief@lemmy.today 2 points 19 hours ago

Oh boy I would not be surprised if there was some kinda ARG buried in all this lol.

[–] felsiq@piefed.zip 3 points 22 hours ago (1 children)

I don’t know what their vibe is but I love it, we need more people like this in the world

[–] hypnicjerk@piefed.social 3 points 11 hours ago

i wish i were a tenth this fucking fearlessly cool

[–] mark@programming.dev 6 points 1 day ago (1 children)

😂 what is this person's goal in life?

[–] urushitan@kakera.kintsugi.moe 7 points 1 day ago (1 children)

Their goal? Can't say. They clearly have a drive to make art, especially mathematical fractal binary minimalist art. Whether they also are actually producing malware or are just trying to piggyback as many services as possible to archive and keep their stuff online is another question. The vast majority of what I saw in my quick recon of their online presence was mostly glitch art/unicode/ascii art, blender stuff, fractals, web based d3 animations, that sort of thing. That being said, as you said, they appear to have gone to great lengths to be anonymous, I've only found a couple of raw IPs in there that mirror their stuff.

That being said, it seems they also clone their backups to anyone who hosts a free forgejo/gitea instance:

OOOOOOOOOOOOOOOO\ꓨЯO.ꓨЯƎᗺƎᗡOϽ CODEBERG.ORG/OOOOOOOOOOOOOOOO
OOOO\MOϽ.ᗺUHƧꓨAᗡ DAGSHUB.COM/OOOO
OOOO\u\MOϽ.ƎᗡOϽƎᗡOHЯ.ƎᗡOϽ CODE.RHODECODE.COM/u/OOOO
oooo∽\TH.ЯƧ.TIꓨ GIT.SR.HT/~oooo
OOOO\ꓨЯO.ꓨUᗺATOИ NOTABUG.ORG/OOOO
O\000Ԑ:მ4.111.78.ਟ81 185.87.111.46:3000/O
O\HϽƎT.TƎꓨƎᗺ.MUTИƎꓨA.TIꓨ GIT.AGENTUM.BEGET.TECH/O
O\ᗡI.Oꓨ.ᗺAꞰꓨИAᗡƎMUƧ.TIꓨ GIT.SUMEDANGKAB.GO.ID/O
OOOO\ƎTIƧ.ƧƎOᒐƧIƧIHT.TIꓨ GIT.THISISJOES.SITE/OOOO
O\UƎ.ЯƎꓨИIᒧᒧƎ.TIꓨ GIT.ELLINGER.EU/O
O\HƧ.1ᗡIꟼ.AƎTIꓨ GITEA.PID1.SH/O
O\ᒧИ.ИƎЯƎOᗺЯƎIVIᒧO.TIꓨ GIT.OLIVIERBOEREN.NL/O
O\ƎM.YꓨOᒧOИYƧ.ꓨИOƎᒐꞰƎ.AƎTIꓨ GITEA.EKJEONG.SYNOLOGY.ME/O
O\𑪽Ͻ.ϽƎVOЯOᗺꞰƎИƎᗡ𑪽.TIꓨ GIT.ZDENEKBOROVEC.CZ/O
O\ꟼᒐ.ƧUᒧꟼTϽƎИИOϽ.TIꓨ GIT.CONNECTPLUS.JP/O
O\YИAꟼMOϽ.ꞰᗺƎ.AƎTIꓨ GITEA.EBK.COMPANY/O
O\MOϽ.ƧꟼOVƎᗡUAꞰA.AƎTIꓨ GITEA.AKAUDEVOPS.COM/O
O\ZYX.VƎᗡƎᒧᗺATЯOꟼ.AƎTIꓨ GITEA.PORTABLEDEV.XYZ/O
O\MOϽ.ƎꓨAMAIV.AƎTIꓨ GITEA.VIAMAGE.COM/O
O\TƎИ.OTYЯϽ.TIꓨ GIT.CRYTO.NET/O
O\VƎᗡ.ƧꟼAMO.TIꓨ GIT.OMAPS.DEV/O
O\MOϽ.ИƎMMƎH-ИAV.TIꓨ GIT.VAN-HEMMEN.COM/O
O\UƎ.ИƎVƧƎИ.TIꓨ GIT.NESVEN.EU/O
O\MOϽ.ᗡAƎЯᗡHTꟻIꟻ.AƎTIꓨ GITEA.FIFTHDREAD.COM/O
[–] mark@programming.dev 2 points 13 hours ago* (last edited 13 hours ago) (1 children)

Yeah. Just found that they're using this email address: OOOOOOOOOOOOOO@MURENA.IO. murena.io gives them 1GB of storage for free. Like you said, they appear to be attempting to keep a backup of a lot of data using third-party services, I'm guessing so that, in theory, even after their death, this data will be available... forever?

[–] sukhmel@programming.dev 1 points 12 hours ago (1 children)

Their repositories are really something, and the commits seem to only happen in bursts, I expected them to do a few commits every day, instead it's like 10 days a year with 1700+ commits total.

But I wouldn't assume they are conventionally malicious, more like a ~~paperclip~~ storage optimiser

[–] urushitan@kakera.kintsugi.moe 3 points 12 hours ago

Agreed, leads me to think they have some kind of script that rewrites filenames and directory names to be symbolic/symmetric and they run it manually rather than on some automated schedule. Then by storing it as a git repo they can find open git hosting and just mirror it there (the lastest copy I saw was like 7 or 8 GB so definitely not tiny, but also not enough to take down your average self hosting project)

[–] ludrol@programming.dev 38 points 1 day ago* (last edited 1 day ago) (1 children)

At first glance there is a lot of noise that look like an ARG but there is just too much random stuff. There are some binary blobs that are marked as executable. They might be malware.

Edit:

Found blender screenshots, firefox screenshots with some firefox extension config files, SVGs and PNGs, links to alternative 4chans, solidworks tutorials and blender VK groups

They are crazy for using VERY heavily riced windows that is ultra-minimalist white.

Russian hacker for sure. Might or might not have developed malware. I am more inclined for this to be a cloud backup hosted on github.

Edit2: The Filepath is crazy

[–] mark@programming.dev 12 points 1 day ago* (last edited 1 day ago) (1 children)

It's insane, right? I was looking through the files and trying to find anything that made sense. None of it does. I thought it was some foreign or custom encoded programming language or something.

[–] ludrol@programming.dev 24 points 1 day ago* (last edited 1 day ago)

It makes sense in Terry A. Davis/Temple OS sense. Someone mentally ill needs everything to be symmetrical. They substitute o with Ⓞ in www.gⓄⓄgle.com I think they use fancy unicode to have a bearable symmetrical font; And someday they found that they can upload stuff to github and they upload what they made.

[–] Quetzalcutlass@lemmy.world 27 points 1 day ago

Probably Command & Control for some sort of malware.

[–] beegnyoshi@lemmy.zip 12 points 1 day ago

What does it mean to proxy a repository through the site?

[–] NaibofTabr@infosec.pub 16 points 1 day ago (1 children)

Good catch. Someone is trying to use your site as a proxy for malicious software. You should report the repository.

[–] mark@programming.dev 13 points 1 day ago

Good idea. I didn't report it before because I wasn't quite sure of whether or not it was malicious or just someone testing something out. But it's clear this person isn't just testing or debugging something. I'll report. Thanks!

[–] talkingpumpkin@lemmy.world 9 points 1 day ago (2 children)

No idea, but it's certainly not the intended use of github.

Have you already reported the user (look at their other repos) or should I?

[–] theherk@lemmy.world 7 points 1 day ago

Several such repositories very similar. I’m thinking some strange encoding for using it as remote storage of some sort.

[–] mark@programming.dev 5 points 1 day ago

Just reported. Wasn't sure if I should at first. But the more people who report it, the better, right? ;) Thanks

[–] AlteE@programming.dev 4 points 1 day ago

Probably someone created it for prank/harmful purposes.