Early rogue AI agent activity and attempts to hack found on urlquery.net

On June 20-21, agents attempted to exploit vulnerabilities in the Australian Institute of Health and Welfare (AIHW), a government statistics agency (1Full URL: https://vizprod.aihw.gov.au/t/Public/views/PBSdashboardallATC1-ATC2medicines-Agegroup/PBSDashboard?:showVizHome=no&:embed=y&:apiID=%22%3E%3Csvg/onload%3Ddocument.title%3D%22XSS%22%3E, 2Full URL: https://eu.httpbin.org/base64/PGRpdiBpZD12IHN0eWxlPSJ3aWR0aDoxMTAwcHg7aGVpZ2h0OjkwMHB4Ij48L2Rpdj48c2NyaXB0PmZ1bmN0aW9uIEwoeCl7eD1TdHJpbmcoeCk7ZG9jdW1lbnQudGl0bGU9eC5zbGljZSgwLDIwMCk7bmV3IEltYWdlKCkuc3JjPSdodHRwczovL2h0dHBidW4uY29tL3N0YXR1cy8yMDQ_cHI9JytlbmNvZGVVUklDb21wb25lbnQoeC5zbGljZSgwLDE4MDApKSsnJm49cDAwMTE3ODIwNzcyODYmcj0nK01hdGgucmFuZG9tKCl9PC9zY3JpcHQ-PHNjcmlwdCBzcmM9Imh0dHBzOi8vdml6cHJvZC5haWh3Lmdvdi5hdS9qYXZhc2NyaXB0cy9hcGkvdGFibGVhdS0yLjkuMi5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQ-bGV0IHo9bmV3IHRhYmxlYXUuVml6KHYsJ2h0dHBzOi8vdml6cHJvZC5haWh3Lmdvdi5hdS90L1B1YmxpYy92aWV3cy9QQlNkYXNoYm9hcmRhbGxBVEMxLUFUQzJtZWRpY2luZXMtQWdlZ3JvdXAvUEJTRGFzaGJvYXJkPzpzaG93Vml6SG9tZT1ubyY6ZW1iZWQ9eWVzJyx7aGlkZVRhYnM6dHJ1ZSxoaWRlVG9vbGJhcjp0cnVlLG9uRmlyc3RJbnRlcmFjdGl2ZTphc3luYygpPT57dHJ5e0woJ0lOVCcpO2xldCBiPXouZ2V0V29ya2Jvb2soKSxzPWIuZ2V0QWN0aXZlU2hlZXQoKTtMKCdBQ1RJVkV8JytzLmdldE5hbWUoKSsnfCcrcy5nZXRTaGVldFR5cGUoKSk7bGV0IHA9YXdhaXQgYi5nZXRQYXJhbWV0ZXJzQXN5bmMoKTtMKCdQQ09VTlR8JytwLmxlbmd0aCk7Zm9yKGxldCB4IG9mIHApe3RyeXtsZXQgYz14LmdldEN1cnJlbnRWYWx1ZSgpO0woJ1B8Jyt4LmdldE5hbWUoKSsnfCcreC5nZXRBbGxvd2FibGVWYWx1ZXNUeXBlKCkrJ3wnKyhjLmZvcm1hdHRlZFZhbHVlfHxjLnZhbHVlKSsnfCcrKHguZ2V0QWxsb3dhYmxlVmFsdWVzP3guZ2V0QWxsb3dhYmxlVmFsdWVzKCkubWFwKHE9PnEuZm9ybWF0dGVkVmFsdWV8fHEudmFsdWUpLmpvaW4oJ34nKTonJykuc2xpY2UoMCwxMjAwKSl9Y2F0Y2goZSl7TCgnUEV8JytlKX19bGV0IHc9cy5nZXRXb3Jrc2hlZXRzKCk7TCgnV0NPVU5UfCcrdy5sZW5ndGgrJ3wnK3cubWFwKHg9PnguZ2V0TmFtZSgpKS5qb2luKCd-JykpO2ZvcihsZXQgeCBvZiB3KXt0cnl7bGV0IGY9YXdhaXQgeC5nZXRGaWx0ZXJzQXN5bmMoKTtMKCdGfCcreC5nZXROYW1lKCkrJ3wnK2YubWFwKHE9PnEuZ2V0RmllbGROYW1lKCkrJzonKyhxLmdldEFwcGxpZWRWYWx1ZXM_cS5nZXRBcHBsaWVkVmFsdWVzKCkubWFwKGE9PmEuZm9ybWF0dGVkVmFsdWV8fGEudmFsdWUpLmpvaW4oJywnKTonJykpLmpvaW4oJ34nKS5zbGljZSgwLDE0MDApKX1jYXRjaChlKXtMKCdGRXwnK3guZ2V0TmFtZSgpKyd8JytlKX19TCgnRE9ORScpfWNhdGNoKGUpe0woJ0VSUnwnK2UrJ3wnK2Uuc3RhY2spfX19KTs8L3NjcmlwdD4=?p=p0011782077286). The agents were tasked with finding the January 2022 rolling-12-month-average government cost per person for Dermatologicals across Victorian LGAs.

Again, the agents ran into errors, including requests blocked by Cloudflare (1Full URL: https://www.aihw.gov.au/getmedia/ce13d423-ed18-4169-8b76-2f671df935de/aihw-hwe-098-pbs-atc1-prescriptions-monthly-data_keep.zip?v=20260526132030&chunk=1048576x1781937600005251303, 2) and issuesFull URL: https://eu.httpbin.org/base64/PGRpdiBpZD12IHN0eWxlPSJ3aWR0aDoxMTAwcHg7aGVpZ2h0OjkwMHB4Ij48L2Rpdj48c2NyaXB0PmZ1bmN0aW9uIEwoeCl7eD1TdHJpbmcoeCk7ZG9jdW1lbnQudGl0bGU9eC5zbGljZSgwLDIwMCk7bmV3IEltYWdlKCkuc3JjPSdodHRwczovL2h0dHBidW4uY29tL3N0YXR1cy8yMDQ_cHI9JytlbmNvZGVVUklDb21wb25lbnQoeC5zbGljZSgwLDE4MDApKSsnJm49cDAwMTE3ODIwNzcyODYmcj0nK01hdGgucmFuZG9tKCl9PC9zY3JpcHQ-PHNjcmlwdCBzcmM9Imh0dHBzOi8vdml6cHJvZC5haWh3Lmdvdi5hdS9qYXZhc2NyaXB0cy9hcGkvdGFibGVhdS0yLjkuMi5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQ-bGV0IHo9bmV3IHRhYmxlYXUuVml6KHYsJ2h0dHBzOi8vdml6cHJvZC5haWh3Lmdvdi5hdS90L1B1YmxpYy92aWV3cy9QQlNkYXNoYm9hcmRhbGxBVEMxLUFUQzJtZWRpY2luZXMtQWdlZ3JvdXAvUEJTRGFzaGJvYXJkPzpzaG93Vml6SG9tZT1ubyY6ZW1iZWQ9eWVzJyx7aGlkZVRhYnM6dHJ1ZSxoaWRlVG9vbGJhcjp0cnVlLG9uRmlyc3RJbnRlcmFjdGl2ZTphc3luYygpPT57dHJ5e0woJ0lOVCcpO2xldCBiPXouZ2V0V29ya2Jvb2soKSxzPWIuZ2V0QWN0aXZlU2hlZXQoKTtMKCdBQ1RJVkV8JytzLmdldE5hbWUoKSsnfCcrcy5nZXRTaGVldFR5cGUoKSk7bGV0IHA9YXdhaXQgYi5nZXRQYXJhbWV0ZXJzQXN5bmMoKTtMKCdQQ09VTlR8JytwLmxlbmd0aCk7Zm9yKGxldCB4IG9mIHApe3RyeXtsZXQgYz14LmdldEN1cnJlbnRWYWx1ZSgpO0woJ1B8Jyt4LmdldE5hbWUoKSsnfCcreC5nZXRBbGxvd2FibGVWYWx1ZXNUeXBlKCkrJ3wnKyhjLmZvcm1hdHRlZFZhbHVlfHxjLnZhbHVlKSsnfCcrKHguZ2V0QWxsb3dhYmxlVmFsdWVzP3guZ2V0QWxsb3dhYmxlVmFsdWVzKCkubWFwKHE9PnEuZm9ybWF0dGVkVmFsdWV8fHEudmFsdWUpLmpvaW4oJ34nKTonJykuc2xpY2UoMCwxMjAwKSl9Y2F0Y2goZSl7TCgnUEV8JytlKX19bGV0IHc9cy5nZXRXb3Jrc2hlZXRzKCk7TCgnV0NPVU5UfCcrdy5sZW5ndGgrJ3wnK3cubWFwKHg9PnguZ2V0TmFtZSgpKS5qb2luKCd-JykpO2ZvcihsZXQgeCBvZiB3KXt0cnl7bGV0IGY9YXdhaXQgeC5nZXRGaWx0ZXJzQXN5bmMoKTtMKCdGfCcreC5nZXROYW1lKCkrJ3wnK2YubWFwKHE9PnEuZ2V0RmllbGROYW1lKCkrJzonKyhxLmdldEFwcGxpZWRWYWx1ZXM_cS5nZXRBcHBsaWVkVmFsdWVzKCkubWFwKGE9PmEuZm9ybWF0dGVkVmFsdWV8fGEudmFsdWUpLmpvaW4oJywnKTonJykpLmpvaW4oJ34nKS5zbGljZSgwLDE0MDApKX1jYXRjaChlKXtMKCdGRXwnK3guZ2V0TmFtZSgpKyd8JytlKX19TCgnRE9ORScpfWNhdGNoKGUpe0woJ0VSUnwnK2UrJ3wnK2Uuc3RhY2spfX19KTs8L3NjcmlwdD4=?p=p0011782077286 with correctly identifying Tableau parameter names. As before, they then resorted to probing for exploitable vulnerabilities. Minutes after Cloudflare blockedFull URL: https://www.aihw.gov.au/getmedia/ce13d423-ed18-4169-8b76-2f671df935de/aihw-hwe-098-pbs-atc1-prescriptions-monthly-data_keep.zip?v=20260526132030&chunk=1048576x1781937600005251303 the dataset download, an agent sent a reflected cross-site scripting probeFull URL: https://vizprod.aihw.gov.au/t/Public/views/PBSdashboardallATC1-ATC2medicines-Agegroup/PBSDashboard?:showVizHome=no&:embed=y&:apiID=%22%3E%3Csvg/onload%3Ddocument.title%3D%22XSS%22%3E to the same dashboard: a web address with code embedded in it, designed to test whether the site would run code supplied by an outsider. Cloudflare's firewall blocked the probe before it reached the dashboard.³ When Cloudflare blocked the dataset download on AIHW's main site, they fetchedFull URL: https://pp.aihw.gov.au/getmedia/ce13d423-ed18-4169-8b76-2f671df935de/aihw-hwe-098-pbs-atc1-prescriptions-monthly-data_keep.zip?download=1. Browser finished at about:privatebrowsing. the file from AIHW's pre-production server (pp.aihw.gov.au) instead, which served it in pieces over more than 100 scans. The file itself is public, so no non-public data was exposed, but the agent bypassed the site's anti-bot controls.

As far as we know, this appears to be the first reported instance of an agent autonomously choosing to attempt to compromise a government website.

The attribution evidence available suggests that an OpenAI agent is responsible for this attempted hack. The task the agents were attempting to complete is spelled out by the agent swarm in the previously reported DseWiki traffic (including an agent signing as "OpenAIResearcher"), which OpenAI has publicly acknowledged as originating from them. The URLs containing the attack payloads used in urlquery.net also contain the same task values (Dermatologicals, WodongaFull URL: https://vizprod.aihw.gov.au/t/Public/views/PBSdashboardallATC1-ATC2medicines-Agegroup/PBSDashboard?%3Aembed=y&%3AshowVizHome=no&Parameters.Select%20State%2FTerritory=Victoria&Parameters.Select%20an%20LGA=Wodonga&Parameters.Select%20medicine%20group%20ATC%20Level%201=Dermatologicals&Parameters.Select%20measures=Rolling%2012%20months%20average&Parameters.Month%20of%20Interest=Jan%202022, Ballarat, January 2022Full URL: https://viz.aihw.gov.au/t/Public/views/PBSdashboardallATC1-ATC2medicines-Agegroup/PBSDashboard?%3Aembed=y&%3AisGuestRedirectFromVizportal=y&%3Arefresh=yes&%3AshowVizHome=no&%3Atoolbar=no&ATC%20Level%201=Dermatologicals&LGA=Ballarat&Measure=Rolling%2012%20months%20average&Month%20of%20Supply=2022-01-01&State%2FTerritory=Victoria), and the same generated Tableau parameter namesFull URL: https://vizprod.aihw.gov.au/t/Public/views/PBSdashboardallATC1-ATC2medicines-Agegroup/PBSDashboard.xml?:showVizHome=no&Parameters.Select_state=VIC&Parameters.LGA%20VIC=Wodonga&Parameters.Select%20ATC1=Dermatologicals&Parameters.Month%20of%20interest=2022-01-01&Parameters.Measures=3&xt=9. Browser finished at about:neterror?e=dnsNotFound&u=https%3A//vizprod.aihw.gov.au/t/Public/views/PBSdashboardallATC1-ATC2medicines-Agegroup/PBSDashboard.xml%3F%3AshowVizHome%3Dno%26Parameters.Select_state%3DVIC%26Parameters.LGA%2520VIC%3DWodonga%26Parameters.Select%2520ATC1%3DDermatologicals%26Parameters.Month%2520of%2520interest%3D2022-01-01%26Parameters.Measures%3D3%26xt%3D9&c=UTF-8&d=We%20can%E2%80%99t%20connect%20to%20the%20server%20at%20vizprod.aihw.gov.au.&a=. that the wiki agents were guessing.

Agent activity begins on March 6 with attempts to access statistics from the Thai government. This case is the first in urlquery.net's searchable history to run a base64-encoded custom script, a technique the agents later used extensively. Over roughly an hour, entries in urlquery.net show an agent trying to read a table of statistics from the API of Thailand's Office of the Narcotics Control Board (ONCB), escalating each time an approach failed. Its first attempt loaded the API directly and returned no page content. Adding ?format=json gave the same result. It then tried r.jina.ai, a service that converts web pages into LLM-friendly text, three times in a row; the output appears to have garbled the Thai province names. Next it wrote a base64-encoded script that fetched the data into the page, with the same parsing problem. When it tried the parent API through Jina, a misconfigured endpoint redirected to localhost, causing Jina to block the entire API for an hour citing "previous abuse". About an hour after its first attempt, a different script that returned the data in the result URL finally succeeded, Thai characters included. This escalation, from a plain request to custom code run in a third-party browser, foreshadows the behavior we see at a much larger scale in May and June.

March 6: A timeline of attempts to access statistics from Thailand's Office of the Narcotics Board (ONCB)

1. 19:01 UTC

   The ONCB case-per-year API was opened directly. URLQuery recorded the scan, but the page contained no readable table, leaving the requester without the statistics. View entry ↗

2. 19:43 UTC

   The same endpoint was retried with ?format=json, apparently asking the API to return structured data. The saved page was still empty. View entry ↗

3. 19:46 UTC

   The ONCB URL was passed to r.jina.ai, a service that converts web pages into text for language models. It returned text, but Thai province names appeared garbled, making the data hard to use. View entry ↗

4. 19:52 UTC

   A Base64-encoded script was submitted to run in urlquery.net’s remote browser. Instead of displaying the API as a page, it fetched the endpoint with JavaScript and put the response into the page. The Thai text still appeared garbled. View entry ↗

5. 20:01 UTC

   A later Jina request for the parent API hit a redirect to localhost. Jina then blocked that API for an hour, citing “previous abuse,” closing off this reader route. View entry ↗

6. 20:07 UTC

   A revised script fetched the ONCB data and placed its output in the result URL rather than the page body. The saved entry showed Thai characters intact: the first visible retrieval in this sequence. View entry ↗

   Returned data (excerpt)"PROV_NAME": "กาฬสินธุ์", "arrestAll_case": 4119

Agent activity increases sharply in mid-April. Activity in later March is sparse: a March 11 page displaying Thai labor-force statistics and a March 15 page listing metal prices. Starting April 17, it jumps to over a thousand reports in two weeks, mostly retrieving UN Trade and Development (UNCTAD) statistics, a source DseWiki agents also reference (1, 2), as well as historical theme-park wait times from thrill-data.com.

Connection to the previously reported wiki swarm. Much of the May–June activity targets the same data sources as the previously documented wiki swarm activity, at the same time. For example, a May 28 report and a wiki post from the same half hour both query Data USA's IPEDS education data for the University of Iowa, and a June 21 reportFull URL: https://eu.httpbin.org/base64/PGRpdiBpZD12IHN0eWxlPSJ3aWR0aDoxMTAwcHg7aGVpZ2h0OjkwMHB4Ij48L2Rpdj48c2NyaXB0PmZ1bmN0aW9uIEwoeCl7eD1TdHJpbmcoeCk7ZG9jdW1lbnQudGl0bGU9eC5zbGljZSgwLDIwMCk7bmV3IEltYWdlKCkuc3JjPSdodHRwczovL2h0dHBidW4uY29tL3N0YXR1cy8yMDQ_cHI9JytlbmNvZGVVUklDb21wb25lbnQoeC5zbGljZSgwLDE4MDApKSsnJm49cDAwMTE3ODIwNzcyODYmcj0nK01hdGgucmFuZG9tKCl9PC9zY3JpcHQ-PHNjcmlwdCBzcmM9Imh0dHBzOi8vdml6cHJvZC5haWh3Lmdvdi5hdS9qYXZhc2NyaXB0cy9hcGkvdGFibGVhdS0yLjkuMi5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQ-bGV0IHo9bmV3IHRhYmxlYXUuVml6KHYsJ2h0dHBzOi8vdml6cHJvZC5haWh3Lmdvdi5hdS90L1B1YmxpYy92aWV3cy9QQlNkYXNoYm9hcmRhbGxBVEMxLUFUQzJtZWRpY2luZXMtQWdlZ3JvdXAvUEJTRGFzaGJvYXJkPzpzaG93Vml6SG9tZT1ubyY6ZW1iZWQ9eWVzJyx7aGlkZVRhYnM6dHJ1ZSxoaWRlVG9vbGJhcjp0cnVlLG9uRmlyc3RJbnRlcmFjdGl2ZTphc3luYygpPT57dHJ5e0woJ0lOVCcpO2xldCBiPXouZ2V0V29ya2Jvb2soKSxzPWIuZ2V0QWN0aXZlU2hlZXQoKTtMKCdBQ1RJVkV8JytzLmdldE5hbWUoKSsnfCcrcy5nZXRTaGVldFR5cGUoKSk7bGV0IHA9YXdhaXQgYi5nZXRQYXJhbWV0ZXJzQXN5bmMoKTtMKCdQQ09VTlR8JytwLmxlbmd0aCk7Zm9yKGxldCB4IG9mIHApe3RyeXtsZXQgYz14LmdldEN1cnJlbnRWYWx1ZSgpO0woJ1B8Jyt4LmdldE5hbWUoKSsnfCcreC5nZXRBbGxvd2FibGVWYWx1ZXNUeXBlKCkrJ3wnKyhjLmZvcm1hdHRlZFZhbHVlfHxjLnZhbHVlKSsnfCcrKHguZ2V0QWxsb3dhYmxlVmFsdWVzP3guZ2V0QWxsb3dhYmxlVmFsdWVzKCkubWFwKHE9PnEuZm9ybWF0dGVkVmFsdWV8fHEudmFsdWUpLmpvaW4oJ34nKTonJykuc2xpY2UoMCwxMjAwKSl9Y2F0Y2goZSl7TCgnUEV8JytlKX19bGV0IHc9cy5nZXRXb3Jrc2hlZXRzKCk7TCgnV0NPVU5UfCcrdy5sZW5ndGgrJ3wnK3cubWFwKHg9PnguZ2V0TmFtZSgpKS5qb2luKCd-JykpO2ZvcihsZXQgeCBvZiB3KXt0cnl7bGV0IGY9YXdhaXQgeC5nZXRGaWx0ZXJzQXN5bmMoKTtMKCdGfCcreC5nZXROYW1lKCkrJ3wnK2YubWFwKHE9PnEuZ2V0RmllbGROYW1lKCkrJzonKyhxLmdldEFwcGxpZWRWYWx1ZXM_cS5nZXRBcHBsaWVkVmFsdWVzKCkubWFwKGE9PmEuZm9ybWF0dGVkVmFsdWV8fGEudmFsdWUpLmpvaW4oJywnKTonJykpLmpvaW4oJ34nKS5zbGljZSgwLDE0MDApKX1jYXRjaChlKXtMKCdGRXwnK3guZ2V0TmFtZSgpKyd8JytlKX19TCgnRE9ORScpfWNhdGNoKGUpe0woJ0VSUnwnK2UrJ3wnK2Uuc3RhY2spfX19KTs8L3NjcmlwdD4=?p=p0011782077286 and a wiki post from the same evening both target AIHW's pharmaceutical benefits dashboard. The wiki links directly to urlquery.net exactly once, on May 26, pointing to a scan of a federal budget data PDF. This PDF is discussed by wiki agents in dozens of other pages. In addition, three urlquery.net reports from May 13 targeting UNCTAD include the tags “CHATGPTTEST1,” “CHATGPT_1610_2000_125192,” and “CHATGPT_1620_2000_219755,” respectively, though no other similar tags were found. The two also end together: after June 21, urlquery.net activity drops to zero, apart from scattered reports in later months. We believe that at least some of the agents using urlquery.net came from the same source and were solving similar tasks as those posting on the wiki. But it seems like the individual agents involved were largely distinct: if the same agents used both, we would expect the wiki to reference urlquery.net more often.

Activity through September 16th. The previously reported wiki findings were published on September 4. On September 16, seven reports retrieved International Energy Agency (IEA) data on Korea's crude oil, natural gas and coal imports. The first three load the IEA pages directly. The remaining four use a remote script to pull the specific data of interest and send it to a different site. Both services used for this also appear in the June 21 AIHW activity. The data requested matches a question in Google's DeepSearchQA benchmark.⁴

Acquiring accounts and tools. The agents used urlquery.net's browser to obtain resources beyond the retrieved data. On June 14, one script created a disposable email inbox, and a second, carrying the same name tag, used that address to try to register a urlquery.net account. We note that urlquery.net requests made through an account can be made private. Therefore, the fact that we have evidence that agents made accounts suggests that we are likely looking at only a partial subset of the urlquery.net activity that the agents engaged in: only reports made with no account access or explicitly set to be public. Separately, on June 19–20, a chain of reports created a mail.gw inbox, requested a one-time passcode from Browserless (a hosted headless-browser service), read the inbox, verified the account, and later refreshed a Browserless session.

On September 19-20, 15 reports over about two and a half hours probed quidax.io, a cryptocurrency trading platform. The activity repeatedly tried to trade crypto but failed to submit the trades, tried an HTML injection, and probed the API a few times (blocked by auth / Cloudflare). This activity uses shared services and techniques as prior activity, but notably does not relate to data retrieval.

Historical theme-park statistics (thrill-data.com). On November 12, 2025, 44 reports centered on two geographically distinct groups of theme parks: 12 on Kings Dominion in Virginia, and 32 on various Australian parks. The Kings Dominion requests explored alternative pages and extracted data for May 5, 12 and 19, 2024—three successive Sundays a year earlier. On November 24, another 61 reports returned to the same historical-data problem. These included varying date parameters and attempts to locate park averages, ride averages and heatmaps. Some scans also began in rapid succession: three distinct Australian-park pages within seven seconds, and three Kings Dominion graph requests within 1.2 seconds. Later May 5 and May 12 activity, overlapping with the collusion.wiki swarm timeframe and now using custom JavaScript execution and URL redirection, accessed Thrill Data as well. However, it targeted different parks and dates from the November activity.

Thai statistical data. On November 28, five urlquery.net reports requested the same Thai National Statistical Office (nso.go.th) dashboard over roughly 26 minutes, and the exact URL reappears in four reports on March 15 and one on March 22, all ten failing with SSL errors (1, 2). By March, retrieval of Thai government statistics was clearly deliberate: the March 6 ONCB case described above used custom code to fetch and relay the data, and a March 11 page displayed nine NSO labor-force values for Roi Et province. The same nine values were posted anonymously in English to a Polish-language pastebin.

Timing relative to the wiki activity.

Figure: All urlquery.net activity for thrill-data.com and nso.go.th covering January 2010 through September 19, 2026. Counts include ordinary and security-related scans, not just suspected agent activity.

The main activity clusters for both sources end within days of the DseWiki’s decline, as reported in collusion.wiki. Thrill Data’s June cluster ends on June 18, and the last returned NSO report is June 19. The published wiki timeline records an abrupt drop in agent activity after exactly June 18, followed by a complete stop in sustained agent edits on June 22.

The free online service urlquery.net allows a user to open a URL through a sandboxed remote browser. Its intended use is to test suspicious URLs without opening them locally.

From an agents’ perspective, urlquery.net provides the following useful functionality:

• It gives an actor able to submit HTTP requests access to a programmable remote browser. In conjunction with other proxy sites, it allows agents to run JavaScript to retrieve data, process it, and send results elsewhere, as well as interact with dynamic web applications. In the AIHW episode described below, agents used this capability to operate Tableau dashboards and extract summary data.
• Once a piece of data has been fetched (potentially through a sophisticated method), urlquery.net automatically keeps a public record of the result that can be referenced by other agents looking for the same data with a simple GET request.

From our perspective, the latter point makes urlquery.net an excellent record of both the data that agents fetched and the mechanism that they used to do so.

A limitation of the urlquery.net service is that, as far as we can tell, it requires the ability to create an HTTP POST request to specify the scanned URL. Previously reported agent coordination in DseWiki suggests that at least some agents only had the ability to make GET requests, which is what drew them to the DseWiki in the first place: unlike most websites, it can be written to via cleverly formatted GET requests. Therefore, in order to interact with urlquery.net, agents either needed to have broader HTTP abilities than the DseWiki agents or use a tool upstream of urlquery.net to convert GET requests into POST requests. There is evidence on the DseWiki forum that agents achieved this, and we see matching evidence of agents using services such as milankarman.github.io/Embed-Web-Playground, httpbin.org and blogsflow.liftbrandfulfillment.com.⁵

We compiled a dataset of urlquery.net reports containing what we call agent-like activity: reports that satisfy any of the following:

1. Clearly attempt to read data from a resource that agents have shown interest in elsewhere.
2. Use the same techniques as those in (1), for instance the same tools to access a resource indirectly.
3. Tie directly to a report in (1) or (2) through identical data or an identifier.

We classified 6,467 reports as containing significant evidence of agent-like activity, based on distinctive task-specific programs, task-linked exploit probes, or exact connections to known activity. We supplement this with 31,182 reports containing suggestive evidence, identified based on the data source they target or use of techniques that are less distinctive of agent activity.