As a JSON: OurBigBook Markup to JSON conversion helper cia-2010-covert-communication-websites/bigb-to-json:
cia-2010-covert-communication-websites/bigb-to-json cia-2010-covert-communication-websites.bigb
Hit criteria: has Wayback Machine archive, and clear indication of a known communication mechanism. The mechanism itself doesn't need to be archived however, a link to it is enough given other supporting elements: IP range, site style, date, web archive date pattern. JS commons are always quickly visually inspected, other mechanisms we look only at filename patterns. Commented edge cases that didn't make the cut can be found mostly under Section "IP range search" and Section "2013 DNS Census virtual host cleanup heuristic keyword searches".
ipdomainWayback Machinelanguagecountry mentionscommsthemenotes
?all-sport-headlines.com2011ArabicJARnewssplit images[ref][ref]Arabic-looking alphabet, image only so can't Google translate easily.
?firstnewssource.com2011FarsiIranJARnewsCopyright 2009. Split images. rss-items.
?global-view-news.com2011EnglishJARnewssplit images[ref][ref]
?globaltourist.net2010EnglishJARtravelsplit images[ref][ref], rss-items. speed.jar "speed test" JAR pattern. Seems to have been legit both before.
?hassannews.net2010ArabicSWFnewsCSS or archive quite broken. Split images[ref][ref]. rss-items.
?health-men-today.com2011ArabicJARnewsrss-items. Encoding broken.
?pars-technews.com2011FarsiIranJARnews"pars" presumably means "Parsi" or something of the same root
?sportsnewsfinder.com2011ChineseChinaJARnews体育新闻发现者 (sports news finder)
?theworldnewsfeeds.com2011EnglishJARnewsrss-items. Split images[ref][ref]
?todayoutdoors.com2011EnglishJARsports, travelsplit images[ref][ref]
?weblognewsinfo.com2011EnglishJARnewsSplit images, rss-items.
?opensourcenewstoday.com2010ArabicJARnewscopyright 2010
?techwatchtoday.com2011EnglishJARtech, newsMarked copyright 2008. Split images[ref][ref]. Later legit.
? "The cyhyraeth is a ghostly spirit in Welsh mythology, a disembodied moaning voice that sounds before a person's death." WTF! So the serious looking black actress lady is meant to represent the voice of death?. Split images[ref][ref]. rss-items
?24hoursprimenews.com2009EnglishJARnewssplit images[ref][ref]
?europeannewsflash.com2011EnglishJARnewsSplit images[ref][ref]
?farsi-newsandweather.com2011FarsiIranJARnewssplit images[ref][ref]
?iranfootballsource.com2011FarsiJSsports, football
?iraniangoalkicks.com2008FarsiIranJARsports, football
?iraniangoals.com2009FarsiIranJSsports, football
?mywebofnews.com2011ArabicJARnewsSplit images[ref][ref]. rss-items.
?news-latina.com2011EnglishJARnewscopyright 2007
?worldofonlinenews.com2011EnglishJARnewssplit images[ref][ref]. Later legit. source copyright 2008 was the first clear .org hit with comms we've been able to find. Title translation: "Arab women to help Iraq", so perhaps "awfaoi" stands for "Arab Women For A O? Iraq". This fits well into the .org theme. Marked copyright 2008."vc" is a standard abbreviation for venture capital, cricket"Bail" is one part of the thing your're supposed to hit with th eball in cricket.[ref], cricketmarked copyright 2009., tennis"jaka" presumably means Jakarta, the capital of Indonesia. There is a Indonesia section on the left sidebar. But the news are quite global however., martial arts website name is a neologism with "show" and "industry". means: "using money and other resources carefully and not wastefully" source source, cricketarchive quite broken, lots of missing files, including the JS has several archives from 2013, marked as Live Web Proxy Crawls and explained "mostly by the Save Page Now", so presumably by counter intelligence or amateurs, martial arts, boxingChinese title: 我的象棋世界 (My Chinese Chess world). rdns source. Split images[ref][ref], boxing source. Split images, rss-items., golf quite broken, but link to CGI comms. example. Since became legitimate, Ciro contacted the owner, and he was unaware of the domain's history., Afghanistan, Iran, EgyptCGInewsPHP pages, images /images/index_01.jpg, basketball times link, PHP pages, golfnice domain name, various othersJSsports, basketball JAR was not archived, but there's a link to it early hit from 2004 to 2005. Then a gap, then they redid the domain: 2011. Same authors given content similarities e.g. "Submit Your Favorite Carson Moment". Reusing the domain after all these years, the lack of OPSEC is just mind blowing! New website marked Copyright 2003. Part of Oleg Shakirov's findings. One of the Reuters websites. Search documented at: Searching for Carson., Islam source source. Heil., running unarchived AmericaCGInews, runningmarked copyright 2010 copyright 2009"sa" is an abbreviation for the site title "Sports Alive", sports, boats link to unarchived JAR uses .zip extension! First instance, wow, golf, swimming, martial artsTODO meaning of "kama"? Kama lol? of Goethe-Institut and Germany all over. JAR unarchived unarchived. TODO why "casa"? Doesn't seem to have any link to Spanish or Portuguese."Runako" is an African given name., shoppingJAR unarchived"Zubee" is a Muslim name: meaning of "JCB". JS unarchived. meaning of "dk;dc". "Weapons Today". In First World countries the CIA felt it would be safe to touch edgier subjects like guns archive almost empty, but JAR was archived. One wonders what "bao" refers to, could be Chinese, but the small snippet of visible website is in English. unarchived copyright 2010 meaning of "dr"? rdns source. is an Arabic masculine name, rugby not found, CGI from unarchived subpage assumed linked to but not archived, Bhutan, India, Maldives, Nepal, Pakistan, Sri Lanka TibetJARtravelJAR linked to but missing from archive, financePHP pages unarchived, Pakistan, India, EnglandJARsports, cricket"Kanata" is a place in Ottawa, Canada. The name is likely of Indigenous origin. copyright 2008, not even the CIA can escape Star Wars. TODO identify boy. website is entitled "活跃游戏" which means "Lively games", or "active games" as in the domain name itself PortugueseBrazilJARmusic, TunisiaJARnews unarchived unarchived very broken, JAR unarchived. Full title: "Persephne International", reference to Greek Goddess of "spring, the dead, the underworld, grain, and nature", baseball very broken, SCUBA divingsubmerge yourself now meaning of "tnc"? source. Some very similar domains:, Needed more creativity here! Later legit., fitness unarchived. unarchived. Split images, rss-items. Present at "Mass Deface III" pastebin. 2009. Present at "Mass Deface III" pastebin. JAR unarchived., footballcopyright 2009. Present at "Mass Deface III" pastebin. of, but on a Russian transliterated domain rather than the English one, very interesting at: "Mass Deface III" pastebin.'t find comms, but stylistically perfect. rss-items. Present at "Mass Deface III" pastebin. images, rss-items. Present at "Mass Deface III" pastebin. Present at "Mass Deface III" pastebin. with SHAs source. Previously, footballTODO meaning of "Bleacher"? Possible reference to Bleacher Report., football, cricketJS unarchived. The requested URL /cricket.js was not found on this server "gdgt" stands for "GaDGeT", which is mentioned on subtitle, footballVuvuzela is this plastic horn, popular in football stadiums. The term is of African origin. Later legit. rdns source. Previously at, cricket got archived a lot of times, though all seem to be Alexa crawls., basketball source. split images[ref][ref]."Dylan" presumably a reference to Bob Dylan? "Don" unclear. Maybe Don McLean? at[ref] in a range. 2007. Split images. rss-items. Previously at, cricketTODO meaning of "grd" source. Later legit., golf"MIDE" stands for "Middle East". Comms not archived, presumably CGI comms variant. source name, cricket, football"Rakota" is an Indian family name, cyclingTalks about mountain biking and Eurobike 2010, so likely Spain focused, but it is not direct enough to be certain. JS unarchived. legit previously. source. Epoch times link., golf, othersJARsports"ar" on domain name presumably means "Arabic" is "Kairu"? a place in India? "frog" in Japanese? rdns source design. rdns source quite broken. JAR unarchived., othersJARnews the kawaii style copyright 2010., musicTitle: "娱乐新闻公司", lit. Entertainment News Company, the Arab chick's drink actually has a cocktail umbrella on it. Marked copyright 2010. O N C E P T U A L design. A rare example of a fake company website. design could either be a given name, or a village in Togo stands for "Inner Circle Worldwide Business (News)", the title of the website, golf, archeology is the capital of Venezuela. But you knew that, right?, cricket"Bail" and "Stump" are the two parts of the thing your're supposed to hit with the ball in cricket.[ref], real-estate times link of the news mentions Snowden /images/banner-02.jpg /images/header_01.jpg, golf mixture of Portuguese and Spanish language external links unarchived, runningsplit images[ref][ref]. rdns source. archives of the HTML, but the JAR was archived, chessJAR unarchived design source source, combat sports became legit: may be of interest for fingerprinting. Title: "智能旅行顾问", lit. Smart Travel Consultant, Lebanon, Israel, IranJSjewelryTlaloc is an Aztec deity, and Aten is an Egyptian deity. Both appear to be somewhat linked to gold, thus their usage in a jewelry website. Creative domain name.ôte d'Ivoire, Lebanon, SudanJARnews, UN Peacekeeping, football, baseball, football, American footballCGI comms variant?, football unarchived."à voilure fixe" is French for "with fixed wing", i.e. fixed wing aircraft copyright 2009 letter domain! FGNL stands for "Farsi Global News Links" Marked copyright 2009., fitness, American footballTODO meaning of the name? Tour Eiffel image, and young people stuff, i.e. first world stuff. It's for France alright. But TODO meaning of domain name? Ciro's second language French didn't cut it this time., scuba, Christianitymarked copyright 2007 (!) investigators"pi" stands for Private Investigators. The CIA must have had some fun making this one., scuba "消费类电子产品", lit. Consummer Electronics "中国目的地指南", lit. "China Destination Guide""ns" stands for "Nirguna Saguna", two separate Hindu names/deities. But there are no other Indian references beyond those. copyright 2009. is an Indian name, plus some prominent mentions of Bollywood both point to India specifically Shares IP with with SHAs. Talks to /cgi-bin/news.cgi. A Kukri is the national weapon of Nepal. Slogan: "Nepal's Sharp Edge", thus matching the website name. Split image header. Copyright 2009. Shares IP with copyright 2008. Previously legit. quite broken, but has link to unarchived JAR. Has an unusually personal touch "As you can probably tell from the title of my website, shopping is my very favorite pastime.", mountaineeringJS unarchived. Marked copyright 2010. copyright 2006 (!) If true this would be the earliest known reference to a date in the websites. archive quite broken, but JAR was archived thankfully., cricketAlso has archives from 2009, but they were a bit broken. The 2011 one is marked copyright 2011, so they actually bothered to updated that. and Brahman are Hindu concepts, but the website appears to have nothing to do with India or Hinduism. Interesting. source. rss-items. "Copyright 2009", motorcyles 2008. rdns source. rss-items. Later legit, with a pause The domain name you have entered is not available. It has been taken down because the email address of the domain holder (Registrant) has not been verified.., fitness design domain name means multiple sclerosis. Comms not found, CGI from unarchived subpage assumed. Has a subdomain "" according to 2013 DNS Census, but no links to it in the archive.

Articles by others on the same topic (0)

There are currently no matching articles.