On: Paige Thompson, Capital One Hacking Suspect, Left ...

[danso]

I was confused by this line in the affidavit (page 9):

> An April 19, 2019, post in the Github account of "paige•••••thompson" includes a "Server List" of IP addresses associated with the account.

What Github "post" could this be referring to? A README.md/issue/comment in which she for some reason posted the IP addresses she uses with that account?

https://www.justice.gov/usao-wdwa/press-release/file/1188626...

[usmannk → danso]

Probably these: https://gist.github.com/paigeadelethompson?direction=desc&so...

[Susanoo → danso]

They also left a GitLab trail - https://gitlab.com/netcrave. We are looking at erratic, whereas they were https://github.com/netcrave

[amyjess → danso]

The first thing that comes to mind is a gist.

[_jyog → amyjess]

Correct. Some gists were still up yesterday when I looked (her github was down, though), and it seems she had a habit of posting logs of stuff, text snippets, etc. there.