by

Ciro Santilli (@cirosantilli, 34)

The hard: finding new IP ranges!

Table of contents

2013 DNS census data (likely obtained via an illegal botnet)

dnscensus2013.neocities.org/

Figure 1.
DNS Census 2013 website
. Source. This source provided valuable historical domain to IP data.

amazon.com,2012-02-01T21:33:36,72.21.194.1
amazon.com,2012-02-01T21:33:36,72.21.211.176
amazon.com,2013-10-02T19:03:39,72.21.194.212
amazon.com,2013-10-02T19:03:39,72.21.215.232
amazon.com.au,2012-02-10T08:03:38,207.171.166.22
amazon.com.au,2012-02-10T08:03:38,72.21.206.80
google.com,2012-01-28T05:33:40,74.125.159.103
google.com,2012-01-28T05:33:40,74.125.159.104
google.com,2013-10-02T19:02:35,74.125.239.41
google.com,2013-10-02T19:02:35,74.125.239.46

https://raw.githubusercontent.com/cirosantilli/media/master/ciro-love-sqlite.png

Wayback Machine searches for the communication method paths: Tor army parallelization!

web.archive.org/cdx/search/cdx?url=capture-nature.com&matchType=domain

com,capture-nature)/robots.txt 20211229130524 https://www.capture-nature.com/robots.txt warc/revisit - XWX2XVEZVSVIUKYXF3AJUYIRDOLOXLTO 1213
com,capture-nature)/robots.txt 20211230151913 http://capture-nature.com/robots.txt warc/revisit - XWX2XVEZVSVIUKYXF3AJUYIRDOLOXLTO 1186
com,capture-nature)/robots.txt 20220419233721 https://www.capture-nature.com/robots.txt warc/revisit - XWX2XVEZVSVIUKYXF3AJUYIRDOLOXLTO 1075
com,capture-nature)/scenes.jar 20110201104851 http://capture-nature.com/Scenes.jar application/java-archive 200 U3GPB3SPISZKLFGUJFD34C5GXWAAC2GJ 287887
com,capture-nature)/scenes.jar 20110224193204 http://capture-nature.com/Scenes.jar application/java-archive 200 U3GPB3SPISZKLFGUJFD34C5GXWAAC2GJ 287890
com,capture-nature)/scenes.jar 20130903003254 http://capture-nature.com/Scenes.jar application/x-java-archive 200 U3GPB3SPISZKLFGUJFD34C5GXWAAC2GJ 287898
com,capture-nature)/trees-and-details 20200928184446 https://www.capture-nature.com/trees-and-details text/html 200 NO6J7567VFWZLRSKBJ5HVXGT27MX2A4K 30902
com,capture-nature)/trees-and-details 20210127132910 https://www.capture-nature.com/trees-and-details text/html 200 SI73WNJUBGTOXSTRK4IRU4D4AJ637F6A 31041
com,capture-nature)/trees-and-details 20210419062751 https://www.capture-nature.com/trees-and-details text/html 200 K4Q444QJ243HW3ECXNNOBNUFMXWAPVFD 31464

https://raw.githubusercontent.com/cirosantilli/media/master/cia-website-comms-methods.png

Tor automation at: github.com/cirosantilli/cirosantilli.github.io/blob/f45d859d4f9350e4a3deffdbb8acd86584d60f2c/cia-2010-covert-communication-websites/cdx-tor.sh

Cheeky fuzzy fingerprint: the domain name contains `news`

They really screwed up there:

$ jq <hits.json '.[].host' | wc
    361     361    7777
$ jq <hits.json '.[].host' | grep news | wc
    129     129    2809

More than 1/3 of my hits found contain the word "news" in the title!!! E.g.:

global-view-news.com
firstnewssource.com
theworldnewsfeeds.com
pars-technews.com
newdaynewsonline.com
sportsnewsfinder.com
newsworldsite.com
todaysnewsreports.net
hassannews.net
weblognewsinfo.com
newsincirculation.com

Chinese expired domain trackers: another valuable domain data dump

static.hupo.com/expdomain_myadmin/2012-03-06（国际域名）.txt

0000o.com
001cssf.com
001techan.com
0061hs-0351xc-g305h.net
006979.com
006h4g-054hs-6504ga.net

I scraped them and uploaded to GitHub repos, 2011 - 2022, 20-30 M entries / year

github.com/cirosantilli/expired-domain-names-by-day-2011

Figure 1. Source.

 Ancestors (6)

View article source

Discussion (0)

There are no discussions about this article yet.

Articles by others on the same topic (0)

There are currently no matching articles.

See all articles in the same topic Create my own version