Reposting here as well, in case some of y'all missed it
Quick item on using RegEx to find infrastructure used by DPRK-actors (and loads of Github repositories)
https://buttondown.com/readwrite/archive/edition-6-using-regex-to-catch-state-sponsored/
hakan “:verified:”
npub1u2…v8zpj
2026-01-08 09:13:14 UTC
Author Public Key
npub1u2vjcwlxklwlnwe2xhvvnfntxueqyxgyjamg2fj68amqn8t8k3rq5v8zpjSeen on
wss://relay.momostr.pinkPublished at
2026-01-08 09:13:14 UTCEvent JSON
{
"id": "913a06f18d08ff19a1b788b8d95fa0f58f6b86910438f49b32850777d8ebef4c",
"pubkey": "e2992c3be6b7ddf9bb2a35d8c9a66b3732021904977685265a3f76099d67b446",
"created_at": 1767863594,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@hatr/115858708525717663",
"web"
],
[
"proxy",
"https://infosec.exchange/users/hatr/statuses/115858708525717663",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/hatr/statuses/115858708525717663",
"pink.momostr"
],
[
"-"
]
],
"content": "Reposting here as well, in case some of y'all missed it\n\nQuick item on using RegEx to find infrastructure used by DPRK-actors (and loads of Github repositories)\n\nhttps://buttondown.com/readwrite/archive/edition-6-using-regex-to-catch-state-sponsored/",
"sig": "1cbeebd1b8c6e71f5650feabaeebc78e9e7a647d18ac8dc2c33c1bf5efdf6ac0002633dc838ff115ebc54239d9070ead0c491a16145bec1e01ce55f16a921b78"
}