I also squeezed a few of the previously known IPs without clear range a bit harder on viewdns.info, as I now understand that there do exist a few websites that share the same IPs. This led to X entirely new hits, and also me moving a few domains that were previously marked as "unknown range" to a specific IP when two or more domains were found in a given IP.

I also understood a bit better the Mass Deface III pastebin pastebin.com/CTXnhjeS discovered by Oleg Shakirov which contains some hits: I think that the hits are purely coincidental when some hacker broke into "Condor Hosting" systems and then defaced several websites it contained, inadvertently also taking down some CIA websites along the day which is funny.

And this seems to be a small host chosen by the CIA, so it contained a disproportionate dense concentration of CIA hits. But the original hackers likely had no idea of what they did. www.zone-h.com/mirror/id/18994983 suggests that Iranian hacker group Sejeal was behind the defacing.

This is an update to the article: Section "CIA 2010 covert communication websites"

While procrastinating I suddenly remembered that cqcounter.com/siteinfo/ has screenshots of many many old websites, and I decided to look at possible hits in known IP ranges for which the Wayback Machine archive was broken.

Luckily I had already maintained a clear list of known domains in IP ranges which had no or broken wayback machine archive, so I just went over those.

This led to finding 60 novel screenshots of previously examined domains that are in common CIA-style, thus confirming them as hits beyond reasonable doubt in my mind. This also publicly revealed for the first time how a few new websites looked like, and what was their content, and in particular the target language, which could sometimes not be easily determined from the domain name alone.

This novel CQ Counter screenshot interpretation, plus a few new random discoveries and a slight relaxation of fingerprint requisites described described below moves us to 473 hits up from the previous 397!

The newly found websites were all just soulless bulk or mildly cute like the vast majority of them, but I did find found a few new screenshots of CIA websites that targeted other democracies:

I've also decided to now classify garanziadellasicurezza.com (Italy) as a hit due to various forms of supporting evidence being present. The archive is very broken however unfortunately.

The fingerprint of "having a visually similar CQ Counter screenshot" is definitely weaker than a Wayback Machine archive as we only have a screenshot and can't inspect the HTML to find the communication mechanism. But when the screenshot is perfectly in CIA style and in a known IP range, the evidence is too strong and we'll consider it as a hit moving forward.

I'm also going to reclassify a few previously known domains in confirmed IP ranges as hits as hits either when:This is a slight moving of goalposts, but those cases just feel overwhelmingly probably.

I love how this project has led me to use whatever random sources come in hand! CQ Counter is the ONLY website that I know of besides the Wayback Machine that has historical screenshots of a huge number of domains. Their database is VERY complete. But they are so obscure!

They even have the old IP of the domain. But because they don't have reverse IP to domain reverse search, and are heavily CAPTCHAed preventing search engines from properly indexing them, we can't use them to fill in existing IP ranges... So the search for the most complete DNS database that doesn't cost 15k USD like DomainTools continues www.reddit.com/r/OSINT/comments/1j8uasm/does_domaintools_offer_historical_reverse_ip_ie/

Interestingly a large number of the websites with broken Wayback Machine are from regions outside of the USA, presumably being slower to load from Wayback Machine US-based servers makes he archives more likely to break.

Announced at:

VN88 từ lâu đã luôn khẳng định được tên tuổi của mình như một nhà cái uy tín hàng đầu tại Việt Nam. Không chỉ thu hút bởi chất lượng dịch vụ tuyệt vời, VN88 còn nổi bật nhờ vào những tính năng vượt trội, những cơ hội thắng lớn mà nó mang lại cho mỗi người chơi. VN88 cung cấp một loạt sản phẩm cá cược phong phú, đáp ứng đầy đủ nhu cầu của mọi người chơi, từ những trò chơi thể thao hấp dẫn, các trò chơi casino trực tuyến chân thật đến các trò chơi dân gian nổi tiếng tại Việt Nam.
Website: vn88.racing/
Phone: 0775664888
Địa Chỉ: 86 Võ Văn Kiệt, An Lạc, Bình Tân, Hồ Chí Minh, Việt Nam
Email: info@vn88.com

Welcome to my home page!

Welcome to my home page!

Welcome to my home page!
98Win là nền tảng giải trí trực tuyến hàng đầu tại Việt Nam, hoạt động từ năm 2020 và được cấp phép bởi chính phủ Costa Rica cùng các tổ chức danh tiếng như PAGCOR, Isle of Man và CEZA.

Website: 98win98.win/
Phone: 0906532526
Địa Chỉ: 45 Đ. Nguyễn Văn Luông, Phường 11, Quận 6, Hồ Chí Minh, Việt Nam
Email: info@98win.com

Welcome to my home page!

Likely hits possible but whose archives is too broken to be easily certain. If:were to ever be found, these would be considered hits.

africainnews.com

globalsentinelsite.com. dawhois.com/www/globalsentinelsite.com.html empty. Copyright 2011 on top and 2008 on bottom. Unusually wide, has a few sections, but somewhat shallow. Copyright 2008. JAR JAR. a.rss-item

todaysolar.com. This might just be legit, but keeping it around just in case.

cqcounter.com has an exceptionally complete database containing:

Unfortunately I can't find a reverse IP search method.

And perhaps due to having lots of CAPTCHAs, Google doesn't seem to index that website very well... it even has a tiny screenshot! And it also shows some more metadata beyond IP, e.g. HTTP response headers, which notably contain stuff like Server: Apache-Coyote/1.1.

They seem to have an exceptionally complete database.

Both cqcounter.com/whois/www/teclafinance.com.html and cqcounter.com/whois/site/activegaminginfo.com.html both are broken, so it appears that their screenshot mechanism at the time did nor support Chinese characters well.

They also have some random localized versions:These can be useful if your IP gets blacklisted on the main site because you were checking too many sites.

As of 2025 they are marked at cqcounter.com/ as "Copyright 2000-2004".

Welcome to my home page!

"HitClub – Cổng game giải trí trực tuyến đẳng cấp, mang đến cho người chơi trải nghiệm cá cược hấp dẫn với kho game đa dạng như bài lá, tài xỉu, nổ hũ và nhiều trò chơi đổi thưởng thú vị khác. Sở hữu hệ thống bảo mật tiên tiến, giao diện thân thiện và tốc độ giao dịch nhanh chóng, HitClub đã trở thành điểm đến lý tưởng cho cộng đồng game thủ yêu thích thử thách và đam mê chiến thắng. Tham gia ngay để tận hưởng những phút giây giải trí đỉnh cao cùng hàng loạt ưu đãi hấp dẫn!
Website: hitclub.forum/

Welcome to my home page!

Welcome to my home page!

Good88 là nền tảng giải trí đa dạng với nhiều trò chơi hấp dẫn, mang đến cho bạn vô số lựa chọn mỗi khi tham gia. Nhờ thiết kế giao diện thông minh và dịch vụ chăm sóc khách hàng chuyên nghiệp, Good88 luôn giành được sự tin tưởng tuyệt đối từ các thành viên. Hãy cùng khám phá chi tiết về thương hiệu này qua bài viết dưới đây!
Website: good888.art/

Welcome to my home page!

There are two toplevel boxes, one contains only input, and all output goes to the second one. The second one may also contain some input.