Cock.li, an anonymous email provider, is currently on red alert after a suspected gag order from government officials. The warrant canary archived here has been removed from the website, and the entire website has been replaced with the message below:
The service is under red alert, with instructions to download 2 files (ins10.luks and ins11.luks) via torrent, as well as an hour and a half long film about COCKCON 2020. Hidden inside the video via stenography is a file that can be extracted with the command ffmpeg -ss 4 -i "COCKCON 2020 (2019) (2022) [1080p] [OvO]/COCKCON 2020 (2019) (2022) [1080p] [OvO].mkv" -map 0:v:1 -pix_fmt yuv444p -f rawvideo ins00.luks, revealing the ins00.luks file. These instructions come from the image placed on the website, shown below:
These 3 files on their own are encrypted, and are useless without the decryption keys. The website states "I don't know if the encryption key will ever be released, but if it does, you'll want quick access to that file."
The 3 encrypted files total 900.7 MB so far. Given the large file size, I predict that the files will decrypt to become a video, potentially a goodbye message for Cock.li or urgent instructions on how to keep Cock.li running. Though, it's strange that the image calls it a "backup".
I also discovered a pattern in the filenames: The last 2 characters of the filename follow 2-bit binary counting, which goes 00, 01, 10, 11. Currently, only files 00, 10, and 11 exist. File ins01.luks does not currently exist. This file either does not exist, will be released later (possibly with the decryption keys), or is hidden somewhere for us to find.
Entertaining that last option, I visited all alternate Cock.li domains, and only found 3 domains of note:
- https://aaathats3as.com/ has a video embedded
- https://memeware.net/ has links to a random embedded video and a YouTube channel (https://www.youtube.com/channel/UC1-fw8iMrmJkERQH477Ncaw)
- https://cocaine.ninja/ has a file upload for cloud storage
Whether or not those will become useful remain to be seen. I have been archiving as much of this as I can on my home computer, in case any byte becomes useful. I suggest everyone does the same, and helps seed the torrents to spread these files. It's truly unfortunate to see a quality service being taken down by a government, and I hope Cock.li will win their legal battles.
This is my first time making a day-of writeup as a news piece. I'm happy to get feedback, and would like to know if you are interested in these kinds of writeups in the future! I will continue to archive the matter, potentially for a future writeup as new information emerges (no promises). I may also release my found files to my GitHub (no promises) which will be linked somewhere here later if I decide to.
Thanks for reading!
- The 8232 Project