CIA 2010 covert communication websites / Adobe Dreamwaver JS functions Created 2025-06-02 Updated 2026-10-23
View more
Many of the files appear to contain JavaScript functions in a format generated by Adobe Dreamweaver, making it almost certain that at least some of the websites were developed in that editor. This was first pointed out by Reddit user sq00q. Also note that the username spells "boobs" upside down in leet.
For example, starwarsweb.net contains the four following functions, first commented out which is funny and has some version comments:
function MM_swapImgRestore() { //v3.0
function MM_preloadImages() { //v3.0
function MM_findObj(n, d) { //v4.01
function MM_swapImage() { //v3.0
and then repeated on a body onload. Here MM_ stands for MacroMedia, and is mentioned e.g. at:
Doing:
git grep MM_swapImage | sed -r 's/\/.*//' | sort -u | wc
on CIA 2010 websites dump currently gives 64 hits out of 421 websites.
The same signatures are also found on the early websites from 2004 such as alljohnny.com.
Read the full article
CIA 2010 covert communication websites / HTML analysis Created 2025-05-07 Updated 2026-10-23
View more
The HTML from the index page of Wayback Machine were:
The best way to analyse the HTML is to grap our dumps from: CIA 2010 websites dump.
Some possibly interesting searches include:
  • list all HTML comments, maybe something spicy was left over:
    git grep '<!--'
  • search for weird file extensions:
    git ls-files | grep -Ev '\.(jpg|gif|html|txt|png|css|php|js|jar|cgi|htm|swf|ico|JPG|class|zip|sf)'
  • have a look at the largest folers:
    ncdu
Some of the HTML files contain conditional comments e.g. web.archive.org/web/20091023041107/http://aquaswimming.com/ contains:
<!--[if IE 6]> <link href="swimstyleie6.css" rel="stylesheet" type="text/css"> <![endif]-->
Varios of the non-English websites seem to have comments translating the content e.g.:
./noticiasmusica.net/20101230165001/index.html:<h2>Alguns dos Melhores Sites Nacionais</h2><!--some of the best national sites (in music)-->
This feels like it could be the translation helping the technical webdev team know what is what.
Many of the RSS frame pages use:
<base target="_blank" />
which is a weird HTML tag that would lead all links to open on new tabs, e.g. web.archive.org/web/20110202124411/http://thecricketfan.com/home.html.
Various websites have pages with .php extension. It feels likely that all websites were written in PHP.
Some URLs existed both in HTML and .php extension, or were converted at some point:
allworldstatistics.com/20110207151941/comprehensivesources.html
allworldstatistics.com/20130818155225/comprehensivesources.php
A few of the PHP urls have weird IDs in them like omktf, juqwt and qlaqft:
./middle-east-newstoday.com/20100829004127/omktf/uirl.php?ok=461128
./newsandsportscentral.com/20100327130237/juqwt/eubcek.php?pe=747155
./pondernews.net/20100826031745/lldwg/qlaqft.php?fc=281298
we wonder what they mean.
A few separate websites have an archive with the same pid parameter:
fightwithoutrules.com/20131220205811/?pid=2POQ7BC1G/index.html
half-court.net/20131223165013/?pid=2POQ7BC1G/index.html
health-men-today.com/20131223002237/?pid=2POQ7BC1G/index.html
intlnewsdaily.com/20131221121441/?pid=2POQ7BC1G/index.html
intoworldnews.com/20131217193621/?pid=2POQ7BC1G/index.html
It is unclear what it means. All of them contain something like:
<html>
<head>
<meta name="robots" content="noarchive" />
<meta name="googlebot" content="nosnippet" />
</head>
<body>
<div align=center>
<h3>Error. Page cannot be displayed. Please contact your service provider for more details.  (11)</h3>
</div>
</body>
</html>
so looks like an archival artifact only.
The following two websites have a feeds.php system for their RSS:
./mydailynewsreport.com/20110211111053/myrss/feeds.php?src=http:/www.refahemelli.com/pashto/news/rss.php&chan=y&desc=1&targ=y&utf=y
./magneticfieldnews.com/20110208063545/magneticfeeds/feeds.php?src=http:/www.bbc.co.uk/pashto/index.xml&chan=y&desc=1&targ=y&utf=y
Some of the HTML uses attributes without quotes, which is legal, but very unusual nowadays:
soldiersofsouthasia.com/20110207203705/home.htm: <a href=http://www.rss-to-javascript.com
We can try to search for any link leaks by listing all domains linked to with:
git grep --no-color -I -h --no-line -o 'https?://[^/">?]+[/">?]' | sed -r 's/.$//' | sort | uniq -c | sort -nk1
The first thing that shows up is that there are some IPs linked to directly! But they seem to be the direct IPs of legitimate websites, we are not sure why IPs were used rather than domain names:
We can also get the full line for each with sorted by least common domains with the slow:
git grep --no-color -I -h --no-line -o 'https?://[^/">?]+[/">?]' | sed -r 's/.$//' | sort | uniq -c | sort -nk1 | awk '{if ($1 < 10) print $2}' | xargs -I{} git --no-pager grep -h --no-line -o '{}.*<' | tee tmp.log
We can search for all IP-like strings with:
git grep '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\b'
Read the full article
CIA 2010 covert communication websites / JAR reverse engineering by Codex 2026-10-23
View more
This project was originally done before Ciro Santilli knew how to use Codex and before Codex was so incredibly strong. Codex 6 Astra High can now just disassemble, deobfuscate and datamine the fuck out of such binaries, so we asked it to. Unfortunately it couldn't really find anything mind blowing, but here are the results anyways.
The analysis scripts is: jar.py and it should be pointed to a dump directory of the websites such as CIA 2010 websites dump. The analysis below was done as of commit b9eb31618c36421133e4875bc1cd7d7ac7763a32.
These scripts produce TODO directories.
The JARs are obfuscated, and Codex believes that they have a strong match to the Zelix KlassMaster commercial obfuscator, and points to this analysis from 2006: www.exploit-db.com/docs/english/13132-cracking-string-encryption-in-java-obfuscated-bytecode.pdf. Zelix appears to have the exact same string obfucation mechanism quat1024 had already previously manually discovered. It stores all string literals XOR'ed with 5 consecutive key bytes along:
switch (character_index % 5):
    case 0: key = 47
    case 1: key = 41
    case 2: key = 84
    case 3: key = 35
    default: key = 14
It then injects an encoder/decoder for this which transforms the strings as neede at runtime. The bytes are present in each class file itself.
Zelix is made by an Australian company based in Narraweena and its website proudly sates:
Leading Java Obfuscator since 1997
Shame they failed to list the CIA in their users list! I'm goign to ping them actually.
Here are the best small finds:
  • some of the resource/resources.bin files contain the string:
    #Auto-generated Starbuck client config file
    Codex could not find any clear public reference to what Starbuck is, which leads to the tentalizing possibility that could be an internal project codename. Though the possibility that it is just some internal of some public tool so obscure that even the web has lost track of it is also too strong to refute entirely.
    This string is part of a more complete key/value pair, e.g. dryterrainnews.com contains:
    • key: Config.properties.old.1277148810409
    • value:
      #Auto-generated Starbuck client config file: Mon Jun 21 14:32:02 ACT 2010
#Mon Jun 21 14:32:02 ACT 2010
ServerURL=http\\://www.dryterrainnews.com/cgi-bin/nigeria.cgi
EncSharedSecret=7A948986EF08B9DDF800E5AF229EC118D4F8AD9609C5080CBF2AB92397C2A9B8
KeyE=1F7D7
KeyN=67D8EA7BF935232E55863DCED7A279F701B7492316FE96F15D00C983CBFDB93B97D35898FA8928FA13D4F320E2B62D1B92F08FA8692F7D043EC197E2857D2A540E01A2529AEB232EB386917992B80D5CADE283D2C4E8DCBF682704F419E29D013FFCF33D9A1BC94E4AA469058BB508EEE1D654CF9FC4B89977A13FA33CDEDAED
    which would be present insie the resource/resources.bin file present inside the JAR.
    resource/resources.bin file is encrypted with International Data Encryption Algorithm, a public symmetric encryption standard. However the key is itself present inside the JAR as an XOR obfuscated string.
    The decrypted form of resource/resources.bin is a custom key value format which Codex could not identify the source of for the life in it. The JAR contains a decoder for it in its code.
    There are different alternative filenames for this file all with the same format, each one with a single key used across all JARs, and each JAR having at most one of them:
    • Applet.properties: key: 7A5DAEC4029C91ED, occurances: 76. Exmaple: aryannews.net/20101229122727/headlines.jar path c/b/b/Applet.properties.
    • Client.properties: key: 60A514D96C19F93C, occurances: 33. Example: activegaminginfo.com/20110202130304/gaming.jar path a/b/f/Client.properties
    • resource/resources.bin: key: 0C5C45F2EC3C2A63, occurances: 45. Example: all-sport-headlines.com/20110207144821/birdie.jar path resource/resources.bin
    The remaining JARs use other arrangements:
    • applet.configs, XOR-obfuscated as a single string: 35. Example: aeronet-news.com/20110202122601/aeronet.jar path a/a/b/applet.configs. Deobfuscated content might look like:
      #Applet Properties
#Thu Aug 19 08:19:00 AMT 2010
RequestKey.UserData.1.IsQuery=set
Applet.BundleSize=1
ResponseKey.UserData.0.Size=85
    • bw.properties, ZIP-packed: 30. Example: casanewsnow.com/20110201184918/casanews.jar path b/a/bw.properties
    • none of these configuration resources: 9. Example: factorforcenews.com/20110202125321/factorspeed.jar
    These files contain a wide variety of resources, including server paths, images, user strings and various settings.
  • there's a certain number of timestamps present in the Jars. Although these could have been faked, it feels unlikey that they were. The sources of those include:
    • ZIP modification time of each file
      • present in: all JAR, since JARs are ZIPs
      • timezone: no
      • visible with: zipinfo -v travelxtreme.net/20101226193020/xtreme.jar
    • Certificate validity dates:
      • present in 37 JARs. Example: latinamericanewsbeat.com/20100513191045/today.jar file META-INF/INLINE.DSA
      • timezone: yes
      • format: Standard binary PKCS#7/X.509 encoding unencrypted, readable with OpenSSL
      • usage: these are part of a standard JAR public key signatures scheme, which if a key trusted would have given greater execution priviledges to the JAR. They are validly signed but self signed as you might expect...
    • applet.configs: comment timestamp as shown above
    • Starbuck client comment as shown above:
      #Auto-generated Starbuck client config file: Mon Jun 21 14:32:02 ACT 2010
    • config key backup Unix epoch milliseconds key, e.g. the 1277148810409 in Config.properties.old.1277148810409. So their editing tool kept backups as they were editing it, which is a small OPSEC defect.
Many of the timestamps present are much older than the earliest archive we have for each website, suggesting that they were around for much longer. E.g. 2005-06-02.
The operators worked exclusively on weekdays, and much less on Friday than other days of the week, lol they're only human:
   Day          Configuration timestamps    Distinct configuration calendar dates    ZIP timestamps¹
   Monday                             21                                       11                 72
   Tuesday                            12                                       10                 78
   Wednesday                          16                                       13                 72
   Thursday                           12                                       11                 72
   Friday                              5                                        5                 60
   Saturday                            0                                        0                  0
   Sunday                              0                                        0                  0
92% of timestamps fall in conventional work hours between 08:00 and 18:00, so it was not a James Bond work through the clock to save the world business.
The timezones are:
Timezone label    applet.configs    Backups in resources.bin    Total    Possible locations / interpretations
  EST                          9                           4       13    Eastern United States, eastern Canada, parts of the Caribbean
  EDT                          8                          11       19    Eastern United States, eastern Canada, parts of the Caribbean
  AMT                         18                           0       18    Western Brazil (Amazon Time), Armenia
  ACT                          0                          16       16    Acre in Brazil (Acre Time), Northern Territory in Australia if interpreted as Java’s short timezone ID
EST an EDT are obvious, Langley. ACT is understandable, Australia, a Five Eyes country and center of US espionage is East Asia. But AMT? That one is weird.
A few sites have timestamps from multiple locations e.g.:
Site                               Labels and counts
internationalnewsworthiness.com    EDT ×2, ACT ×2
intlnewsdaily.com                  EDT ×2, ACT ×1
www.myhealthlibrary.net            EDT ×1, ACT ×5
www.todaysnewsreports.net          EDT ×1, ACT ×3
Codex also spots the interesting case of myhealthlibrary on April 11, 2011 backup sequence, configuration comments go:
09:18:19 ACT
13:59:13 EDT
13:34:14 ACT
13:43:20 ACT
14:17:18 ACT
which in UTC would jump backwards in time if ACT actually means Australia...
09:18:19 ACT    April 10, 23:48:19
13:59:13 EDT    April 11, 17:59:13
13:34:14 ACT    April 11, 04:04:14
13:43:20 ACT    April 11, 04:13:20
14:17:18 ACT    April 11, 04:47:18
but would work neatly if ACT is actualy Acre Standard time at UTC-4. Damn, Brazilian operators???
14:18:19 UTC
17:59:13 UTC
18:34:14 UTC
18:43:20 UTC
19:17:18 UTC
Codex also comments:
One historical wrinkle: Acre’s official clocks used UTC−4 during 2008–2013, including April 2011. An older Java timezone database could still apply UTC−5, so the label alone doesn’t establish the offset actually used.
Too strong. Too strong.
About the backups Codex analyses:
  • 31 backups across 11 sites; eight sites have multiple backups.
  • Of 20 successive intervals, 11 are under an hour, 15 under a day.
  • Four intervals exceed a month; the longest is about 560 days.
This fits bursts of configuration work followed by occasional maintenance.
Read the full article
CIA 2010 covert communication websites / List of websites Updated 2026-10-23
View more
This section contains a list of all the websites that we consider belong to the network beyond reasonable doubt.
The list is also available in JSON format at: github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/hits.json. When there are new additions we keep the JSON up to date with the help of the following OurBigBook Markup to JSON conversion helper ../cia-2010-covert-communication-websites/bigb-to-json:
cia-2010-covert-communication-websites/bigb-to-json cia-2010-covert-communication-websites.bigb
and new results that have been added to the list below can automatically be merged with ../cia-2010-covert-communication-websites/bigb-to-json-merge:
cia-2010-covert-communication-websites/bigb-to-json-merge > tmp.json
mv tmp.json ../media/cia-2010-covert-communication-websites/hits.json
We have also made a dump of the websites extracted from the Wayback Machine at: CIA 2010 websites dump:
The main criteria to consider a website as a hit is for it to have a Wayback Machine archive with an archived communication mechanism. JS comms are always quickly visually inspected, other mechanisms we look only at filename patterns for now. We also consider as hits websites that don't have archived comms, often the case for CGI comms, but which have two ore more of the following supporting evidence:
Commented edge cases that didn't make the cut can be found mostly under Section "IP range search" and Section "2013 DNS Census virtual host cleanup heuristic keyword searches".
ipdomainWayback Machinelanguagecountry mentionscommsthemenotes
?24hoursprimenews.com2009EnglishJARnewssplit images[ref][ref]
?cyhiraeth-intlnews.com2011EnglishJARnewsen.wikipedia.org/wiki/Cyhyraeth "The cyhyraeth is a ghostly spirit in Welsh mythology, a disembodied moaning voice that sounds before a person's death." WTF! So the serious looking black actress lady is meant to represent the voice of death?. Split images[ref][ref]. rss-items. Here she is on Getty Images: www.istockphoto.com/photo/natural-style-for-the-individual-gm171403107-26684547 by Urilux
?dailynewsandsports.com2013EnglishJARsports
?differentviewtoday.com2011EnglishJARnewssplit images, JAR unarchived
?euronewsonline.net2010EnglishJARnewsa.newslink. The image of the woman reading newspapers reverse searches to www.istockphoto.com/photo/news-gm101581053-7410445, iStock from Getty images. Copyright 2007.
?europeannewsflash.com2011EnglishJARnewsSplit images[ref][ref]
?farsi-newsandweather.com2011FarsiIranJARnewssplit images[ref][ref]
?financecentraltoday.com2011EnglishJARnews, financeunusual td > p > strong article list. Copyright 2008.
?firstnewssource.com2011FarsiIranJARnewsCopyright 2009. Split images. rss-items.
?global-view-news.com2011EnglishJARnewssplit images[ref][ref]
?globaltourist.net2010EnglishJARtravelsplit images[ref][ref], rss-items. speed.jar "speed test" JAR pattern. The split headers have a weird style however <li><a id="banner1">&nbsp;</a></li> and then filled with a CSS background image. This is a weird one, there is some chance that it is a legit website in the CIA style. Notably, at least as of August 2012 it had become a wordpress site marked "Just another Media Network Online Sites site", which is a bit early. Likely they just watch for good domain drops and take over quickly. The last in-style archive is from March 2012, which is first followed by a Godaddy parked domain on April 2012. This domain also has a 2003 archive which is almost certainly from the same authors as it also has a link to globaltourist.net/speed.jar and the upper left image is the same. Its history does however remember us of alljohnny.com, which had its 2004 version and then a 2010 rehash. Both of these versions contain ImageReady Slices mentions in them, characteristic of the split header images fingerprint.
?hassannews.net2010ArabicSWFnewsCSS or archive quite broken. Split images[ref][ref]. rss-items. cqcounter.com/whois/www/hassannews.net.html not found. The arabic title is "حسن الأخبار" (good news) and the domain seems to be a transliteration of it.
?health-men-today.com2011ArabicJARnewsrss-items. Encoding broken. cqcounter.com/whois/www/health-men-today.com.html also broken. Same registrar as medicatechinfo.com: Jason Noll IP and DNS metadata. Closely related stock model image comically used as the image of the Gay Arab Central community on the. Copyright 2008.
?inkfreenews.com2011EnglishJARnewssplit images, JAR unarchived
?internationalnewsworthiness.com2011EnglishJARnewsRSS, split images, JAR unarchived
?intlnewsdaily.com2011EnglishJARnewsrss-items
?intoworldnews.com2011EnglishJARnewssplit images. Links to news websites from frontpage, not news themselves.
?iranfootballsource.com2011FarsiJSsports, football
?iraniangoalkicks.com2008FarsiIranJARsports, football
?iraniangoals.com2009FarsiIranJSsports, football
?latinamericanewsbeat.com2010EnglishJARnewssplit images. Also has an archived "register" link at the bottom: web.archive.org/web/20101114045007/http://latinamericanewsbeat.com/register.html but it reads "We are currently unable to register new members while we upgrade our site. Please check back soon."
?magneticfieldnews.com2010EnglishJARnewsrss, split images
?middle-east-newstoday.com2010FarsiJSnewsrss, split images
?mideasttoday.net2010FarsiJARnewsa.rss-item, split images, copyright 2008
?mydailynewsreport.com2011PashtoAfghanistanJARnewsrss, split images
?mynepalnews.com2011EnglishJARnewsSplit images with <li><a id="banner1">&nbsp;</a></li> style. Nice swimsuit ad. The bottom bar "Copyright © 2008 My Nepal News, LLC. All Rights Reserved." is also kind of typical, see e.g. web.archive.org/web/20110208042144/http://helpinghandssite.com/, both have <!-- begin #footer --> and <div id="footer">. ingenuitytrendz.com is another closely related template. One ridiculously mind blowing thing about this website is the presence of Webalizer reports under /stats e.g.: /stats. This fact is so mind blowing that it makes us question if this an actual hit or just style coincidence. Particularly ridiculous is the presence of inurl:cgi server_software at web.archive.org/web/20110204095809/http://mynepalnews.com:80/stats/usage_200805.html which is almost certainly a Google dork search, which we know is something that the Iranians used to find the websites. Also of interest are link backs from at web.archive.org/web/20110204095815/http://mynepalnews.com:80/stats/usage_200806.html from whois.domaintools.com/mynepalnews.com and www.whois.sc/mynepalnews.com That search hits under /cgi-bin/check.cgi. That page is itself os some interest containing SERVER_ADMIN = mmadev@mmadev.com. web.archive.org/web/20110204095815/http://mynepalnews.com:80/stats/usage_200806.html also reveals several request IPs. Even if this is not a CIA website, there's a chance we could find the IP of the Iranian counter-intelligence in these IP list, it's mind blowing. And if a hit, we could also find IPs used by CIA handlers to see if the website is working. Lot's of referrer spam too as well.
?newdaynewsonline.com2011EnglishJARnews
?networkconnectionsite.com2011EnglishJSnewsrss, split images
?news-latina.com2011EnglishJARnewscopyright 2007
?newsdelivered.net2010EnglishJARnewsrss, split images, JAR unarchived
?newsincirculation.com2011ArabicJARnews
?newsworldsite.com2011PashtoAfghanistanJARnews
?opensourcenewstoday.com2010ArabicJARnewscopyright 2010
?outlooknewscast.com2011FarsiIranJARnews
?pars-technews.com2011FarsiIranJARnews"pars" presumably means "Parsi" or something of the same root
?pondernews.net2011ArabicJARnewsrss. Some archived pages use unusual paths such as /lldwg/qlaqft.php?fc=282910.
?profile-news.com2011EnglishJARnewsa.newslink
?purlicue-news.com2011EnglishJARnewssplit images, rss
?segomonews.com2011EnglishJARnewsrss, split images. TODO meaning of "segomo"? The main Wikipedia hit is a Gallo-Roman God, but the website is focused on Asia?
?shadesofnews.com2011ArabicJARnewsa.rss-item, split images. Also has a second from 2013 JAR at: web.archive.org/web/20131229092754/http://shadesofnews.com/sptgms213.jar and a raw .class crime.Business.class which replies with "The requested document was not found on this server". Copyright 2009.
?sportsnewsfinder.com2011ChineseChinaJARnews体育新闻发现者 (sports news finder)
?techwatchtoday.com2011EnglishJARtech, newsMarked copyright 2008. Split images[ref][ref]. Later legit.
?terrain-news.com2011PashtoAfghanistanJARnews
?todayoutdoors.com2011EnglishJARsports, travelsplit images[ref][ref]
?todaysnewsreports.net2010ArabicJARnews
?weblognewsinfo.com2011EnglishJARnewsSplit images, rss-items.
?wiredworldnews.com2011EnglishJARtechsplit images, copyright 2008
62.22.60.40travel-passage.com2011English, ChinesetravelNo Wayback Machine archives of toplevel, only of the 航空 Flight Reservations subpage: web.archive.org/web/20091118013330/http://travel-passage.com:80/service-flights.htm. The link to it can be seen from the cqcounter screenshot. The page contain an unusual mixture of Chinese and English. The Chinese title is 游行连接 (lit. travel connection)
62.22.60.42newsupdatesite.com2011EnglishJARnewssplit images, rss-item. JAR unarchived.
62.22.60.46flyingtimeline.com2011EnglishJARairplanes
62.22.60.48currentcommunique.com2011EnglishEgyptSWFnews
62.22.60.49telecom-headlines.com2011EnglishJStech
62.22.60.52collectedmedias.com2011FrenchJSnewsMarked copyright 2008
62.22.60.54romulusactualites.com2011FrenchFrancenews
62.22.60.55thefilmcentre.com2011EnglishJSfilms
62.22.60.56traveltimenews.com2011EnglishJSnews
62.22.61.193awfaoi.org2010ArabicIraqJARnot-for-profitThis was the first clear .org hit with comms we've been able to find. Title translation: "Arab women to help Iraq", so perhaps "awfaoi" stands for "Arab Women For A O? Iraq". This fits well into the .org theme. Marked copyright 2008.
62.22.61.197rc5sports.com2011EnglishJARsports
62.22.61.198inside-vc.com2011EnglishCGIfinance"vc" is a standard abbreviation for venture capital. Previously legit circa 2004: web.archive.org/web/20030306171752/http://www.inside-vc.com/
62.22.61.200zerosandonesnews.com2011EnglishSWFnewsrss, split images
62.22.61.202bailsnboots.com2011EnglishSWFsports, cricket"Bail" is one part of the thing your're supposed to hit with th eball in cricket.[ref]
62.22.61.203the-cricketer-online.com2011EnglishJARsports, cricketmarked copyright 2009.
62.22.61.204hollywoodscreen.net2011EnglishJSfilms
62.22.61.206worldnewsnetworking.com2011ArabicJARnews
62.22.61.212nuestrasfinanzas.com2011SpanishJARfinance
62.22.61.213sandstormnews.com2011ArabicSWFnewsrss, split images
62.22.61.215the-tech-mind.com2011Englishtechnology, newsWelcome to the US Petabox on Wayback Machine.
62.22.61.217court-masters.com2011EnglishJARsports, tennis
62.22.61.219allworldstatistics.com2011EnglishJSstatistics
62.22.61.220newsjaka.com2011EnglishIndonesiaJSnews"jaka" presumably means Jakarta, the capital of Indonesia. There is a Indonesia section on the left sidebar. But the news are quite global however. Photo source: www.shutterstock.com/image-photo/little-boat-on-bratan-lake-front-5860873 depicts "Bratan lake in front of the Pura Ulu Danau temple" by Ine Beerten. Pinged her at: portfolio.inebeerten.be/#Contact
63.131.229.2fightskillsresource.com2011EnglishJSsports, martial artsGetty Images for the karate dude: www.istockphoto.com/photo/take-off-gm98702037-1196239
63.131.229.4unitedterritorynews.com2011EnglishJSnews
63.131.229.9show-dustry.com2011EnglishCGIentertainmentThe website name is a neologism with "show" and "industry".
63.131.229.11mythriftytrip.com2010EnglishCGItravelthrifty means: "using money and other resources carefully and not wastefully"
63.131.229.12cyberreportagenews.com2011EnglishJARnewsrdns source
63.131.229.13sunrise-news.com2011EnglishJARnewsrdns source
63.131.229.15cricketnewsforindia.com2013EnglishIndiaJSsports, cricketarchive quite broken, lots of missing files, including the JS. cqcounter.com/whois/www/cricketnewsforindia.com.html in style.
63.131.229.16nutricion-saludable.net2010SpanishCGIhealthAlso under nutricion-saludable.info. There is weirdly a single page archived from 2008: epages/nutricion-saludable_net.sf with this weird .sf extension. It is HTML however. It says: "Lo sentimos, la tienda está actualmente cerrada por razones técnicas. Pronto estaremos a tu disposición. Si lo deseas puedes ponerte en contacto con nosotros en el tel: 651 80 76 19". This appears to be a spanish phone number: without country code, which would be +34[ref].
63.131.229.20fixashion.net2011EnglishJSfashion
63.130.160.50theglobalheadlines.com2010EnglishJARnewsthis has several archives from 2013, marked as Live Web Proxy Crawls and explained "mostly by the Save Page Now", so presumably by counter intelligence or amateurs
63.130.160.51hai-pow.com2011EnglishJARsports, martial arts
63.130.160.53echessnews.com2011ChineseChinaJARsports, boxingChinese title: 我的象棋世界 (My Chinese Chess world). rdns source. Split images[ref][ref]
63.130.160.60boxingstop.net2010PolishPolandJARsports, boxing
63.130.160.61bookmarksthis.com2010EnglishJARbooksA book review website. Shows a stock model reading a book and their signature black print over decorations on top
63.130.160.62azerinews.org2009AzerbaijaniAzerbaijanJARnewsrdns source. Split images, rss-items. "Azeri" is a word that denotes the people from the region of Azerbaijan.
64.16.204.53bosniakbusinessnews.com2011EnglishBosniabusinessA Bosniak is someone from an ethnicity from Bosnia
64.16.204.54affairesdumonde.com2011Frenchnews
64.16.204.55holein1news.com2010EnglishJARsports, golf
64.16.204.58tech-topix.com2013EnglishCGItechArchive quite broken, but link to CGI comms. Copyright 2010. cqcounter.com/whois/www/tech-topix.com.html not found.
65.61.127.161european-footballer.com2011CroatianSports, footballBroken Wayback Machine archive: web.archive.org/web/20110319111233/http://european-footballer.com/. The title was "Europski Nogometaš" (European football player). The CQ Counter screenshot clarifies that the surviving Wayback Machine archive contains only a sidebar. It is unlikely to contain comms therefore.
65.61.127.163capture-nature.com2011EnglishJARphotographyReuters example. Since became legitimate, Ciro contacted the owner, and he was unaware of the domain's history.
65.61.127.166globalnewsbulletin.com2013EnglishTunisia, Afghanistan, Iran, EgyptCGInewsPHP pages, images /images/index_01.jpg
65.61.127.167internationalwhiskylounge.com2011EnglishCGInewsNo Wayback Machine archives. There's a "Log-in" tab so CGI comms likely. Stock image used of young woman with a glass of Whisky: www.istockphoto.com/photo/the-girl-with-glass-of-whisky-gm94997193-11328059 by alarich
65.61.127.168the-golden-rule.info2011Englishfinance, newsWebsite error archived at: web.archive.org/web/20131011012026/http://the-golden-rule.info/
65.61.127.169crossovernews.net2011EnglishJARsports, basketball
65.61.127.170newsidori.com2011EnglishnewsVery broken 2013 archive: web.archive.org/web/20130714134510/http://www.newsidori.com/. "Idori" sounds Japanese, but the meaning is unclear even after the cqcounter screenshot! It's just random US news, nothing to do with Japan.
65.61.127.171nrgconsultingandnews.com2011EnglishnewsIt is in English but contains several mentions of Brazil. Entitled: "Energy Consulting News Forum"
65.61.127.171premierstriker.com2011Englishsports, footballNo Wayback Machine archives from the time, and has been since parked by something apparently as of 2022 onwards. Entiled "Premier striker"
65.61.127.174dedrickonline.com2010GermanJSsports
65.61.127.175altworldnews.com2013EnglishCGInewsEpoch times link, PHP pages
65.61.127.176american-historyonline.com2011EnglishhistoryNo Wayback Machine archives
65.61.127.177material-science.org2009Englishscience, material scienceNo comms found, and slightly innovative design. Comms could be CGI under web.archive.org/web/20091213032538/http://material-science.org/services.htm or web.archive.org/web/20091213032538/http://material-science.org/equipment.htm. But marking it as hit because .rss-item + IP range.
65.61.127.178tee-shot.net2011EnglishSWFsports, golfnice domain name
65.61.127.180screencentral.info2011EnglishAfghanistancinemaRather innovative design, but hit likely. Welcome to US Petabox: web.archive.org/web/20130713224951/http://screencentral.info/.
65.61.127.181worldnewsandtravel.com2011EnglishnewsNo Wayback Machine archives
65.61.127.182pangawana.com2011ArabicAfghanistanJSnews
65.61.127.183cutabovenews.com2011EnglishAlgeria, various othersJSsports, basketballThe globe on Shutterstock: www.shutterstock.com/image-illustration/creative-drawing-charts-graphs-business-success-211092952 by rzoze19. Pinged him at: x.com/cirosantilli/status/1899748328549609700
65.61.127.184worldwildlifeadventure.com2011EnglishJARtravel
65.61.127.186explorealtmeds.com2013EnglishJARhealththe JAR was not archived, but there's a link to it
65.218.91.9rolling-in-rapids.com2010Englishsports, kayakFound by searching for "Glaze, L.", registrar of alljohnny.com, on tools.whoisxmlapi.com/reverse-whois-search
65.218.91.9welcometonyc.net2010EnglishCGItravel
65.218.91.17alljohnny.com2004EnglishCGIfansitemega early hit from 2004 to 2005. Then a gap, then they redid the domain: 2011. Same authors given content similarities e.g. "Submit Your Favorite Carson Moment". Reusing the domain after all these years, the lack of OPSEC is just mind blowing! New website marked Copyright 2003. Part of Oleg Shakirov's findings. One of the Reuters websites. Search documented at: Searching for Carson. Carson is also featured, although less proeminently, at webofcheer.com. There must have been some massive Johnny Carson fan among the contractors a that time!
66.45.179.192thegraceofislam.com2011EnglishCGIreligion, Islam
66.45.179.193arabicnewsunfiltered.com2011ArabicJARnewsrdns source
66.45.179.194raulsonsglobalnews.com2011EnglishJARnews
66.45.179.195aryannews.net2010PashtoAfghanistanJARnewsrdns source. Heil.
66.45.179.199attivitaestremi.com2011ItalianCGIsports
66.45.179.200foodwineandsuch.com2011EnglishfoodNo Wayback Machine archives. Entitled "Food, wine & such".
66.45.179.201hitthepavementnow.com2011EnglishCGIsports, running
66.45.179.202newimages.org2011TurkishTurkeyJARphotographyJAR unarchived
66.45.179.203noticiascontinental.com2011SpanishSouth AmericaCGInews
66.45.179.205noticiasporjanua.com2011SpanishJARnews
66.45.179.206podisticamondiale.com2010ItalianItalyJARsports, runningmarked copyright 2010
66.45.179.207reflectordenoticias.com2011SpanishJARnews
66.45.179.208havenofgamerz.com2011EnglishCGIgamingmarked copyright 2009
66.45.179.209vejaaeuropa.com2011Brazilian PortugueseBraziltravelweb.archive.org/web/20130810131440/http://www.vejaaeuropa.com/: Welcome to the US Petabox. cqcounter.com/whois/www/vejaaeuropa.com.html confirms Brazilian Portuguese. Entitled "Veja a Europa" (Visit Europe, lit. See Europe)
66.45.179.210sa-michigan.com2011EnglishJARsports"sa" is an abbreviation for the site title "Sports Alive"
66.45.179.211absolutebearing.net2010EnglishCGItravel, sports, boats
66.45.179.213myportaltonews.com2011EnglishJSnews
66.45.179.214investmentintellect.com2011EnglishJARfinance
66.45.179.215nigeriastar.net2011EnglishNigeriaJARnewsContains link to unarchived JAR
66.104.169.163doctorsoncallsite.com2011EnglishJARhealth
66.104.169.164lightandshadowonline.com2010EnglishJARphotography
66.104.169.168plugged-into-news.net2010EnglishJARnewsJAR uses .zip extension! First instance, wow
66.104.169.169worldsportsite.com2011ArabicsportsComms not found. rss-items, split images. Has some apparently unrelated archives from 2008: web.archive.org/web/20080617213238/http://www.worldsportsite.com:80/
66.104.169.171golf-on-holiday.com2011EnglishJARsports, golf
66.104.169.172perspectiva-noticias.com2011SpanishJSnews
66.104.169.175aquaswimming.com2009EnglishJARsports, swimming
66.104.169.177dojo-temple.com2011EnglishCGIsports, martial artsTODO meaning of "kama"? Kama lol?
66.104.169.179neighbour-news.com2010EnglishGermanyJARnewsMentions of Goethe-Institut and Germany all over. JAR unarchived
66.104.169.180medicatechinfo.com2010EnglishJShealth
66.104.169.181brickmanfinancialnews.com2011EnglishJSfinance
66.104.169.182casanewsnow.com2011EnglishJARJAR unarchived. TODO why "casa"? Doesn't seem to have any link to Spanish or Portuguese.
66.104.169.184bcenews.com2011AlbanianAlbaniaJARnewsUsed to be a legit Korean website circa 2004: web.archive.org/web/20030401214602/http://www.bcenews.com/
66.104.173.163runakonews.com2011EnglishAfricaCGInews"Runako" is an African given name.
66.104.173.164shoppingadventure.net2010EnglishJARtravel, shoppingJAR unarchived
66.104.173.165entertaining-ly.com2011EnglishJARentertainment
66.104.173.166zubeenews.com2011EnglishJSnews"Zubee" is a Muslim name: muslimnames.com/zubee.
66.104.173.169smart-financeology.com2011EnglishJARfinance
66.104.173.173worldfeedstoday.com2011EnglishnewsNo main page Wayback Machine archives. Subpage archive: 2011 has a.newslink. Slightly innovative style with multi-language tabs. There is some potential for error, but let's consider it. world-newsfeeds.com also known on same IP but with no known archives.
66.104.173.175media-coverage-now.com2010EnglishSWFnews
66.104.173.176jbc-online-news.com2011EnglishJSnewsTODO meaning of "JCB". JS unarchived.
66.104.173.177webscooper.com2011EnglishJARnews
66.104.173.178dk-dcinvestment.com2010EnglishJARfinanceTODO meaning of "dk;dc".
66.104.173.179newsforthetech.com2011Englishnews, techWelcome to the US Petabox.
66.104.173.180stara-turistick.com2011CroatianJARtourism
66.104.173.181playbackpolitics.com2011EnglishJSnews
66.104.173.182snapnewsfront.net2011EnglishJapanJSnews
66.104.173.183ingenuitytrendz.com2011EnglishJARtech
66.104.173.184armashoy.com2011SpanishSpainSWFgunsmeaning: "Weapons Today". In First World countries the CIA felt it would be safe to touch edgier subjects like guns
66.104.173.185baocontact.comEnglishJARHTML archive almost empty, but JAR was archived. One wonders what "bao" refers to, could be Chinese, but the small snippet of visible website is in English.
66.104.173.186myworldlymusic.com2011EnglishPakistanJARmusicJAR unarchived
66.104.173.189hitpoint-gaming.com2011EnglishJSgamingMarked copyright 2010
66.104.175.34itwebtoday.com2011EnglishJStech
66.104.175.35drglobalnews.com2011EnglishJARnewsTODO meaning of "dr"? rdns source.
66.104.175.36adilnews.net2010ArabicSWFnewsAdil is an Arabic masculine name
66.104.175.40beyondnetworknews.com2011EnglishEgyptCGInews
66.104.175.41grubbersworldrugbynews.com2011EnglishJSsports, rugby
66.104.175.42news-and-sports.com2011EnglishJARnewsrss, split images
66.104.175.44yourtripfinder.net2010Englishtravelcomms not found, CGI from unarchived subpage assumed
66.104.175.45rollinsnetwork.com2011EnglishCGItechArchive quite broken. CGI linked to but not archived. Seems to have been legit circa 2006. cqcounter.com/whois/www/rollinsnetwork.com.html empty from 2025.
66.104.175.46infosharenews.com2011EnglishJARnews
66.104.175.47southasiaheadlines.com2011EnglishBangladesh, Bhutan, India, Maldives, Nepal, Pakistan, Sri Lanka TibetJARtravelJAR linked to but missing from archive
66.104.175.48worlddispatch.net2010ArabicSWFnews
66.104.175.49webworldsports.com2011ArabicJARsports
66.104.175.50fly-bybirdies.com2011EnglishJARtravel
66.104.175.51businessexchangetoday.com2011EnglishCGInews, financePHP pages
66.104.175.52mensajeradenoticias.com2011SpanishCGInewsCGI unarchived
66.104.175.53info-ology.net2010EnglishJARnews
66.104.175.54marketflows.net2011EnglishJARfinance
66.104.175.57metanewsdaily.com2010EnglishCGInews
66.175.106.134paddlescoop.com2011EnglishBangladesh, Pakistan, India, EnglandJARsports, cricket
66.175.106.137kessingerssportsnews.com2010EnglishJSsports
66.175.106.138factorforcenews.com2009EnglishJARnews
66.175.106.142kanata-news.com2010EnglishCanadaJSnews"Kanata" is a place in Ottawa, Canada. The name is likely of Indigenous origin.
66.175.106.143thecricketfan.com2011EnglishJARnews
66.175.106.146inews-today.com2011EnglishEgyptJARnewsMarked copyright 2008
66.175.106.147starwarsweb.net2010EnglishSWFfansitewell, not even the CIA can escape Star Wars. TODO identify boy.
66.175.106.148activegaminginfo.com2011ChineseJARgamingthe website is entitled "活跃游戏" which means "Lively games", or "active games" as in the domain name itself. The center character seems to be from one of the infinitely many Romance of the Three Kingdoms games that must exist: www.gamersky.com/news/200711/82611.shtml
66.175.106.149feedsdemexicoyelmundo.com2011SpanishMexicoJSnews
66.175.106.150noticiasmusica.net2010Brazilian PortugueseBrazilJARmusic
66.175.106.155atomworldnews.com2011EnglishEgyptJARnews
66.175.106.158nouvellesetdesrapports.com2011FrenchEgypt, TunisiaJARnews
66.237.236.227newsandmusicminute.com2011PashtoJSmusic
66.237.236.229pearls-playlist.com2011EnglishSWFmusic
66.237.236.230beyondthefringe.info2012EnglishJARrugsJAR unarchived
66.237.236.231primetimemovies.net2009EnglishJSfilmsJS unarchived
66.237.236.235persephneintl.com2013JARarchive very broken, JAR unarchived. Full title: "Persephne International", reference to Greek Goddess of "spring, the dead, the underworld, grain, and nature". cqcounter.com/whois/www/persephneintl.com.html shows us how it would have looked like.
66.237.236.236directoalgrano.net2010SpanishJARnews
66.237.236.240actualizaciondebeisbol.com2011SpanishJSsports, baseball
66.237.236.243mygadgettech.com2009ChineseCGItechArchive very broken. cqcounter.com/whois/www/mygadgettech.com.html shows it better. The Chinese title was "我的灵巧技术".
66.237.236.247comunidaddenoticias.com2011SpanishEcuadorJARnews
66.237.236.249sumerjaseahora.com2011SpanishCGIsports, SCUBA divingsubmerge yourself now
69.84.156.69al-ashak-news-me.com2011ArabicJSnews
69.84.156.70theventurenews.info2011Englishnews
69.84.156.71worldfinancetoday.net2011EnglishJARfinance
69.84.156.72autonewsarabia.com2011ArabicJARcars
69.84.156.74blue-moon-news.com2011ArabicJSnews
69.84.156.76tnc-urdu.com2011UrduJARtechTODO meaning of "tnc"?
69.84.156.80noticiasdenuestromundo.com2011SpanishnewsSouth America focus
69.84.156.82arabicnewsonline.com2011ArabicJARnewsrdns source. Some very similar domains: modernarabicnews.com, arabicnewsource.com. Needed more creativity here! Later legit.
69.84.156.83unganadormundial.com2010SpanishCGIsports, fitness
69.84.156.84focusonbokeh.com2011EnglishphotographyNo Wayback Machine archives or broken. The design is a bit innovative, but fuck it I'll mark it as a hit. Only a "Sony" logo remains: web.archive.org/web/20110207222330/http://focusonbokeh.com/images/logo_014.jpg A photography website "Focus on Bokeh" as suggested by the domain name. reimaginepeacefulparenting.com/make-kids-happy/ contains the cute stock Asian girl. "Login" link visible suggesting CGI comms.
69.84.156.85classic-rocktopia.com2011Englishmusic, rockStock image e.g. at: www.dissection.nu/frames.htm
69.84.156.87i7diver.com2011Englishdiving
69.84.156.88diariodeelmundo.com2011SpanishJARnews
69.84.156.89todaysarabnews.com2011ArabicJARnewsJAR unarchived.
69.84.156.90stickshiftnews.com2011EnglishJARcars
69.84.156.91theinternationalgoal.com2011SpanishCGInews
72.34.53.174electronictechreviews.com2011EnglishJARtechJAR unarchived. Split images, rss-items. Present at "Mass Deface III" pastebin.
72.34.53.174just-the-news.com2011ArabicJARnewscopyright 2009. Present at "Mass Deface III" pastebin. JAR unarchived.
72.34.53.174kickitnews.com2010ArabicJARsports, footballcopyright 2009. Present at "Mass Deface III" pastebin.
72.34.53.174moyistochnikonlaynovykhigr.com2011RussianRussiafansitecopy of myonlinegamesource.com, but on a Russian transliterated domain rather than the English one, very interesting
72.34.53.174myhealthlibrary.net2011EnglishJARhealthpresent at: "Mass Deface III" pastebin.
72.34.53.174myonlinegamesource.com2011RussianRussiagamingCan't find comms, but stylistically perfect. rss-items. Present at "Mass Deface III" pastebin.
72.34.53.174mytravelopian.com2011EnglishJARtravel
72.34.53.174recursosdenoticias.com2011SpanishJARnewsSplit images, rss-items. Present at "Mass Deface III" pastebin.
72.34.53.174sayaara-auto.com2010ArabicJARcars
72.34.53.174technologytodayandtomorrow.com2011EnglishJARtechrss-items. Present at "Mass Deface III" pastebin.
72.34.53.174todaysnewsandweather-ru.com2011RussianRussiaJSnewsJavaScript with SHAs
74.116.72.227dayenews.com2011EnglishJARnewsrdns source. Previously 69.74.45.67.
74.116.72.229guide-daventure.com2011FrenchFranceJARtravel
74.116.72.231bleachersfootballnews.com2011EnglishJARsports, footballTODO meaning of "Bleacher"? Possible reference to Bleacher Report.
74.116.72.232indirectfreekick.com2011EnglishJARsports, football
74.116.72.233wwiichronicles.net2011EnglishCGIhistory
74.116.72.234petroleumagenews.com2011EnglishJARoil
74.116.72.235the-open-book-online.com2011EnglishJSliterature
74.116.72.236techtopnews.com2011EnglishJARtech
74.116.72.238pohandakhbar.com2011ArabicnewsArabic titlel: "خبرونه پوهاند" translates as "News Professor", and the domain name seems to be a transliteration of that.
74.116.72.239crickettoday.info2013PashtoJSsports, cricketJS unarchived. The requested URL /cricket.js was not found on this server
74.116.72.240zafernews.com2011ArabicJARnews
74.116.72.241itechnewstoday.com2011Englishnews"IT Tech News Today". Broken/GoDaddy takeover.
74.116.72.242gdgtsource.com2011EnglishCGItechPresumably "gdgt" stands for "GaDGeT", which is mentioned on subtitle
74.116.72.243waronfilmonline.com2011Englishcinema
74.116.72.244arborstribune.org2011newsTODO what is "Arbors"?
74.116.72.246vuvuzelanews.com2011EnglishJARsports, footballVuvuzela is this plastic horn, popular in football stadiums. The term is of African origin. Later legit. rdns source. Previously at 69.74.45.86.
74.116.72.247ballbatstumpsandbails.com2011EnglishJARsports, cricket
74.116.72.248kioni-sailing.com2011sports, sailing
74.116.72.249round-trip-travel.com2010EnglishCGItravelthis got archived a lot of times, though all seem to be Alexa crawls.
74.116.72.250arabicnewsource.com2011ArabicCGInews
74.254.12.163half-court.net2010EnglishPhilippinesJARsports, basketball
74.254.12.164dailywellnessnews.com2011EnglishJARhealthrdns source. split images[ref][ref].
74.254.12.165dylandon.net2011ChineseSWFmusic"Dylan" presumably a reference to Bob Dylan? "Don" unclear. Maybe Don McLean? But it is all a bit weird given that the actual contents of the website don't seem to have anything to do with music, it appears to just be a news aggregator.
74.254.12.166afghanpoetry.net2010EnglishAfghanistanSWFpoetryAlso at 63.131.229.10[ref] in a range.
74.254.12.168non-stop-news.net2010FarsiJARnews
74.254.12.169soldiersofsouthasia.com2011EnglishJARhistory
74.254.12.170greek-news.info2011EnglishGreecenewsWelcome to the US Petabox.
74.254.12.171autism-news.org2011EnglishSWFhealthcopyright 2007. Split images. rss-items. Previously at 69.74.45.67. After these revelations, security researcher Ellie registered the domain and she found that there was a link on Wikipedia to the website from back in 2011 when it was still live.
74.254.12.173thefreshnews.com2009EnglishSWFnewsrss, split images
74.254.12.176pakcricketgrd.com2011UrduJARsports, cricketTODO meaning of "grd"
74.254.12.177networkofnews.com2011EnglishJARnewsrdns source. Later legit.
74.254.12.179wineconnaisseur.net2010EnglishJSwine
74.254.12.187efiinvestment.com2011Englishfinance, newsTODO meaning of EFI
74.254.12.180helpinghandssite.com2011EnglishJARnews
74.254.12.188first-tee-golf.com2011EnglishJARsports, golf
74.254.12.189fabu-foto.com2011EnglishCGIphotography
74.254.12.190viptravelabroad.com2011EnglishJStravel
174.133.70.18dryterrainnews.com2011EnglishAfricaJARnewsrss
174.133.70.18thefootball-life.com2011EnglishJSsports, footballrss, split images
174.133.70.18thenewsofpakistan.com2009EnglishPakistanJARnewsa.rss-item, split images
174.133.70.18totallynewsnow.com2011EnglishJSnewsrss
199.19.110.7classymotors.net2011EnglishJScarsrss-items
199.19.110.7russiansportsworld.com2010EnglishJSsportsSplit headers. Unarchived middle frame, visible at: dawhois.com/www/russiansportsworld.com.html. Russian title: "Русский мир спорта" (Russian world of sport)
199.19.110.7theworldnewsfeeds.com2011EnglishJARnewsrss-items. Split images[ref][ref]
199.19.110.7urbestbod.com2011ChineseCGIsports, fitnessNo Wayback Machine archives. Broken Chinese site as usual for their archives. The headline: "你最好的身体.最好的健康和健身信息" translates as "Your Best Body The best health and fitness information", so we understand that the domain name is a super broken "your best body". Visible is a link to "论坛" (forum), so likely CGI
199.85.212.105mide-news.com2010EnglishCGInews"MIDE" stands for "Middle East". Comms not archived, presumably CGI comms variant.
199.85.212.111newsandsportscentral.com2009EnglishJARnewsrdns source
199.85.212.118just-kidding-news.com2011EnglishJARnewsepic name
199.187.208.12webofcheer.com2011EnglishJARfansite, comedyhas a an unarchived "members only!" section pointing to webofcheer.com/member.html, CGI comms variant. Copyright 2005! Features Johnny Carson, Charles Chaplin, Rowan Atkins, The Three Stooges and some other Americans no one knows about anymore. There must have been a massive Johnny Carson amongst the CIA contractors at that time given alljohnny.com! The HTML page is weirdly titled pg1c. Interesting, feels like a leak of the site generation system.
199.187.208.12world-news-online.net2010EnglishJARnewsa.rss-item, split images
204.176.38.130i-pressnews.com2011EnglishJARnews
204.176.38.132turkishnewslinks.com2011EnglishTurkeyJARnews
204.176.38.133globalcitizennews.net2010EnglishJARnewsrss, split images
204.176.38.134photographyarecord.com2011EnglishCGIphotographyCute
204.176.38.135breakingthewicket.com2011EnglishCGIsports, cricket
204.176.38.136politicalworldtoday.com2011EnglishEgyptJARnews
204.176.38.137hi-tech-today.com2011EnglishJARtech
204.176.38.139bigscreenbattles.com2011EnglishJARfilms
204.176.38.141rakotafootball.com2011EnglishJARsports, football"Rakota" is an Indian family name
204.176.38.143noticiassofisticadas.com2011SpanishCGInews
204.176.38.142senderosdemontana.com2011SpanishJSsports, cyclingTalks about mountain biking and Eurobike 2010, so likely Spain focused, but it is not direct enough to be certain. JS unarchived.
204.176.38.144techno-today.com2011EnglishJARtechwas legit previously.
204.176.38.145tickettonews.com2011EnglishJARnewsrdns source. Epoch times link.
204.176.38.146dps-digitalphotosharing.com2011EnglishJARphotography
204.176.38.147theputtingreen.com2011EnglishJARsports, golf
204.176.38.149sportsnewstodayar.com2011ArabicLebanon, othersJARsports"ar" on domain name presumably means "Arabic"
204.176.38.159kairuafricanews.com2011EnglishAfricaJARnewswhat is "Kairu"? en.wikipedia.org/wiki/Kairu a place in India? en.wiktionary.org/wiki/kairu "frog" in Japanese? rdns source
204.176.39.97beamingnews.com2011ArabicJARnewsNice design. rdns source
204.176.39.98cubriendonoticias.com2011SpanishJARnewsarchive quite broken. JAR unarchived. cqcounter.com/whois/www/cubriendonoticias.com.html not found.
204.176.39.100rowleyworldpost.com2011EnglishEgypt, othersJARnews
204.176.39.103economicnewsbuzz.com2011KoreanCGIfinanceLove the kawaii style
204.176.39.104spectranewsonline.com2011EnglishCGInewsmarked copyright 2010.
204.176.39.105entertainmentnewscompany.com2011ChineseSWFfilms, musicTitle: "娱乐新闻公司", lit. Entertainment News Company
204.176.39.110arabnewsatdawn.com2011ArabicCGInewscute, the Arab chick's ice cream actually has a cocktail umbrella on it. Marked copyright 2010. Here she is: www.shutterstock.com/image-photo/young-veiled-woman-reading-newspaper-eating-4836766 by Anneka. Pinged her privately on www.facebook.com/Anyka.Fotografie.
204.176.39.115globalprovincesnews.com2010ArabicJSnewsThe largest HTML by far so far at 328 KiB
204.176.39.116mahparah-news.com2011FarsiJSnews
204.176.39.119commercialspacedesign.com2013FarsiCGIarchitectureC O N C E P T U A L design. A rare example of a fake company website.
207.150.191.68kickofffootballnews.com2010EnglishCGIsports, footballrss-item. archive quite broken, comms not found. "login" link web.archive.org/web/20100512232600/http://kickofffootballnews.com/login.html to unarchived, so CGI comms likely. cqcounter.com/whois/www/kickofffootballnews.com.html in-style.
207.150.191.68mywebofnews.com2011ArabicJARnewsSplit images[ref][ref]. rss-items.
207.150.191.68technologypresstoday.com2011FarsiJARnewssplit images, RSS
207.150.191.68worldofonlinenews.com2011EnglishJARnewssplit images[ref][ref]. Later legit.
207.210.250.131starrynightnews.com2011ArabicJSnewsinteresting design
207.210.250.132aeronet-news.com2011EnglishJARairplanes
207.210.250.133bakaribulletin.com2011EnglishAfricaJSnewsBakari could either be a given name, or a village in Togo
207.210.250.134deprensaenlarevisiondehoy.com2011SpanishJARnews
207.210.250.135icwb-news.com2011EnglishJARnewsICWB stands for "Inner Circle Worldwide Business (News)", the title of the website
207.210.250.136sportsreelhighlights.com2011EnglishJARsports
207.210.250.138inquiry-human-past.com2011EnglishJARhistory
207.210.250.139thefairwaysaregreen.com2011ThaiJARsports, golf
207.210.250.142russiaupdate.com2011RussiannewsOlder unrelated archive: web.archive.org/web/20010429003443/http://russiaupdate.com/. Visible but possibly cut title "Россия Обновление" (Russia Update)
207.210.250.143archaeologyreview.net2010EnglishJARhistory, archeology
207.210.250.146noticias-caracas.com2011SpanishVenezuelaCGInewsCaracas is the capital of Venezuela. But you knew that, right?
207.210.250.147bailandstump.com2011EnglishJSsports, cricket"Bail" and "Stump" are the two parts of the thing your're supposed to hit with the ball in cricket.[ref]
207.210.250.148classicalmusic4arab.com2011musicThe first words in the title are "كلاسيكيات الموسيقى العربية" (Arabic music classics)
207.210.250.149globalventurestat.com2008EnglishSWFnews
207.210.250.152al-rashidrealestate.com2010ArabicEgyptCGIfinance, real-estate
207.210.250.153newsintheworld-ru.com2011RussianJARnews
207.210.250.154news-unlimited.info2011Englishnews"members" link visible so likely GI comms.
208.93.112.105fastnews-online.com2009EnglishJARnewsa.newslink
208.93.112.106travelxtreme.net2008EnglishJARtravelsplit images
208.93.112.108nbanewsroundup.com2013EnglishCGIsports, basketballquite broken with only HTML archived in 2013, but we're counting it due to coms link and IP range. cqcounter.com/whois/www/nbanewsroundup.com.html shows it well.
208.93.112.110luxuryfive.net2011EnglishtravelTitle: "Luxury five"
208.93.112.111topfootballnewsonline.com2011Englishsports, footbal"Top Football News Online".
208.93.112.112todaysportscores.com2011Englishsports
208.93.112.114dynamicworldnews.com2011Englishnews
208.93.112.116gazingvoyage.com2011Englishtravel
208.93.112.123garundipost.com2011EnglishnewsTODO meaning of "Garundi"
208.254.38.39todaysengineering.com2011EnglishCGIengineering
208.254.38.56nejadnews.com2011ArabicJARnewsrss, JAR unarchived
208.254.40.96sixty2media.com2011EnglishVariousJARnewsEpoch times link
208.254.40.99newspoliticssource.com2013ArabicJARnewsOne of the news mentions Snowden
208.254.40.110musical-fortune.net2010EnglishCGImusicimages /images/banner-02.jpg
208.254.40.113ashoka-gemstones.com2010EnglishJARjewelry
208.254.40.117worldnewsandent.com2010ArabicEgyptCGImews
208.254.40.124riskandrewardnews.com2013EnglishCGIfinance
208.254.42.194it-proonline.com2011EnglishCGItechimages /images/header_01.jpg
208.254.42.205driversinternationalgolf.com2011EnglishCGIsports, golf
208.254.42.209mardelsurnoticias.com2011SpanishJARnewsweird mixture of Portuguese and Spanish language external links
208.254.42.215nowfreshfinances.com2011EnglishCGIfinanceCGI unarchived
208.254.42.216circulatingnews.net2010EnglishJARtravel
208.254.42.219westingtonpassnews.com2011EnglishJARnews
209.162.192.44thejewelofsouthamerica.com2010SpanishCGInature, birdsrss-item, split images. CGI unarchived but likely under the "Foro" (Forum) link. Talks about the Amazon river and rainforest which it refers to in the Spanish title of the English domain: "La Joya de Sudamerica" (The Jewl of South America).
209.162.192.49rastadirect.net2010EnglishJARfansite
209.162.192.51yellow-chair-report.com2011EnglishCGInewsrss-item, split images. CGI unarchived likely under "Members" link.
209.162.192.57globalnewsreports.net2010EnglishCGInewsrss-item. Copyright 2008. CGI unarchived. Comms unarchived likely CGI under "Forum" link
209.162.192.59easytravelsite.net2009EnglishCGInewsSplit headers. CGI unarchived, likely under "Login" link.
209.51.136.178cellar-notes.com2011EnglishJARwinerss, split images, JAR unarchived
209.51.136.178the-news-scene.com2011EnglishJARnewssplit images, RSS
210.80.75.36e-commodities.net2011EnglishJARfinance
210.80.75.37trekkingtoday.com2011EnglishJARsports, runningsplit images[ref][ref]. rdns source.
210.80.75.41multinews-33.comJARnewsNo archives of the HTML, but the JAR was archived
210.80.75.43gulfandmiddleeastnews.com2011ArabicJSnews
210.80.75.44whirlybirdinflight.com2011EnglishJARhelicopters
210.80.75.45kings-game.net2011EnglishJARgaming, chessJAR unarchived
210.80.75.46topglobalnewsdaily.com2011EnglishJSnews
210.80.75.49recipe-dujour.com2011EnglishJARcookingnice design
210.80.75.53sportsman-elite.com2011Englishsports
210.80.75.55philippinenewsonline.net2010PhilippinesJARnews
210.80.75.56technewsforme.com2011FarsiJARtech
210.80.75.59goldeportesnoticias.com2011Spanishsports, football
212.4.16.224lanoticiasdehoyelinforme.com2010SpanishJARnews
212.4.16.232mynewscheck.com2011EnglishCanadaJARnewsrdns source
212.4.16.245financial-crisis-news.com2011RussianRussiaJARnewsrdns source
212.4.16.252minutosdenoticias.com2010SpanishCGInewsCSS
212.4.17.38fightwithoutrules.com2011RussianJARsports, combat sportsThe photo on top middle can be seen e.g. at spfightingtalk.wordpress.com/2013/01/18/breaking-down-mixed-martial-arts-what-is-mma/. The fither on top is Mac Danzig, TODO find bottom one lazy now.
212.4.17.41newtechfrontier.com2010EnglishCGItechsince became legit: newtechfrontier.com/
212.4.17.43smart-travel-consultant.com2011ChineseCGItravelajaxtax.js may be of interest for fingerprinting. Title: "智能旅行顾问", lit. Smart Travel Consultant
212.4.17.46atentlaloc.com2009EnglishQuatar, Lebanon, Israel, IranJSjewelryTlaloc is an Aztec deity, and Aten is an Egyptian deity. Both appear to be somewhat linked to gold, thus their usage in a jewelry website. Creative domain name.
212.4.17.53newsresolution.net2010EnglishCôte d'Ivoire, Lebanon, SudanJARnews, UN Peacekeeping
212.4.17.56lesummumdelafinance.com2010FrenchFranceJARfinance
212.4.17.98topbillingsite.com2011EnglishCGIfilms
212.4.17.122b2bworldglobal.com2011EnglishCGInews
212.4.17.125worldaroundyunnan.com2011ChineseJARnewsrss, split images, JAR
212.4.17.160localtoglobalnews.com2010EnglishJARnewsrss, split images
212.4.18.14football-enthusiast.com2011EnglishEuropeJSsports, football
212.4.18.129sightseeingnews.com2010EnglishJARtravel
212.209.74.105globalbaseballnews.com2011EnglishJSsports, baseball
212.209.74.106football-de-luxe.com2010FrenchFranceJARsports, football
212.209.74.112developmental-league.com2010EnglishCGIsports, American footballCGI comms variant?
212.209.74.115mediocampodefutbol.com2010SpanishJARsports, football
212.209.74.117myengineeringaffinity.com2011EnglishJARtech
212.209.74.122atthemovies.biz2011EnglishJARcinemaArchive very broken with no text and rather only images in a table. But it has a link to unarchived JAR. The only .biz domain found so far as of writing. There are also some broken redirect archives from 2003.
212.209.74.123worldfinancialexchangenews.com2010EnglishSWFfinanceSWF unarchived.
212.209.74.124urouttahere.com2011EnglishTravelThe title means "you're out of here", a reference to this being a travel website. A closely stock image of the same child models is visible at: www.hammockbeach.com/play/kids-crew-resort-program/
212.209.74.125avoilurefixe.com2011FrenchTunisiaJARairplanes"à voilure fixe" is French for "with fixed wing", i.e. fixed wing aircraft
212.209.74.126headlines2day.com2011FarsiJARnewsmarked copyright 2009
212.209.79.34fgnl.net2011EnglishIranCGInewsfour letter domain! FGNL stands for "Farsi Global News Links" Marked copyright 2009.
212.209.79.37fitness-sources.com2010EnglishJSsports, fitness
212.209.79.40hydradraco.com2011EnglishJARsports, American footballTODO meaning of the name?
212.209.79.41noticiasdelmundolatino.com2011SpanishJARnews
212.209.79.42suparakuvi.com2011FrenchFranceJARnewsa Tour Eiffel image, and young people stuff, i.e. first world stuff. It's for France alright. But TODO meaning of domain name? Ciro's second language French didn't cut it this time.
212.209.79.46cetusdelph.com2011EnglishJSsports, scuba
212.209.79.47willtoworship.com2011EnglishJARreligion, Christianitymarked copyright 2007
212.209.79.48themvconnection.com2011EnglishJARmusic
212.209.79.51pi-resources.net2010EnglishJSprivate investigators"pi" stands for Private Investigators. The CIA must have had some fun making this one.
212.209.79.53ourscubaworld.com2011EnglishJSsports, scuba
212.209.79.58tech-love-home.com2011ChineseJStechTitle: "消费类电子产品", lit. Consummer Electronics
212.209.79.60first-solo-aviation.com2010EnglishJARairplanes
212.209.79.61china-destinations.org2011ChineseJStraveltitle: "中国目的地指南", lit. "China Destination Guide"
212.209.90.69worldedgenews.com2011EnglishJARnews
212.209.90.72talkingpointnews.info2011Englishnews
212.209.90.74globalinvestmentnews.net2010EnglishJARnewsrss, split images
212.209.90.75prebitinvestment.com2011EnglishfinanceTitle: "Pre-BIT Investment". TODO meaning of "BIT".
212.209.90.80nsmovies.net2010EnglishJARfilms"ns" stands for "Nirguna Saguna", two separate Hindu names/deities. But there are no other Indian references beyond those.
212.209.90.82middleeastjournal.net2010ArabicJSnews
212.209.90.84thenewseditor.com2011EnglishJARnews
212.209.90.87newsandweathersource.com2009EnglishJARnewsmarked copyright 2009.
212.209.90.89pakisports.com2010EnglishPakistanSWFsports
212.209.90.90vriha-aesthetics.com2011ArabicJSnews
212.209.90.92amishkanews.com2011EnglishIndiaJSnewsAmishka is an Indian name, plus some prominent mentions of Bollywood both point to India specifically
212.209.90.93theentertainbiz.com2011EnglishJARentertainment
212.209.90.94eurosportssummary.com2011EnglishJARsports
216.93.248.194esmundonoticias.com2011SpanishJARnewsrss-items. Shares IP with kukrinews.com.
216.93.248.194kukrinews.com2010EnglishJSNewsJavaScript with SHAs. Talks to /cgi-bin/news.cgi. A Kukri is the national weapon of Nepal. Slogan: "Nepal's Sharp Edge", thus matching the website name. Split image header. Copyright 2009. Shares IP with esmundonoticias.com.
216.93.248.194lasthournews.com2010UrdujARnewssplit images
216.93.248.194tech-geek-news.com2010ArabicJSnewsSplit images, rss-item. Comms unarchived. Wayback machine archive very broken but cqcounter.com/whois/www/tech-geek-news.com.html perfectly in style.
216.104.38.114all-sport-headlines.com2011ArabicJARnewssplit images[ref][ref]Arabic-looking alphabet, image only so can't Google translate easily.
216.104.38.114wahidfutbol.com2011ArabicJSfootballWayback Machine very broken. cqcounter.com/whois/www/wahidfutbol.com.html somewhat in-style, but not very typical.
216.104.38.114wildbirds-seasia.com2011EnglishJARnature, birdsSlit headers, rss-item. "Birds of Southeast Asia". Stock image match example at: fr.pinterest.com/pin/745627282030750518/, possibly a greater bird-of-paradise.
216.105.98.132europeantravelcafe.com2010Englishtravelrss-items, split images. Marked copyright 2009. Comms not found. There's a currency converter at: web.archive.org/web/20100724024644/http://www.europeantravelcafe.com/tools.html which could be suspicious. The "plan your trip" link links to a different website: secure-cert.net/~etc/transport.html which is unusual. A similar thing happens in intloil.org. That link was removed from the next archive: web.archive.org/web/20110201192245/http://europeantravelcafe.com/ which is quite funny, looks like a bug and is possibly a link used by the CIA operators to manage the website? "secure-cert.net" is obscure, the only other surviving online mention of it is www.leewillis.co.uk/wordpress-plugins/#comment-6513
216.105.98.134fuenteneta.com2011SpanishnewsGoogle says:
"Fuente neta" in Spanish translates to "truth" or "for real" in a colloquial, Mexican context, emphasizing the truthfulness of what is being said
216.105.98.135ilat-news.com2011EnglishnewsThe domain stands for : "International Law Enforcement & Anti Terrorism", also on page "Law Enforcement and Anti Terrorism news".
216.105.98.136etherealinspirations.net2011EnglishreligionTitle: "Ethereal Inspirations"
216.105.98.137the-news-zone.com2011EnglishJARnewsThere is a broken archive: web.archive.org/web/20130814194744/http://the-news-zone.com/ which contains just the middle frame. But by chance the broken JAR link was there further confirming the hit!
216.105.98.139cultura-digital.net2008SpanishCGInewsMarked copyright 2008. Previously legit.
216.105.98.140uaeshoppingspree.com2013EnglishUAEJARshoppingArchive quite broken, but has link to unarchived JAR. Has an unusually personal touch "As you can probably tell from the title of my website, shopping is my very favorite pastime." cqcounter.com/whois/www/uaeshoppingspree.com.html shows it well.
216.105.98.144garanziadellasicurezza.com2011ItalianJARcommercialThe archive is quite broken with toplevel archiving a frame rather than the actual website. JAR unarchived. web.archive.org/web/20110822020341/http://www.garanziadellasicurezza.com:80/news.html has rss-item. I'm counting this one it's too much.
216.105.98.145montanismoaventura.com2012SpanishSpainJSsports, mountaineeringJS unarchived. Marked copyright 2010. More visible archive at: cqcounter.com/whois/www/montanismoaventura.com.html
216.105.98.146large-format-news.com2011Englishphotography
216.105.98.147nepalnewsbrief.com2008EnglishNepalJARnewsMarked copyright 2006 (!) Registered 2007-01-18.
216.105.98.148teclafinance.com2011ChinesefinanceCQ Counter screenshot rather broken but in a similar way as another Chinese website: cqcounter.com/whois/site/activegaminginfo.com.html so it seems that simply their screenshot mechanism of the time didn't have proper Chinese encoding support. The title is "特科拉财经" which Google Translate translates to "Tekola Finance", the first word apparently being the phonetic transliteration of a foreign name, but it is unclear what it references exactlyh.
216.105.98.149entreman.com2011EnglshCGIbusinessComms unarchived. Marked Copyright 2011. Archive a bit broken, original styling more clearly visible at: cqcounter.com/whois/www/entreman.com.html. Tis is the only website found so far that stores its custom fonts on the site e.g. /M-1c-fontfacekit/mplus-1c-black-webfont.svg. Stock of office workers at: www.shutterstock.com/image-photo/presentation-business-people-working-office-2-4767229 by Marcin Balcerzak. Light bulb stock at: www.bigstockphoto.com/image-4406416/stock-photo-money-light by PhilipO.
216.105.98.152modernarabicnews.com2013ArabicJARnewsHTML archive quite broken, but JAR was archived thankfully. cqcounter.com/whois/www/modernarabicnews.com.html shows it well. Original title: "أخبار عربية حديثة قياسي"
216.105.98.153global-headlines.com2011EnglishnewsWas a legitimate WordPress website for a while in 2020.
216.105.98.154everythingcricket.org2011EnglishJARsports, cricketAlso has archives from 2009, but they were a bit broken. The 2011 one is marked copyright 2011, so they actually bothered to updated that.
216.105.98.156familyhealthonline.net2011EnglishCGIhealth
216.105.98.157delacorne.com2011FrenchnewsThe title is french "Corne de l'Afrique Nouvelles" and "de la Corne", the French name for the Horn of Africa. So French but not France.
216.105.98.158econfutures.com2011EnglishfinanceAfrica focus. Stock image source: www.istockphoto.com/photo/asian-helpdesk-support-operator-gm147050715-12052374 by imabase
219.90.61.110surya-brahma.com2011SpanishJARnewsSurya and Brahman are Hindu concepts, but the website appears to have nothing to do with India or Hinduism. Interesting.
219.90.61.111classicalmusicboxonline.com2010EnglishCGImusic
219.90.61.116athletepro.net2010EnglishJARsports
219.90.61.117lajornadanow.com2010SpanishJARnews
219.90.61.119aviation-navigation.com2011Englishaviation
219.90.61.120theinternationalworld.com2011EnglishJARnewsrdns source. rss-items.
219.90.61.121thepyramidnews.com2011FarsiIranJARnews
219.90.61.122iran-newslink-today.com2011FarsiIranJARnews
219.90.61.123journeystravelled.com2011EnglishJARtravel
219.90.62.229information-junky.com2011EnglishGhanaJARnews
219.90.62.231todosperuahora.com2011SpanishPeruCGInews
219.90.62.233theworld-news.net2010UrduCGInews
219.90.62.234recuerdosdeviajeonline.com2011SpanishSWFtravelmarked "Copyright 2009"
219.90.62.235ordenpolicial.com2011SpanishSpainnews, security
219.90.62.237elcorreodenoticias.com2011SpanishVenezuelaJARnews
219.90.62.238freshtechonline.com2011EnglishCGItech
219.90.62.240cityworldnewsnow.com2011EnglishnewsHas subdomain secure.cityworldnewsnow.com so likely CGI comms. in-style, arab world mentions.
219.90.62.241newscentertoday.com2011EnglishJARnewsCopyright 2008. rdns source. rss-items. Later legit. In 2016: The domain name you have entered is not available. It has been taken down because the email address of the domain holder (Registrant) has not been verified..
219.90.62.242ride-captain.com2011EnglishJARsports, motorcyles
219.90.62.243fitness-dawg.com2021EnglishJARsports, fitnessOriginal Reuters article sample. Pushup dude stock: www.istockphoto.com/photo/sweating-young-man-doing-push-ups-gm115455429-645125 by Mike R. Manzano, pinged at: x.com/cirosantilli/status/1899750172260806711. Dude was an ex-Sr. Software engineer at Coinbase from 2019-2022, he likely retired with the Bitcoin boom already legend. Still making apps as of 2024 though: www.facebook.com/leftspin. Dog at: www.istockphoto.com/photo/english-bulldog-gm92095947-2629950 by GlobalP.
219.90.62.244easytraveleurope.com2012EnglishJARtravelnice design
219.90.62.245world-news-now.net2011EnglishJARnews
219.90.62.246negativeaperture.com2011EnglishCGIphotographynice domain name
219.90.62.247conquermstoday.com2011EnglishCGIhealthMS means multiple sclerosis. Comms not found, CGI from unarchived subpage assumed. Has a subdomain "heal.conquermstoday.com" according to 2013 DNS Census, but no links to it in the archive.
Read the full article
CIA 2010 covert communication websites / SWF reverse engineering 2026-10-23
View more
Codex did some SWF reverse engineering for us creating the analysis script: jar.py and should be pointed to a dump directory of the websites such as CIA 2010 websites dump. The analysis below was done as of commit b9eb31618c36421133e4875bc1cd7d7ac7763a32.
Unfortunately, the SWF are much less interesting than the JAR files.
According to Codex' analysis, it is just a lean client, and doesn't even contain its own UI which seems to be downloaded from the server. As such, we will never know what it actually looked like.
One thing that they do do is to load a gallery or things that it loops through, presumably images, and loop through them automatically. These are loaded one by one from the server, and it keeps doing server requests after that.
Codex mentions that the SWF could also download another SWF to execute, which could in turn contain the login UI, possibly upon click. But it is all hidden.
A particularly interesting example is worlddispatch.net/servlet/news2. This is apparently a helper page for the SWF, but perhaps because the website became broken after it was abandoned, it was archived, and contains the following 10 bytes of a URL query string:
c=0&f=3424
Codex' reverse engineering identified what the parameters do exactly:
  • c=0: Selects the ordinary content-cycling mode. c=1 selects a different scrolling/animated branch.
  • f=3424: advance to the next content item every 3.424 seconds, when content is available. The code's default is 4 seconds.
Read the full article
CIA 2010 covert communication websites / Wayback Machine Updated 2026-10-23
View more
D'oh.
But to be serious. The Wayback Machine contains a very large proportion of all sites. It does happen sometime that a Wayback Machine archive is missing or broken and cqcounter has the screenshot. But the Wayback Machine is still the most complete database we have found so far. Some archives are very broken. But those are rare.
The only problem with the Wayback Machine is that there is no known efficient way to query its archives across domains. You have to have a domain in hand for CDX queries: Wayback Machine CDX scanning.
The Common Crawl project attempts in part to address this lack of querriability, but we haven't managed to extract any hits from it.
CDX + 2013 DNS Census + heuristics however has been fruitful however.
We have dumped all Wayback Machine archives of known websites to: CIA 2010 websites dump using ../cia-2010-covert-communication-websites/download-websites.sh. This allows for better grepping and serves as a backup in case they ever go down.
Read the full article