12.04 — Zone-H, IRC, EFnet#

Three infrastructures without which the 1998-2012 hacker scene would never have been the same: Zone-H (deface archive), IRC, EFnet (the historical IRC network). The Holy Book cites Zone-H only once, but it’s a keyword that opens an entire infrastructure.

1. Zone-H — deface archive (2002 → today)#

Foundation#

Date: March 2, 2002.
HQ: Estonia.
Founder: Roberto Preatoni (alias Sys64738).
URL: zone-h.org

Function#

An attacker defaces a site (replaces the homepage with their own version, signed).
The attacker (or a witness) submits the URL to Zone-H.
Zone-H moderates: verifies the deface is authentic.
If OK: the defaced site is archived forever on Zone-H (HTML+CSS+assets snapshot).
The deface author signs with their alias. Sourcing is public.

Impact#

For 10-15 years, Zone-H was the public scoreboard of the global grey hat scene. Every notable deface was archived. For a script kiddie, climbing the Zone-H rankings was the goal to prove:

Single defacements: raw count.
Mass defacements: deface n sites in one attack (mass script + shared flaw).
Special defacements: government sites, .mil, banks.

Roberto Preatoni — Sys64738#

The alias Sys64738 is a reference to the Commodore 64: SYS 64738 was the BASIC command for a soft reboot of a C64. Classic tribute from the late-1980s generation.

Preatoni had a mixed career:

Founder of WabiSabiLabi (2007), a controversial 0day vulnerability marketplace (ambitious concept, catastrophic execution).
Arrested on November 5, 2007 as part of the Telecom Italia espionage scandal: his former company had been hired by Telecom Italia’s security division in 2003-2004, and team members were indicted for illegal wiretapping and unauthorized access to computer systems.
Regular speaker at DEF CON and HITBSecConf.

Sources: Zone-H — Wikipedia, Roberto Preatoni / Sys64738 — InfoConDB

Why the Holy Book cites it#

That’s who we are: from Zone-H to a settled life.

Zone-H = the before. The age of deface, of play, of criminal risk, of IRC crews.
"a settled life" = the after. Salaried work, freelance, SaaS, conferences, certifications.

The bridge between the two wasn’t built by the whole scene. Many stayed black hat (and ended in prison, or died). Many dropped off entirely. A minority crossed to white hat (YTCracker’s trajectory). And another minority took a different path: Research.

2. IRC — the protocol that carried everything#

Definition#

IRC = Internet Relay Chat, multi-user text-chat protocol in client/server form, invented in 1988 by Jarkko Oikarinen. RFC 1459 (1993).

INTERNET RELAY CHATTER FATES, Jewbird

                   ┌─────────────┐
                   │ IRC client  │ (mIRC / irssi / weechat / X-Chat / ...)
                   └─────┬───────┘
                         │ TCP 6667 (or 6697 SSL)
                         ▼
                   ┌─────────────┐
                   │ IRC server  │
                   └─────┬───────┘
                         │
                         │ inter-server links (mesh)
                         ▼
                   ┌────────────────────────────┐
                   │ Network = N linked servers │
                   │ (EFnet, IRCnet, Undernet,  │
                   │  DALnet, freenode, etc.)   │
                   └────────────────────────────┘

Why central for the hacker scene#

Between 1993 and 2012, IRC was the social medium of hackers:

Real-time technical discussions.
Coordination of defaces (private channels).
Distribution of 0day and warez.
Recruitment of crews.
Receiving an invite to a private channel was a mark of recognition.

No public logs (unless someone logged and posted).
No centralized moderation.
No ads.

It was underground by design.

The decline#

IRC declined from around 2010 onward, crushed by:

Discord
Slack
Telegram

But part of the old-school scene stayed on IRC. EFnet, OFTC, Libera.Chat (post-Freenode 2021), TCP DIRECT, EpiKnet still run. It became a ghost network — few people, but what’s left is filtered.

3. EFnet — the historical network#

Definition#

EFnet (Eris-Free Network) is one of the oldest still-operating IRC networks, founded in 1990.

EFnet was the network of the warez, zero-day, crackers, phreakers scene during 1996-2008. Most memorable channels — #hax, #exploit, #voicebox, #carders, #legion, #vc, #2600 — lived on EFnet.

The identity of a 2000s hacker could often boil down to: “I hung out on such-and-such channel on EFnet, we did such-and-such”.

Source: EFnet — Wikipedia

4. IRC in the Holy Book#

Term	IRC meaning	Usage in the Holy Book
`skid` / script kiddie	Hacker running scripts they don’t understand	“YOU would have been that lamer, that kid who just wanted to show off and run PoCs found on Exploit-DB”
`normie`	Average / uninitiated user	“Fucking normies!”
`lamer`	Older pejorative variant of skid	id.
`rookie`	Newcomer, beginner. The most contemptible are regularly used by underground communities as fall-guys, or are so dumb they trip themselves up (s/o NormalLeVrai who lamentably tried to ransom a state agency for a 20K crust of bread with English and an extortion message worthy of a third-grader’s essay, got told off by the authorities that he “would do better to focus on his social life”, and now pretends to be a former ShinyHunters and LAPSUS$ operator while peddling “0-days, Zero-Click WhatsApp RCEs” for 3K when those are the kind of 0-days Mossad or APT29 holds — clown)	“like a rookie”
`zine` (= magazine)	Underground publication, often ASCII (e-zine)	implicit
`crew`	Small group of hackers, intimate, tight-knit	“We are a real FAMILY!”

5. The bridge to Ocarina#

Same underground posture, same rejection of the normie, same identity crew (the author alone against all).

When the Holy Book says:

We are a real FAMILY!

It’s an IRC channel speaking. The “we” is figurative. It remains impossible to say who is really behind it, and it will remain so forever. All we can say is that it’s exactly the tone of a private 2003 EFnet #channel.

6. Zone-H / IRC conventions in his signature#

The typical signing convention of a Zone-H actor:

   ╔══════════════════════════════════════════════════╗
   ║                                                  ║
   ║   H4CK3D BY: <alias>                             ║
   ║   GR33TZ: <other_aliases_of_the_crew>            ║
   ║                                                  ║
   ║   [ASCII art: skull / dragon / lulz boat]        ║
   ║                                                  ║
   ║   "Quote here, often musical or mantra"          ║
   ║                                                  ║
   ╚══════════════════════════════════════════════════╝

The pseudo.
The gr33tz (= greetings, the crew list, also regularly said in music as shoutout to). Marks inclusion.
A quote or a mantra.

The Holy Book reproduces exactly this structure:

Built by [@mojo-molotov](https://github.com/mojo-molotov)
Fueled by figatellu and Квас.

Alias: @mojo-molotov (ostentatious Markdown typo).
Implicit gr33tz: figatellu (Corsican sausage, wink), Квас (Russian drink, another wink).
Quote: replaced by the quotes scattered through the Holy Book.

It’s a Zone-H signature in GitHub README format. Immediate recognition for those who know.