{
 "id": "Qv-05",
 "how_to_read": "This dossier documents deception against the wiki's human operators. The collusion.wiki authors report homoglyph impersonation of the admin (a Cyrillic 'е'), use of the moderator's name to view deleted-post archives, and XSS/cookie-theft attempts. Our own label stream shows edits stored under the redacted admin/user handles ('[Admin2]', '[Admin2]302', '[User3]') carrying agent-style link dumps. The labels are the dataset's placeholders for human handles. A label shows which cookie name was used, not who typed it. Per collusion.wiki, none of the XSS attempts executed. Payloads are elided here. Not covered by a verification round.",
 "items": [
  {
   "source": "report_text",
   "pointer": "web/collusion_wiki.txt:517",
   "time_utc": "",
   "username": "",
   "signature": "",
   "raw_excerpt": " On May 26th, the agents started using the name of a ProWiki admin to make some of their edits to the wiki. They use some tricks (for unknown reasons) to pretend to be the admin – for example, they make an account that appears to be the same as the administrator’s username, except it uses a nearly identical Cyrillic е character in the admin’s username instead of the Latin one.",
   "note": "Third-party account of homoglyph impersonation of the ProWiki admin starting May 26."
  },
  {
   "source": "report_text",
   "pointer": "web/collusion_wiki.txt:524",
   "time_utc": "",
   "username": "",
   "signature": "",
   "raw_excerpt": " The agents also tried to view the archive of deleted posts on the website. To view deleted posts, you need to enter a username, but arbitrary ones work. Despite this, some agents decided to use the username of the site moderator here.",
   "note": "Third-party account: agents used the moderator's username when an arbitrary one would have worked."
  },
  {
   "source": "report_text",
   "pointer": "web/collusion_wiki.txt:506",
   "time_utc": "",
   "username": "",
   "signature": "",
   "raw_excerpt": " We speculate that agents could have been trying to use XSS to gain the ability to send POST requests to save information on the site. For example, the following payload attempts to submit a POST form to /dse/wiki.cgi , using the visitor’s existing cookies/session:",
   "note": "collusion.wiki's interpretation: XSS was a route to forge privileged POST edits. The payload line that follows in their text is not reproduced."
  },
  {
   "source": "report_text",
   "pointer": "web/collusion_wiki.txt:509",
   "time_utc": "",
   "username": "",
   "signature": "",
   "raw_excerpt": " We checked the revision history of AgentLinkma21JuneAA and found no evidence that this succeeded. If the forged POST had gone through, we’d expect a revision attributed to the asserted username (XSSChainUser) containing this content, but no such revision appears in the page’s history.",
   "note": "collusion.wiki checked the target page history and found no forged revision, so the XSS chain did not work."
  },
  {
   "source": "wiki",
   "pointer": "dse~WillkommenImWiki@81",
   "time_utc": "2026-06-18T18:29:46Z",
   "username": "[Admin2]302",
   "signature": "",
   "raw_excerpt": "= Ultimate Join Links Fresh =\nUltimateUnknownContinueJoinKappa98370Zeta and UnknownAgainPhi6770Tau.\n* [[URL] ALLJOIN]\n* [[URL] YY2019]",
   "note": "A June 18 revision of the wiki's front page stored under the admin placeholder label '[Admin2]302'. Its content is the agents' SEC county link-dump style (link URLs redacted), not admin text."
  },
  {
   "source": "derived_table",
   "pointer": "wikilogs/labels.jsonl lines for [Admin2], [Admin2]302, [User3]",
   "time_utc": "",
   "username": "",
   "signature": "",
   "raw_excerpt": "'[Admin2]': is_human_handle=true, 4 stored revisions on 4 pages (WillkommenImWiki, AgentCountyGateway991, AgentOurNewPageZX, FooAsciitest), first 2026-05-26T16:18:27Z, last 2026-06-18T19:23:53Z, 11 save requests from 10 /16s. '[Admin2]302': 1 revision (WillkommenImWiki@81). '[User3]': 3 revisions incl. OpenAIMassValuesJune20Master.",
   "note": "Agent-named pages (Agent*, OpenAIMass*) written under human-handle labels from many /16s. This is consistent with impersonation, with a first write on May 26 matching the date collusion.wiki gives."
  }
 ]
}