Ciro Santilli @cirosantilli 37

 Articles (11k) Discussions (25) Comments (53) Follows  Received likes

 New  Updated  Top  Announced  A-Z  Liked  Followed

Updates / 60 new CIA website screenshots discovered on CQ Counter  Updated 2025-06-12  +Created 2025-04-15  2025-06-12

 View more

This is an update to the article: Section "CIA 2010 covert communication websites"

While procrastinating I suddenly remembered that cqcounter.com/siteinfo/ has screenshots of many many old websites, and I decided to look at possible hits in known IP ranges for which the Wayback Machine archive was broken.

Luckily I had already maintained a clear list of known domains in IP ranges which had no or broken wayback machine archive, so I just went over those.

This led to finding 60 novel screenshots of previously examined domains that are in common CIA-style, thus confirming them as hits beyond reasonable doubt in my mind. This also publicly revealed for the first time how a few new websites looked like, and what was their content, and in particular the target language, which could sometimes not be easily determined from the domain name alone.

This novel CQ Counter screenshot interpretation, plus a few new random discoveries and a slight relaxation of fingerprint requisites described described below moves us to 473 hits up from the previous 397!

The newly found websites were all just soulless bulk or mildly cute like the vast majority of them, but I did find found a few new screenshots of CIA websites that targeted other democracies:

I've also decided to now classify garanziadellasicurezza.com (Italy) as a hit due to various forms of supporting evidence being present. The archive is very broken however unfortunately.

Figure 1.
2011 cqcounter archive of affairesdumonde.com targeting France
. Source.

Figure 2.
2011 cqcounter archive of romulusactualites.com targeting France
. Source.

Figure 3.
2011 cqcounter archive of ordenpolicial.com targeting Spain
. Source.

Figure 4.
2011 cqcounter archive of vejaaeuropa.com targeting Brazil
. Source.

Figure 5.
2011 cqcounter archive of european-footballer.com targeting Croatia
. Source.

The fingerprint of "having a visually similar CQ Counter screenshot" is definitely weaker than a Wayback Machine archive as we only have a screenshot and can't inspect the HTML to find the communication mechanism. But when the screenshot is perfectly in CIA style and in a known IP range, the evidence is too strong and we'll consider it as a hit moving forward.

I'm also going to reclassify a few previously known domains in confirmed IP ranges as hits as hits either when:

they have Wayback Machine archives with matching visual style
they have broken Wayback Machine archives but with indication of comms or known HTML elements like rss-item

This is a slight moving of goalposts, but those cases just feel overwhelmingly probably.

I love how this project has led me to use whatever random sources come in hand! CQ Counter is the ONLY website that I know of besides the Wayback Machine that has historical screenshots of a huge number of domains. Their database is VERY complete. But they are so obscure!

They even have the old IP of the domain. But because they don't have reverse IP to domain reverse search, and are heavily CAPTCHAed preventing search engines from properly indexing them, we can't use them to fill in existing IP ranges... So the search for the most complete DNS database that doesn't cost 15k USD like DomainTools continues www.reddit.com/r/OSINT/comments/1j8uasm/does_domaintools_offer_historical_reverse_ip_ie/

Interestingly a large number of the websites with broken Wayback Machine are from regions outside of the USA, presumably being slower to load from Wayback Machine US-based servers makes he archives more likely to break.

Announced at: