by Ciro Santilli (@cirosantilli, 35)
Here we list domains for which the correct IP was apparently not found since there are no neighbouring hits.
These are suspicious, and suggest either that we didn't obtain the correct reverse IP, or a change in CIA methodology from an older time at which they were not yet using the obscene IP ranges.
For example, in the case of inews-today.com, 2013 DNS Census gave one IP 193.203.49.212, but then viewdns.info gave another one 66.175.106.146 which fit into an existing IP range, and which assumed to be the correct IP of interest.
A similar case happened when we found IP 212.209.74.126 for headlines2day.com with dnshistory.org: dnshistory.org/historical-dns-records/a/headlines2day.com.
It is interesting to note that Reuters seems to have featured disproportionately many hits from that range, one wonders why that happened. It is possible that they chose these because they actually didn't have any nearby hits to give away less obvious information, though they did pick some from the ranges as wel.
In what follows we list the domains with possible reverse IPs and what was explored so far for each. We consider IPs not in a range to be uncertain, and that instead their domains might have been previously in a range which we
dailynewsandsports.com. Found with: 2013 DNS Census virtual host cleanup heuristic keyword searches
  • 216.119.129.94. rdns source: viewdns.info "location": "United States", "owner": "A2 Hosting, Inc.", "lastseen": "2012-04-13". Tested viewdns.info range: 216.119.129.85 - 216.119.129.86, 216.119.129.89 - 216.119.129.99, ran out of queries for 87 and 88
    • 216.119.129.90: eastdairies.com 2011-04-04. Promising name and date, but no archives alas.
    • 216.119.129.97: miideaco.com 2016-02-01
  • 216.119.129.114 Found with: 2013 DNS Census virtual host cleanup heuristic keyword searches, also present on viewdns.info but at a later date from previous "location": "United States", "owner": "A2 Hosting, Inc.", "lastseen": "2013-11-29". Tested viewdns.info range: 216.119.129.109 - 216.119.129.119
    • 216.119.129.110: dommoejmechty.com.ua. Legit.
    • 216.119.129.111: dailybeatz.com: Legit
    • 216.119.129.113:
      • audreygeneve.com
      • reyzheng.com
      • jacintorey.com
    • 216.119.129.114: dailynewsandsports.com. hit.
    • 216.119.129.115: afxchange.com legit/broken
    • 216.119.129.116: danafunkfinancial.com: legit
  • 208.73.33.194 on securitytrails.com
    • 69.64.155.77 Amazon.com, Inc. 2008-12-10 (16 years) 2008-12-19 (16 years) 9 days
    • 68.178.232.100 GoDaddy.com, LLC 2008-10-04 (16 years) 2008-11-02 (16 years) 29 days
    • 208.73.33.194 Jumpline Inc 2008-09-01 (17 years) 2008-10-03 (16 years) 1 month
iranfootballsource.com:
  • 34.98.99.30 Kansas City - United States Google LLC 2021-05-24
  • 184.168.221.94 United States GoDaddy.com 2020-07-21
  • 50.63.202.66 United States GoDaddy.com 2020-07-07
  • 50.63.202.86 United States GoDaddy.com 2020-05-28
  • 184.168.221.94 United States GoDaddy.com 2020-05-13
  • 50.63.202.74 United States GoDaddy.com 2020-04-29
  • 50.18.223.191 San Jose - United States Amazon.com 2015-03-23. Sources: 2013 DNS Census and viewdns.info
    • no viewdns.info hits +- 10
  • 85.13.200.108 United Kingdom Coreix Dedicated Customer Allocation 2013-06-30. Source: viewdns.info
    • 85.13.200.108: 1000 hits, so unlikely to be the one
iraniangoalkicks.com:
iraniangoals.com:
football-enthusiast.com:
  • 212.4.18.14: Tested viewdns.info range: 212.4.18.1 - 212.4.18.29. This is a curious case, rather close to 212.4.18.129 sightseeingnews.com, but not quite in the same range apparently. Viewdns.info also agrees on its history with only "212.4.18.14", "location" : "Milan - Italy", "owner" : "MCI Worldcom Italy Spa", "lastseen" : "2013-06-30" of interest.
cyhiraeth-intlnews.com:
news-latina.com: domainsbyproxy.com 2007-12-17
europeannewsflash.com:
outlooknewscast.com:
  • dnshistory.org/historical-dns-records/a/outlooknewscast.com
    • 2009-08-08 -> 2011-02-11 74.53.159.130. Tested viewdns.info range: 74.53.159.120 - 74.53.159.140
      • 74.53.159.130: aeromedhistory.org 2014-11-29
      • 74.53.159.130: mariposahorticultural.com 2022-11-28
      • 74.53.159.130: thewritestuffresume.com 2011-04-04. Legit.
  • viewdns.info/iphistory/?domain=outlooknewscast.com
    • 204.93.178.121 Chicago - United States SERVERCENTRAL 2011-09-08. Tested viewdns.info range: 204.93.178.111 - 204.93.178.131. Skimmed through, nothing of great interest.
    • 74.53.159.130 United States SOFTLAYER 2011-04-04. Tested.
farsi-newsandweather.com:
global-view-news.com:
health-men-today.com:
  • dnshistory.org/historical-dns-records/a/health-men-today.com
    • 2011-01-07 -> 2011-01-07 69.90.162.165. Tested viewdns.info range: 69.90.162.155 - 69.90.162.175. Virtuals.
    • 2009-11-30 -> 2010-05-27 67.220.228.224. New range with global-view-news.com? Tested viewdns.info range: 67.220.228.214 67.220.228.234
      • 67.220.228.223: stagedwithdistinction.com 2011-10-09. One archive of godaddy only.
    • 2009-08-01 -> 2009-09-19 69.42.58.50. Tested viewdns.info range: 69.42.58.40 - 69.42.58.60. Virtuals, canada.
  • viewdns.info/iphistory/?domain=health-men-today.com
    • 204.11.56.19 British Virgin Islands CONFLUENCE-NETWORK-INC 2014-04-19. Virtuals.
    • 208.91.197.19 British Virgin Islands CONFLUENCE-NETWORK-INC 2013-05-20. Unknown range.
    • 69.90.162.165 Canada COGECO-PEER1 2012-06-29. Tested.
  • securitytrails.com/domain/health-men-today.com/history/a
    • 69.42.58.50 Aptum Technologies 2008-09-01 (17 years) 2008-09-04 (17 years) 3 days
firstnewssource.com:
pars-technews.com:
newdaynewsonline.com:
sportsnewsfinder.com:
newsworldsite.com:
todaysnewsreports.net:
  • viewdns.info/iphistory/?domain=todaysnewsreports.net
    • 208.91.197.132 British Virgin Islands CONFLUENCE-NETWORK-INC 2013-07-01
    • 205.178.189.129 United States NETWORK-SOLUTIONS-HOSTING 2013-05-20 likely virtual
    • 173.255.131.72 Reno - United States UK-2 Limited 2012-08-27. Tested viewdns.info range: 173.255.131.62 173.255.131.82. Virtual and modern hits only.
    • 67.213.211.232 United States UK-2 Limited 2011-09-07 unknown. Tested viewdns.info range: 67.213.211.222 67.213.211.242. viewdns.info/reverseip/?t=1&host=67.213.211.232 empty.
      • 67.213.211.236: icf-finan.com 2015-01-20
      • 67.213.211.237: playinside.me 2016-02-04. Nice domain hack, but no.
      • 67.213.211.239: reality-sexxx.com 2011-09-08
hassannews.net:
todayoutdoors.com:
globaltourist.net:
terrain-news.com:
intlnewsdaily.com
opensourcenewstoday.com:
techwatchtoday.com:
Likely hits possible but whose archives is too broken to be easily certain. If:
  • nearby IP hits
  • proper reverse engineering of their comms if any, or any other page fingerprints
were to ever be found, these would be considered hits.
africainnews.com
  • no archives of the HTML. dawhois.com/www/africainnews.com.html somewhat in-style but unclear.
  • SWF. A reverse engineering of the SWF should be able to confirm.
  • web.archive.org/web/20111007194814/http://africainnews.com/robots.txt
  • dnshistory.org/historical-dns-records/a/africainnews.com
    • 2009-12-29 -> 2010-07-28 72.167.232.43. Tested viewdns.info range: 72.167.232.33 - 72.167.232.53. Several virtual hosts there. viewdns.info/reverseip/?t=1&host=72.167.232.43 medium virtual haven't bothered to explore much
    • 2011-10-14 -> 2011-10-14 68.178.232.100 virtual
    • 2012-08-12 -> 2012-08-12 97.74.42.79. Tested viewdns.info range: 97.74.42.69 - 97.74.42.89
      • 97.74.42.74: landtex.net 2023-03-22
      • 97.74.42.76: solidasshonky.com 2023-03-07
      • 97.74.42.77: solidasshonky.com 2023-03-07
      • 97.74.42.78: blakebrothers.co 2018-05-05
      • 97.74.42.78: learningjbe.com 2023-02-02
      • 97.74.42.78: solidasshonky.com 2023-03-07
      • 97.74.42.78: sourceuae.com 2023-03-07
      • 97.74.42.78: superiorfoodservicesales.com 2017-09-10
      • 97.74.42.79: large virtual
      • 97.74.42.80: waiasialtd.com 2016-10-17
  • viewdns.info/iphistory/?domain=africainnews.com
    • 50.63.202.92 United States AS-26496-GO-DADDY-COM-LLC 2013-06-30. Likely large virtual.
    • 97.74.42.79 United States AS-26496-GO-DADDY-COM-LLC 2013-05-20. tested.
    • 68.178.232.100 United States AS-26496-GO-DADDY-COM-LLC 2012-06-29 virtual
    • 68.178.232.99 United States AS-26496-GO-DADDY-COM-LLC 2011-11-13
    • 68.178.232.100 United States AS-26496-GO-DADDY-COM-LLC 2011-10-09 virtual
    • 72.167.232.43 United States GO-DADDY-COM-LLC 2011-09-08. Tested.
globalsentinelsite.com. dawhois.com/www/globalsentinelsite.com.html empty. Copyright 2011 on top and 2008 on bottom. Unusually wide, has a few sections, but somewhat shallow. Copyright 2008. JAR JAR. a.rss-item
todaysolar.com. This might just be legit, but keeping it around just in case.

Ancestors (12)

  1. IP range search
  2. Methodology
  3. CIA 2010 covert communication websites
  4. Central Intelligence Agency
  5. Intelligence agency
  6. Secret service
  7. Espionage
  8. War
  9. Social science
  10. Scientific method
  11. Science
  12. Home

Incoming links (2)

View article source

Discussion (0)

+ New discussion

There are no discussions about this article yet.

Articles by others on the same topic (0)

There are currently no matching articles.
See all articles in the same topic + Create my own version