CIA 2010 covert communication websites / TODO

All IP ranges have some holes in them for which we don't have a domain name.

It is because there was nothing there, or just because we don't have a good enough reverse IP database?

It is possible that DomainTools could help with a more complete database, but its access is extremely expensive and out of reach at the moment.

Censys is another option that would be good to try.

Putting 140 USD into WhoisXMLAPI to get all whois histories of interest for possible reverse searches would also be of interest.

It can't be HTML crawl because presumably there wouldn't have been links to those websites? Presumably this is why Common Crawl doesn't seem to have any hits.

So they must have had some kind of DNS A record database?

Or would IPv4 sweep have worked, without the Host header with the CIA's setup?

The same question also applies to the 2013 DNS Census. It has less hits, but still has many.

Whatever they did, we are so so glad that they did!

.com and .net are very dominant. Here we list other choices made:

Previously it was unclear if there were any .org hits, until we found the first one with clear comms: web.archive.org/web/20110624203548/http://awfaoi.org/hand.jar

Later on, two more clear ones were found with expired domain trackers:further settling their existence. Later on newimages.org also came to light.

Others that had been previously found in IP ranges but without clear comms:

.org is very rare, and has been excluded from some of our search heuristics. That was a shame, but likely not much was missed.