Exposing a Currently Active Malicious Free VPN Domain Portfolio Run and Operated by the NSA - An OSINT Analysis

From this. 

Currently active free VPN servive domains courtesy of the NSA known to have been participating in the campaign:

bluewebx.com

bluewebx.us

irs1.ga

iranianvpn.net

IRSV.ME

DNSSPEEDY.TK

ironvpn.tk

ironvpn.pw

irgomake.win

make-account.us

make-account.ir

IRANTUNEL.COM

JET-VPN.COM

newhost.ir

homeunix.net

vpnmakers.com

hidethisip.info

uk.myfastport.com

witopia.net

worldserver.in

music30ty.net

misconfused.org

privatetunnel.com

aseman-sky.in

Related domains known to have been involved in the campaign:

gaysexvideo.us

keezmovies.us

hitporntube.com

enjoyfreesex.com

allfreesextube.com

thegaytubes.com

sextubeshop.com

pornfetishexxx.com

ebonypornox.com

freepornpig.com

marriagesextube.com

searchporntubes.com

suckporntube.com

darlingmatures.com

pornretrotube.com

teensexfusion.net

rough18.us

teendorf.us

1retrotube.com

typeteam.com

biosextube.com

hadcoreporntube.com

reporntube.com

telltake.com

asianprivatetube.com

hostednude.com

alfaporn.com

sexbring.com

porntubem.com

newerotictube.com

firstretrotube.com

oralsexlove.com

1bdsmtubes.com

hairytubeporn.com

brunettetubex.com

tubelatinaporn.com

xxxgaytubes.com

analxxxvideo.com

analsexytube.com

aeroxxxtube.com

amateurpornlove.com

admingay.com

xxxretrotube.com

xxxshemaletubes.com

hotpornstartube.com

firsttrannytube.com

erotixtubes.com

1pornstartube.com

1asiantube.com

18mpegs.com

maturediva.com

elitematures.com

vipmatures.com

pcsextube.com

porn-vote.com

pornbrunettes.com

maturedtube.com

alfatubes.com

maturetubesexy.com

justhairyporn.com

hotblowjobporn.com

homemadetubez.com

homemadexx.com

golesbiansex.com

fuck-k.com

freebdsmxxx.com

emeraldporntube.com

dosextube.com

bigtitslove.com

yoursex.sexy

tubez.sexy

japaneseporn.win

hdfuck.me

tubelesbianporn.com

vipebonytube.com

vipamateurtube.com

largematuretube.com

latinosextube.com

xxxhardest.com

tubebigtit.com

tubesexa.com

realfetishtube.com

pornways.com

Related domains known to have participated in the campaign:

hi2panel.us

androidserver.us

make22.us

make46.us

make58.us

make-account.us

irspeedy.info

memolfashion.com

irspeedy.com

downloadpluse.com

make-account.com

kashkashun.com

erfan-shop.com

digidoorbin.com

make34.us

make94.us

make82.us

make70.us

make166.us

takeaw.us

irspeedyy.us

make-account2.us

downloadplus.link

mehrdad.biz

mypayments.me

appleid22.com

susadns.com

saba-sdi.com

saba-sdi.design

bluewebx.com

Stay tuned!