Request: 2 matched .onion hostnames from 2016 Project Sonar Tor scan (3301.json LFS object)

[MattSnowCrash]

Hi rtkd,

I'm Matt O'Brien, running cryptanalysis research on the Cicada 3301 Liber Primus at SnowCrash Labs (snowcrashlabs.com).

Over the last few weeks we've done a comprehensive AI-orchestrated sweep of every classical and structural cipher hypothesis on LP2. Most relevantly for you: we identified what appear to be two Tor v2 onion addresses mathematically encoded in LP page 73's 512-bit hash. The extraction ("first 8 hex of each of 5 visible lines → base32") is unique across 160 tested extraction rules at ~10⁻²² coincidence probability:

• gy3hoy2zizvuzvdb.onion
• rxxemt626fcwretk.onion

Both are inaccessible (Tor v2 deprecated Oct 2021) and neither appears in any public archive we've checked — Wayback, archive.org, OnionScan datasets, community forums, or academic crawls.

Your idclip repo is the single most relevant reference I've been able to find. Per the .log file, in 2016 you ran the regex \b3301\b against Project Sonar's Tor HTTP scan data and matched exactly 2 hosts. That match count is striking — two hits on a highly-selective regex across a multi-terabyte 2016 internet scan. If either of those hosts is gy3hoy2zizvuzvdb or rxxemt626fcwretk, we'd have external 2016 confirmation that these addresses were live.

Unfortunately the LFS object behind log/2016-onion-http/3301/3301.json has been purged from GitHub's storage (HTTP 404; oid d401ca82dd21e6ce9ad99b47e88f6e4119c1c17aa2fbeb5d16eacdbf8ce9d200, 8.71 MB). Software Heritage never archived the repo; no mirrors carry the LFS blobs.

Ranked ask, any tier would be valuable:

1. Minimum (easiest — 2 minutes): just the 2 .onion hostnames from the \b3301\b match. A quick grep over your local copy of that file should surface them. Posting those two hostnames in a reply — publicly or privately — would let us verify or rule out the hypothesis immediately.

2. If convenient: the 1 matched .onion from \b1033\b (log/2016-onion-http/1033/1033.json, LFS oid ff169ef3...36c, 1.6 MB). 1033 is the companion Cicada number from the magic square on LP page 16, so any match there is also meaningful.

3. If you're feeling generous: the full HTTP response bodies from those 2-3 matched hosts. What the onions actually served in 2016 could potentially unlock LP2 itself.

4. Most helpful but biggest ask: git lfs push --object-id the original blobs back up so they're archived for future researchers. This also resolves a gap for anyone else working on Cicada.

5. Orthogonal: your iddt crawler was specifically designed to find the LP page 73 hash target by brute-force hashing crawled onion addresses. If it ever ran against gy3hoy2zizvuzvdb or rxxemt626fcwretk, that's also valuable data.

What I can offer in return:

• Full attribution in any publication of this work (currently a ~15-page writeup under revision)
• Our complete cryptanalysis methodology — wave logs, scoring corpus (11.67M-rune unified Thelemic-esoteric model), and all null-result evidence from ~80 waves
• Whatever acknowledgment or co-authorship structure works for you
• Strictly non-commercial, academic use only

Everything we're doing is public-puzzle cryptanalysis in the same research category as work on Zodiac Z340, Voynich, Beale, and Kryptos. No target systems, no commercial intent.

Your work on idclip and iddqd is genuinely impressive and the canonical LP transcription we're using comes from your corpus. I appreciate you considering this.

Best,
Matt O'Brien
SnowCrash Labs · San Francisco
matt@snowcrashlabs.com · @MattSnowCrash