 Fingerprints

ID: cia-2010-covert-communication-websites/fingerprints

 Top articles  Latest articles + New article in topic

CIA 2010 covert communication websites / Fingerprints by

Ciro Santilli 36  Updated 2025-04-24  +Created 1970-01-01

From The Reuters websites and others we've found, we can establish see some clear stylistic trends across the websites which would allow us to find other likely candidates upon inspection:

natural sounding, sometimes long-ish, domain names generally with 2 or 3 full words. Most in English language, but a few in Spanish, and very few in other languages like French.
shallow websites with a few tabs, many external links, sometimes many images, and few internal pages
lots of rectangular images make up the top bar banner image. Stock images are often used to make the full image, and then the full image is split. An example
common themes include:
- news
- hobbies, notably sports, travel and photography. Golf seems overrepresented. Must be a thing over there in Langley.
.com and .net top-level domains, plus a few other very rare non .com .net TLDs, notably .info and .org
each one has one "communication mechanism file": communication mechanisms
narrow page width like in the days of old, lots of images
each hit domain is the only domain for its IP, i.e. the websites are all private hosted, no shared web hosting service examples have been found so far
split images images: many of the website banners are composed of several images cut up. Stock images were first assembled into the banner, and then the resulting image was cut. Possibly this was done to make reverse image search to their stock image provider harder. But it somewhat backfired and serves as a good marker that confirms authorship. Maybe it is some kind of outdated web design thing, which they took much further in time than the average website, like the JAR. Their websites do appear to follow common style guidelines form earlier eras, around the early 2000s notably, some legit sites that look a lot like hits:
- web.archive.org/web/20031002010827/http://www.ausiranstudy.com/
some common pattern they follow in their news lists:
- ul.rss-items > li.rss-item, e.g.: web.archive.org/web/20110202092126/http://beamingnews.com/
- links with class a.newslink and a.newslinkalt e.g. web.archive.org/web/20110128181622/http://profile-news.com/

The most notable dissonance from the rest of the web is that there are no commercial looking website of companies, presumably because it was felt that it would be possible to verify the existence of such companies.

It would be fun to actually reverse search into one of their stock image provider's original images. Ones we've found:

 Read the full article

 New to topics? Read the docs here!