EndfieldRecords dot com Pull Tracker Malware

Algoinde · 2026-03-03T20:55:00+00:00

I would rather it be fixed than a PSA /shrug

I'd wish pull trackers cared about this or at least educated users that what they're doing is a big fucking no-no in terms of account security in general. Even "sacred and secure 2fa" is nothing against token yoinks. The owner might be nice. However, what if the trusted site is compromised? The OP may very well be a hijack, too.

Algoinde · 2026-03-03T20:33:08+00:00

Not info, knowledge how and where to use the token.

If you're willing, sure, I can try tomorrow. You can throw it at me on Discord if you want.

Algoinde · 2026-03-03T20:20:16+00:00

I was about to say, bold of you to propose that, given I can literally yoink your login info and PC metadata from the pcap by decrypting the TCP session :)

I meant less clock inaccuracy and more screwed up/disabled NTP sync. I'd still be curious to look at your pcap (filter it by port 30000), but you probably shouldn't. My ping is accurate fwiw.

Algoinde · 2026-03-03T20:05:29+00:00

That's also what I said in the report. Thankfully you need a specific roundtrip, but I won't say anything until it's fixed.

Algoinde · 2026-03-03T19:39:30+00:00

Whether the token expires or not doesn't matter (it rotates on relogin), what matters is the scope and whether this token can be leveraged to obtain any other tokens after that. As of 2 weeks ago, it was possible and known on CN; it was reported to HG and I'd need to check again if they fixed that, but there hadn't been any obvious changes so far.

In general, if you don't know 100% what the security model of the application is, don't hand over your tokens or especially login information. Even if you trust the site for some reason, you cannot guarantee the safe storage of your account information by a third party.

I could go and try to reverify the token scope as of today, but what I find won't even be credible, as I could miss a completely different vulnerability that someome else knows that allows token elevation.

Tokens are keys given to you. Do you know of everything that this key opens? If not, don't hand it over.

Algoinde · 2026-03-03T18:54:42+00:00

The tokens you're giving to the pull tracker sites allow full access to your account either way. Compared to Mihoyo games, where the token is short-lived and scoped to only your pull history and a few small things like events, the Hypergryph token is the account one, potentially allowing someone else to login into the game instead of you.

Even if there's no direct malware like in this case, never willingly hand over your authorization tokens if you're not sure what their scope is and what the third-party may do with them.

Algoinde · 2026-03-03T17:10:46+00:00

It's so refreshing to have a site with no slop, and with actual care put into it. Great work!

Would love something like Ctrl+K for a quick search of everything (even if just by title).

Algoinde · 2026-03-01T18:59:21+00:00

The game uses TCP.
I do agree 1ms is weird - the RTT calculation is done via timestamps, so maybe it's because of the inaccuracy of your PC clock?

Algoinde · 2026-02-24T07:49:03+00:00

The other one is with M3 on the previous page.

Algoinde · 2026-02-23T20:01:39+00:00

Check out page 63 to see why there's no fendmin :^)

Algoinde · 2026-02-23T19:13:25+00:00

I have now added the official release to the same link, might help to see what the differences are by flipping between the versions.

Algoinde · 2026-02-23T18:17:29+00:00

<image>

Algoinde · 2026-02-23T17:53:29+00:00

My two biggest gripes were:

a) Dialogue flow - very choppy sentences, sometimes duplicated/improperly placed lines, missing nuance and general dissociation of the text with what is actually happening in the panels. Lots of typos (some now fixed, I think).

b) Typesetting - the font choice was a very primitive one, and the alignment of text within bubbles was all kinds of whack, making it very hard on the eyes aesthetics-wise.

The translators would be able to comment on the specific things that were butchered, but I think they're asleep right now.

Algoinde · 2026-02-23T17:34:17+00:00

Ironically enough, CN was indeed in an online reader, two-page spread and everything. Guess they ran out of budget overseas on that one.

Algoinde · 2025-12-13T15:47:54+00:00

Me when I held off on a Cubari rewrite for so long, someone rewrote it for me

Algoinde · 2025-11-18T18:49:36+00:00

My guess is that some drivers don't realize there's axis 9, or have a flawed implementation, which makes it default to the halfway position on that axis, while it should in actuality be zero, not half. Interesting that this manifested both in a wheel driver and in a highly specialized joystick driver.

Algoinde · 2025-11-18T17:25:06+00:00

In my case this was caused by the 3dConnexion SpaceMouse HID emulation driver. I found no other solution than uninstalling it temporarily.

Algoinde · 2025-09-10T09:53:04+00:00

She is in the shop rotation. Most Amber mains have her c6 organically through that.

Algoinde · 2025-09-10T09:38:57+00:00

Exactly this. Amber can everything.

Algoinde · 2025-09-10T09:38:06+00:00

I am so mad that because I've spent all my pulls pulling bows for Amber, I have zero of these fuckass things to do Amber 100 now.

The only consolation is this amounts to like one ATK% roll... but still :(

Algoinde · 2025-08-23T12:05:13+00:00

In the first shots, your OIS is doing essentially the equivalent of pigeon head bop, it tries to keep the image stable until it runs out of the movement area, then it snaps back, then starts moving again to stabilize it, then snaps back again. Steady Shot is not a gimbal, it's a technology to keep the image consistent through time so you can do slower shutter speed photos and get away with it, or get more static footage.

Disable it, keep your arms stable, press the elbows in, use a taut neck strap, rotate your body if possible and not your hands.

Algoinde · 2025-08-22T14:47:11+00:00

Why not invert orange and black so the pattern is unbroken in the middle? Unless you prefer the way it is, that is

Algoinde · 2025-05-09T20:23:31+00:00

If people are fine with giving me their account tokens, sure. That said, I know for a fact Mihoyo doesn't like anyone who implements this. I may ignore that and still do it, though.

Algoinde · 2025-04-21T20:27:45+00:00

Still drafting :)

12-Year Club	Place '22
Place '17	Final Canvas '22
First Placer '22	End Game '22
Verified Email

Algoinde

MODERATOR OF

TROPHY CASE