= 44 new CIA websites
This is an update to the article: <CIA 2010 covert communication websites>{full}
I found 44 new covert websites made by the CIA around 2010 bringing the total to 397!
Most websites were boring as usual, but one was slightly cooler: https://web.archive.org/web/20110207150839/http://webofcheer.com/[webofcheer.com] is a comedy fansite featuring Johnny Carson, Charles Chaplin, Rowan Atkins (of Mr. Bean fame), The Three Stooges and some other <Americans> no one knows about anymore. There must have been a massive Johnny Carson amongst the contractors at that time, given that we previously also knew about https://web.archive.org/web/20040113025122/http://alljohnny.com/[`alljohnny.com`], a site dedicated fully to him! Both of these sites also serve as some of the earliest examples we've got so far, dating back to 2004 and 2005.
\Image[https://github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/screenshots/webofcheer.com.jpg?raw=true]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110207150839/http://webofcheer.com/[webofcheer.com]}
{height=717}
{source=https://web.archive.org/web/20040113025122/http://alljohnny.com/}
\Image[https://github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/screenshots/webofcheer.com-scroll.jpg?raw=true]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110207150839/http://webofcheer.com/[webofcheer.com] scrolled to show Johnny Carson}
{height=717}
{source=https://web.archive.org/web/20040113025122/http://alljohnny.com/}
\Image[https://github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/screenshots/alljohnny.com.jpg?raw=true]
{title=2004 <Wayback Machine> archive of https://web.archive.org/web/20040113025122/http://alljohnny.com/[alljohnny.com]}
{description=This one was a previously known website featuring Johnny Carson.}
{height=717}
{source=https://web.archive.org/web/20040113025122/http://alljohnny.com/}
Another cool discovery is that I found the <#Getty Images> source of the #Jedi boy on their <Star Wars> themed site https://web.archive.org/web/20101230033220/http://starwarsweb.net/[starwarsweb.net]: https://web.archive.org/web/20101230033220/http://starwarsweb.net/ The photo can still be licensed today as of 2025: https://www.gettyimages.co.uk/detail/photo/little-jedi-royalty-free-image/172984439[]. I found it by searching for "jedi boy" on https://gettyimages.co.uk. The photo is credited to username `madisonwi`, presumably an alias of a photographer from <#Madison, Wisconsin>. Inspired by this I <reverse image searched> and found the source of many other stock images from other websites, and I pinged their authors whenever I could locate them e.g. https://x.com/cirosantilli/status/1899750172260806711[].
\Image[https://web.archive.org/web/20250312060328if_/https://media.gettyimages.com/id/172984439/photo/little-jedi.jpg?s=2048x2048&w=gi&k=20&c=vKTUlTKpYtPcL8wQobbZMQEhU1CZefV7VlXxDExqZn8=]
{title=Stock photo of a Jedi boy from Getty Images used on https://web.archive.org/web/20101230033220/http://starwarsweb.net/[starwarsweb.net]}
{height=700}
{source=https://www.gettyimages.co.uk/detail/photo/little-jedi-royalty-free-image/172984439}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/starwarsweb.net.jpg]
{title=2010 <Wayback Machine> archive of https://web.archive.org/web/20101230033220/http://starwarsweb.net/[starwarsweb.net]}
{height=1400}
There were two small advances that led to the discovery of new domains:
* while looking for a way to procrastinate I decided to scrape https://justdropped.com/drops/ for fun. That website lists expired domain names and see if it would yield any new results.
I had already <CIA 2010 covert communication websites/Expired domain trackers>[scrapped other expired domain websites before and used that data], and I hoped that this one would provide some new domain hits, even though it had very large overlap with the other websites I had scraped domains from previously.
Such domain name lists tend to contain all SCAM domains in existence, since those inevitably expire once the scammers are caught.
* even more importantly, I noticed by chance that I was being too strict on a small part of my fingerprinting which was excluding a few good domains, by removing any hits that had multiple archives of the <CIA 2010 covert communication websites/Communication mechanism>
With those two new developments, I then kicked off my pre-existing search pipelines searching for domain names with the word `news` on them, an amazingly efficient heuristic because many of the websites were disguised as news aggregators, and after a few hours theses new hits emerged. A few of those also led to the discovery of new IPs which then led to new domains.
One entirely new IP range was found around https://web.archive.org/web/20090420131359/http://fastnews-online.com/[fastnews-online.com] from 208.93.112.105 to 208.93.112.125. There were many domain names with very promising names in the range, but unfortunately for some reason most didn't have <Wayback Machine> Archives so I didn't count them as hits as per my guidelines.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/fastnews-online.com.jpg]
{title=2009 <Wayback Machine> archive of https://web.archive.org/web/20090420131359/http://fastnews-online.com/[fastnews-online.com]}
{height=800}
Also the newly found https://web.archive.org/web/20110228051404/http://todaysengineering.com/[todaysengineering.com] at 208.254.38.39 appears to form an IP range with the previously known https://web.archive.org/web/20110207210023/http://nejadnews.com/[nejadnews.com] at 208.254.38.56:, but I couldn't find any other domains in the region with our current data sources.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/todaysengineering.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110228051404/http://todaysengineering.com/[todaysengineering.com]}
{height=800}
All other domains either slot into previously known IP ranges, or more commonly don't currently have a known IP, though they would likely just slot in existing ranges if we had better data.
Thanks to <#Jack Rhysider> from the <#Darknet Diaries> podcast for pointing me to the existing of the <CIA 2010 covert communication websites/Reuters article>[2022 Reuters article] that kickstarted my research on the subject!
The full list of newly found websites is:
* https://web.archive.org/web/20110202110916/http://cellar-notes.com/[cellar-notes.com]
* https://web.archive.org/web/20110201114414/http://dailywellnessnews.com/[dailywellnessnews.com]
* https://web.archive.org/web/20110202185635/http://differentviewtoday.com/[differentviewtoday.com]
* https://web.archive.org/web/20110209045123/http://dryterrainnews.com/[dryterrainnews.com]
* https://web.archive.org/web/20100206221718/http://euronewsonline.net/[euronewsonline.net]
* https://web.archive.org/web/20090420131359/http://fastnews-online.com/[fastnews-online.com]
* https://web.archive.org/web/20110203041325/http://financecentraltoday.com/[financecentraltoday.com]
* https://web.archive.org/web/20101229090542/http://globalcitizennews.net/[globalcitizennews.net]
* https://web.archive.org/web/20101229090625/http://globalinvestmentnews.net/[globalinvestmentnews.net]
* https://web.archive.org/web/20110201180802/http://inkfreenews.com/[inkfreenews.com]
* https://web.archive.org/web/20110202031020/http://internationalnewsworthiness.com/[internationalnewsworthiness.com]
* https://web.archive.org/web/20110202054628/http://intoworldnews.com/[intoworldnews.com]
* https://web.archive.org/web/20100513182623/http://lasthournews.com/[lasthournews.com]
* https://web.archive.org/web/20100513190714/http://latinamericanewsbeat.com/[latinamericanewsbeat.com]
* https://web.archive.org/web/20100514160029/http://localtoglobalnews.com/[localtoglobalnews.com]
* https://web.archive.org/web/20100515102926/http://magneticfieldnews.com/[magneticfieldnews.com]
* https://web.archive.org/web/20100517070603/http://middle-east-newstoday.com/[middle-east-newstoday.com]
* https://web.archive.org/web/20100923090646/http://mideasttoday.net/[mideasttoday.net]
* https://web.archive.org/web/20110207171340/http://mydailynewsreport.com/[mydailynewsreport.com]
* https://web.archive.org/web/20110203000411/http://mynepalnews.com/[mynepalnews.com]
* https://web.archive.org/web/20130704042538/http://nbanewsroundup.com/[nbanewsroundup.com]
* https://web.archive.org/web/20110207210023/http://nejadnews.com/[nejadnews.com]
* https://web.archive.org/web/20110208004005/http://networkconnectionsite.com/[networkconnectionsite.com]
* https://web.archive.org/web/20110208063146/http://news-and-sports.com/[news-and-sports.com]
* https://web.archive.org/web/20101226034643/http://newsdelivered.net/[newsdelivered.net]
* https://web.archive.org/web/20110106212939/http://pondernews.net/[pondernews.net]
* https://web.archive.org/web/20110128181622/http://profile-news.com/[profile-news.com]
* https://web.archive.org/web/20110201122747/http://purlicue-news.com/[purlicue-news.com]
* https://web.archive.org/web/20110208085035/http://sandstormnews.com/[sandstormnews.com]
* https://web.archive.org/web/20110131054130/http://segomonews.com/[segomonews.com]
* https://web.archive.org/web/20110201184753/http://shadesofnews.com[shadesofnews.com]
* https://web.archive.org/web/20110201212849/http://technologypresstoday.com/[technologypresstoday.com/]
* https://web.archive.org/web/20110202221408/http://the-news-scene.com/[the-news-scene.com]
* https://web.archive.org/web/20110202151142/http://thefootball-life.com/[thefootball-life.com]
* https://web.archive.org/web/20091209022355/http://thefreshnews.com/[thefreshnews.com]
* https://web.archive.org/web/20110202221328/http://thenewsofpakistan.com/[thenewsofpakistan.com]
* https://web.archive.org/web/20110207201846/http://totallynewsnow.com/[totallynewsnow.com]
* https://web.archive.org/web/20080314234452/http://travelxtreme.net/[travelxtreme.net]
* https://web.archive.org/web/20110207150839/http://webofcheer.com/[webofcheer.com]
* https://web.archive.org/web/20110208191615/http://wiredworldnews.com/[wiredworldnews.com]
* https://web.archive.org/web/20101226225311/http://world-news-online.net/[world-news-online.net]
* https://web.archive.org/web/20110210004831/http://worldaroundyunnan.com/[worldaroundyunnan.com]
* https://web.archive.org/web/20110210051430/http://worldofonlinenews.com/[worldofonlinenews.com]
Announced at:
* https://mastodon.social/@cirosantilli/114156495883418926
* https://x.com/cirosantilli/status/1900249928653271334
* https://www.facebook.com/cirosantilli/posts/pfbid02LbrfezGmFik582d6H7ZEoCf9bwpU73vyivdGLVbbzWjejWLS5Rv9EjGNXBPQppUBl
* https://www.linkedin.com/posts/cirosantilli_httpslnkdineyu8qwc-i-found-44-new-covert-activity-7306015949374058496-X5zl/
Back to article page