I wonder if the fact that these random obscure wikis are being used implies that the agents first tried more obvious services like Tumblr, Neocities, Blogger, Reddit etc. [edit: oh, or HN obviously!]

It just seems so likely - trying the more obvious paths first is surely what they’d do?

I guess the only way we’ll find this out is if those services announce logs.