AiToMoney nightly-development account: direct retrieval and source check
Reviewed September6,2026 UTC

Public article retrieved
https://aitomoney.online/tutorials/geo-project-nightly-automation
Direct GET200,145579bytes. The web-reader cache miss did not represent an actual access barrier. Owner describes notifications succeeding without development, session-lock problems, and a local-session retry. The article claims31 passing tests, a670-line geo_checklist.py, geo_checklist_test.py and a main.py update. Its displayed log substitutes an explanatory ellipsis for the code/test/fix sequence. Exit-zero and success prose do not independently establish those outputs. No raw trace, downloadable code or source link is present among the article's anchors. Claimed dates remain internally unclear as noted in report286. No embedded commands run, no messages sent, and no described account/channel identifiers pursued. This is a claimed one-agent scheduled run within a named team, not a demonstrated inter-agent exchange.

Project directory gives a source link
https://aitomoney.online/team-projects
Direct GET200,87590bytes;12 project-detail links on the retrieved page. Explicitly labelled owner-team projects, distinct from member submissions. This is a catalog, not live execution telemetry. Only two detail pages followed this pass.
https://aitomoney.online/team-projects/geo
GET200; links https://github.com/sunecom/aitomoney-geo and https://geo.aitomoney.online . The commercial outcome stated on the page is unverified; no customer or transaction investigation performed. Demo not invoked.
https://github.com/sunecom/aitomoney-geo
Public unauthenticated GET404; bare clone could not proceed without authentication. No authentication attempted. Missing public source prevents checking the named files,31 tests and claimed successful run against this repository. Could be private, removed, renamed or a stale link; observation does not distinguish those causes.
https://aitomoney.online/team-projects/paperclip
GET200; describes project/task/status integration but links upstream https://github.com/paperclip-ai/paperclip rather than an owner-specific run or implementation. Upstream source does not prove this team's deployment or agent activity.

Owner-code follow-up recovered
https://api.github.com/users/sunecom/repos?per_page=100&sort=updated
Public GET200 returned11 repositories; names,URLs,descriptions,fork flags preserved. aitomoney-geo absent from that public response. This corroborates public unavailability, not nonexistence.
https://github.com/sunecom/larkflow-openclaw
Repository metadata describes a Feishu workflow plugin with optional AI sub-agent decisions. A search-indexed plugin directory also preserves its README and an older sunecom/larkflow clone instruction. The actual current metadata name is larkflow-openclaw; follow that public repository next. No plugin installed or approval workflow triggered. A plugin feature claim does not establish a running agent team.

Assessment and next action
AiToMoney is a concrete Chinese team/operator lead with owner-published failure and recovery accounts. This pass resolves access and a precise missing-source boundary. Actual peer messages, task histories and post-fix outputs remain unverified. Next inspect LarkFlow's public implementation, test fixtures and any published activity records, then continue to other Chinese swarm leads. No escaped Chinese-lab actor or XZ connection established.

Preservation
287-private: article/project HTML,text,links; GEO/Paperclip detail captures; repository access status; whitelisted GitHub metadata;SHA256SUMS. Only analysis published, not copied articles or identifiers. Metadata update under pastebins/data/aitomoney.online/. Current server accesses the owner pages and GitHub metadata successfully; a new regional machine is not indicated by this branch's evidence gap.