Thursday, January 27, 2022

Profiling the Liberty Front Press Network Online - An OSINT Analysis

Note: This OSINT analysis has been originally published at my current employer's Web site - https://whoisxmlapi.com where I'm currently acting as a DNS Threat Researcher since January, 2021.

We’ve decided to take a closer look at the Internet-connected infrastructure of the Liberty Front Press Network part of a recent takedown and domain seizure part of an ongoing law enforcement operation fighting online propaganda online and to offer practical and relevant including actionable intelligence on the Internet-connected infrastructure behind the Liberty Front Press Network including the individuals behind it.

In this analysis we’ll take a closer look inside the Internet-connected infrastructure behind the Liberty Front Press Network and offer practical and relevant information including actionable intelligence on its Internet-connected infrastructure including the individuals behind it. Sample screenshot of various related domain name registrations using WhoisXML API’s and Maltego’s Integration

Related domains known to have been currently registered using the same registrant email addresses part of the Liberty Front Press Network Internet-connected infrastructure:

syriact-sy[.]com

darfikr[.]net

aminbaik[.]com

aminelzeintrading[.]com

khamenaei[.]com

shaghaaf[.]com

app-line[.]ir

alzouzougroup[.]com

trustmiddleeast[.]com

raha-travel[.]com

mg-sy[.]com

sinasibsalamat[.]com

ansar-allah[.]com

aletthadnews-iq[.]org

asiaquran[.]com

payamkherad[.]com

alavitile[.]com

mohseny[.]org

farhang-press[.]com

moshaver-sanati[.]ir

nsafari[.]ir

bpaorg[.]com

payamekherad[.]com

goshayesh[.]org

walifaqih[.]com

islamwilayah[.]com

walifaqih[.]info

Related malicious and fraudulent domains known to have been historically registered using the same email addresses:

nilenetonline[.]org

ansaroallah[.]org

hajez-sy[.]info

syriaalhadath[.]org

alwaienews[.]net

syriaalhadath[.]com

alwaght[.]net

alwaienews[.]com

ansaroallah[.]net

ansaroallah[.]info

farhang-press[.]com

navidplast[.]ir

iauaf[.]ir

nsafari[.]ir

sokhanetarikh[.]com

af[.]gl

mohajeronline[.]ir

yosin[.]org

mohajeronline[.]org

afghanistanema[.]ir

iranindia[.]org

imenhost[.]org

iuvmdaily[.]net

iuvmdaily[.]com

arab-now[.]com

aleppospace[.]com

harbi-media[.]com

ehsan-sy[.]org

truemedia-sy[.]com

syria-victory[.]com

scope-photos[.]com

u-roqayya[.]com

aminbaik[.]com

furatorder[.]com

alzouzougroup[.]com

darfikr[.]net

trustmiddleeast[.]net

eset-sy[.]com

darfikr[.]com

syriact-sy[.]com

souqsyria[.]com

alameensupport[.]com

ait-sy[.]com

shaghaaf[.]com

app-line[.]ir

afghanfeed[.]com

atlaspress[.]org

roushd[.]com

haghline[.]com

faryadmag[.]com

barchinews[.]com

pashtunews[.]com

reachpage[.]ir

darinews[.]com

raha-travel[.]com

sinasibsalamat[.]com

walifaqih[.]com

titisan[.]net

hpiiran[.]com

titisan[.]org

walifaqih[.]org

islamwilayah[.]com

mediaadil[.]com

syiahahlilbait[.]com

saintshepherd[.]com

walifaqih[.]info

newsaktual[.]com

hajez-sy[.]com

ansar-allah[.]com

online-traveler[.]com

Sample responding IPs for some of the domains known to have been historically registered using the same email addresses:

5[.]220[.]32[.]26

104[.]31[.]90[.]232

172[.]67[.]218[.]252

185[.]202[.]92[.]26

104[.]21[.]6[.]144

104[.]28[.]15[.]223

104[.]31[.]91[.]232

104[.]27[.]191[.]22

172[.]245[.]14[.]202

172[.]67[.]155[.]39

104[.]27[.]190[.]22

104[.]21[.]11[.]89

104[.]28[.]14[.]223

199[.]59[.]242[.]150

188[.]0[.]245[.]26

172[.]67[.]165[.]178

104[.]18[.]63[.]141

104[.]27[.]174[.]61

104[.]27[.]175[.]61

104[.]31[.]95[.]165

104[.]31[.]94[.]165

95[.]217[.]63[.]156

185[.]88[.]178[.]104

94[.]130[.]129[.]47

95[.]216[.]246[.]232

46[.]166[.]182[.]56

108[.]59[.]12[.]100

198[.]71[.]232[.]3

108[.]61[.]19[.]12

18[.]197[.]248[.]23

199[.]115[.]115[.]102

172[.]93[.]194[.]60

192[.]155[.]108[.]158

199[.]115[.]115[.]119

108[.]59[.]12[.]98

46[.]166[.]182[.]55

52[.]59[.]120[.]70

108[.]59[.]12[.]101

217[.]182[.]208[.]108

5[.]79[.]68[.]109

162[.]210[.]195[.]123

46[.]166[.]182[.]52

63[.]143[.]32[.]94

172[.]93[.]194[.]61

184[.]168[.]221[.]34

108[.]61[.]19[.]13

52[.]11[.]10[.]90

52[.]40[.]118[.]225

44[.]229[.]223[.]74

34[.]211[.]213[.]227

167[.]99[.]26[.]105

185[.]26[.]105[.]244

34[.]208[.]93[.]148

52[.]43[.]21[.]0

52[.]8[.]174[.]68

50[.]112[.]29[.]189

34[.]214[.]135[.]41

50[.]112[.]46[.]4

34[.]211[.]118[.]203

209[.]251[.]26[.]166

172[.]67[.]145[.]166

79[.]143[.]85[.]44

104[.]21[.]73[.]146

88[.]198[.]13[.]86

46[.]4[.]6[.]184

104[.]18[.]40[.]203

104[.]18[.]41[.]203

172[.]67[.]131[.]105

104[.]21[.]4[.]3

138[.]201[.]142[.]150

78[.]47[.]230[.]139

104[.]27[.]154[.]187

172[.]67[.]176[.]84

104[.]27[.]155[.]187

198[.]38[.]82[.]90

127[.]0[.]0[.]1

216[.]104[.]165[.]72

209[.]251[.]26[.]169

172[.]67[.]133[.]177

104[.]21[.]5[.]179

173[.]45[.]114[.]24

104[.]28[.]12[.]91

209[.]251[.]26[.]164

104[.]28[.]13[.]91

104[.]31[.]77[.]253

47[.]91[.]170[.]222

185[.]53[.]177[.]20

104[.]31[.]76[.]253

176[.]9[.]79[.]91

88[.]198[.]56[.]139

104[.]18[.]47[.]243

104[.]18[.]46[.]243

185[.]87[.]187[.]198

52[.]213[.]114[.]86

104[.]28[.]25[.]112

212[.]83[.]172[.]150

104[.]21[.]6[.]168

172[.]67[.]135[.]11

176[.]9[.]29[.]165

104[.]28[.]24[.]112

144[.]91[.]104[.]181

34[.]102[.]136[.]180

62[.]171[.]177[.]42

192[.]64[.]10[.]106

216[.]104[.]165[.]3

216[.]104[.]165[.]2

208[.]67[.]23[.]136

208[.]67[.]23[.]101

34[.]224[.]160[.]149

216[.]104[.]165[.]90

72[.]1[.]32[.]168

162[.]210[.]196[.]167

37[.]48[.]65[.]152

37[.]48[.]65[.]154

37[.]48[.]65[.]155

216[.]104[.]165[.]30

109[.]201[.]135[.]45

104[.]18[.]34[.]105

5[.]79[.]68[.]107

162[.]210[.]196[.]168

199[.]115[.]116[.]216

172[.]98[.]192[.]37

104[.]21[.]88[.]42

37[.]48[.]65[.]153

172[.]67[.]172[.]76

104[.]18[.]35[.]105

172[.]67[.]208[.]182

104[.]24[.]118[.]67

208[.]91[.]197[.]46

104[.]31[.]83[.]28

172[.]67[.]152[.]252

104[.]31[.]82[.]28

104[.]21[.]49[.]222

104[.]24[.]109[.]208

104[.]24[.]108[.]208

199[.]115[.]116[.]162

162[.]210[.]196[.]173

94[.]229[.]72[.]117

104[.]21[.]51[.]133

94[.]229[.]72[.]115

95[.]211[.]187[.]100

162[.]210[.]196[.]171

188[.]165[.]44[.]218

94[.]229[.]72[.]116

104[.]24[.]119[.]67

94[.]229[.]72[.]120

216[.]104[.]165[.]12

162[.]210[.]196[.]172

104[.]28[.]30[.]73

94[.]229[.]72[.]118

172[.]67[.]180[.]160

94[.]229[.]72[.]124

104[.]24[.]97[.]171

94[.]229[.]72[.]123

104[.]24[.]96[.]171

144[.]76[.]32[.]148

104[.]28[.]31[.]73

148[.]251[.]1[.]71

109[.]201[.]135[.]71

185[.]208[.]173[.]3

109[.]201[.]135[.]39

54[.]38[.]220[.]85

96[.]47[.]230[.]67

151[.]106[.]5[.]168

108[.]61[.]19[.]11

192[.]155[.]108[.]153

162[.]210[.]196[.]166

109[.]201[.]135[.]46

151[.]106[.]5[.]173

192[.]155[.]108[.]156

151[.]106[.]5[.]165

192[.]155[.]108[.]150

151[.]106[.]5[.]164

104[.]21[.]32[.]133

172[.]67[.]152[.]55

172[.]67[.]187[.]82

104[.]21[.]72[.]204

104[.]27[.]149[.]153

104[.]27[.]148[.]153

207[.]244[.]67[.]218

208[.]67[.]16[.]254

151[.]106[.]5[.]169

192[.]155[.]108[.]152

37[.]48[.]65[.]149

151[.]106[.]5[.]170

151[.]106[.]5[.]167

192[.]155[.]108[.]151

151[.]106[.]5[.]163

37[.]48[.]65[.]150

192[.]155[.]108[.]149

192[.]155[.]108[.]154

37[.]48[.]65[.]151

192[.]155[.]108[.]147

151[.]106[.]5[.]166

151[.]106[.]5[.]174

209[.]99[.]40[.]222

156[.]67[.]211[.]180

213[.]247[.]47[.]190

104[.]31[.]82[.]19

104[.]31[.]83[.]19

104[.]247[.]81[.]10

34[.]98[.]99[.]30

173[.]239[.]8[.]164

173[.]239[.]5[.]6

46[.]166[.]184[.]102

104[.]247[.]82[.]10

91[.]195[.]240[.]117

176[.]9[.]85[.]197

185[.]53[.]179[.]7

185[.]206[.]180[.]123

185[.]53[.]178[.]10

192[.]99[.]147[.]163

107[.]150[.]52[.]242

104[.]21[.]40[.]221

104[.]18[.]49[.]253

174[.]120[.]70[.]159

172[.]67[.]157[.]38

151[.]106[.]5[.]172

208[.]67[.]23[.]31

104[.]18[.]48[.]253

192[.]155[.]108[.]157

104[.]21[.]6[.]160

66[.]152[.]163[.]75

104[.]28[.]9[.]112

172[.]67[.]135[.]3

209[.]99[.]40[.]220

192[.]155[.]108[.]155

49[.]128[.]177[.]81

156[.]67[.]211[.]189

207[.]244[.]67[.]138

109[.]201[.]135[.]65

37[.]48[.]65[.]148

104[.]28[.]8[.]112

5[.]79[.]68[.]110

104[.]28[.]21[.]230

104[.]27[.]177[.]28

172[.]67[.]154[.]209

172[.]67[.]218[.]104

208[.]67[.]23[.]36

104[.]27[.]176[.]28

104[.]21[.]6[.]86

104[.]31[.]66[.]144

104[.]21[.]10[.]32

104[.]28[.]20[.]230

172[.]67[.]189[.]225

51[.]89[.]88[.]96

104[.]31[.]67[.]144

69[.]172[.]201[.]153

69[.]172[.]201[.]208

46[.]166[.]184[.]104

52[.]128[.]23[.]153

78[.]46[.]102[.]123

176[.]9[.]43[.]40

173[.]208[.]153[.]250

174[.]128[.]248[.]231

149[.]56[.]147[.]39

88[.]198[.]48[.]179

144[.]76[.]140[.]66

150[.]95[.]255[.]38

184[.]168[.]221[.]43

104[.]28[.]15[.]51

104[.]28[.]14[.]51

202[.]150[.]213[.]60

156[.]67[.]209[.]15

85[.]159[.]233[.]35

192[.]155[.]108[.]148

104[.]27[.]130[.]254

104[.]31[.]94[.]4

154[.]92[.]251[.]72

104[.]27[.]131[.]254

104[.]21[.]75[.]92

104[.]27[.]146[.]35

104[.]21[.]39[.]77

104[.]27[.]147[.]35

85[.]159[.]233[.]60

104[.]237[.]196[.]117

207[.]244[.]67[.]214

104[.]24[.]118[.]189

104[.]24[.]119[.]189

104[.]18[.]40[.]90

5[.]9[.]96[.]104

136[.]243[.]19[.]6

95[.]216[.]77[.]5

192[.]99[.]92[.]2

172[.]67[.]217[.]163

176[.]31[.]51[.]154

51[.]254[.]232[.]56

104[.]18[.]41[.]90

54[.]37[.]218[.]50

172[.]67[.]143[.]200

209[.]251[.]26[.]162

104[.]27[.]154[.]78

172[.]67[.]206[.]116

184[.]168[.]221[.]59

104[.]27[.]155[.]78

104[.]21[.]77[.]94

We’ll continue monitoring the campaign and post updates as soon as new developments take place.

Stay tuned!

No comments:

Post a Comment