Note: This OSINT analysis has been originally published at my current employer's Web site - https://whoisxmlapi.com where I'm currently acting as a DNS Threat Researcher since January, 2021.
We’ve decided to take a closer look at the Internet-connected infrastructure of the Liberty Front Press Network part of a recent takedown and domain seizure part of an ongoing law enforcement operation fighting online propaganda online and to offer practical and relevant including actionable intelligence on the Internet-connected infrastructure behind the Liberty Front Press Network including the individuals behind it.
In this analysis we’ll take a closer look inside the Internet-connected infrastructure behind the Liberty Front Press Network and offer practical and relevant information including actionable intelligence on its Internet-connected infrastructure including the individuals behind it. Sample screenshot of various related domain name registrations using WhoisXML API’s and Maltego’s Integration
Related domains known to have been currently registered using the same registrant email addresses part of the Liberty Front Press Network Internet-connected infrastructure:
syriact-sy[.]com
darfikr[.]net
aminbaik[.]com
aminelzeintrading[.]com
khamenaei[.]com
shaghaaf[.]com
app-line[.]ir
alzouzougroup[.]com
trustmiddleeast[.]com
raha-travel[.]com
mg-sy[.]com
sinasibsalamat[.]com
ansar-allah[.]com
aletthadnews-iq[.]org
asiaquran[.]com
payamkherad[.]com
alavitile[.]com
mohseny[.]org
farhang-press[.]com
moshaver-sanati[.]ir
nsafari[.]ir
bpaorg[.]com
payamekherad[.]com
goshayesh[.]org
walifaqih[.]com
islamwilayah[.]com
walifaqih[.]info
Related malicious and fraudulent domains known to have been historically registered using the same email addresses:
nilenetonline[.]org
ansaroallah[.]org
hajez-sy[.]info
syriaalhadath[.]org
alwaienews[.]net
syriaalhadath[.]com
alwaght[.]net
alwaienews[.]com
ansaroallah[.]net
ansaroallah[.]info
farhang-press[.]com
navidplast[.]ir
iauaf[.]ir
nsafari[.]ir
sokhanetarikh[.]com
af[.]gl
mohajeronline[.]ir
yosin[.]org
mohajeronline[.]org
afghanistanema[.]ir
iranindia[.]org
imenhost[.]org
iuvmdaily[.]net
iuvmdaily[.]com
arab-now[.]com
aleppospace[.]com
harbi-media[.]com
ehsan-sy[.]org
truemedia-sy[.]com
syria-victory[.]com
scope-photos[.]com
u-roqayya[.]com
aminbaik[.]com
furatorder[.]com
alzouzougroup[.]com
darfikr[.]net
trustmiddleeast[.]net
eset-sy[.]com
darfikr[.]com
syriact-sy[.]com
souqsyria[.]com
alameensupport[.]com
ait-sy[.]com
shaghaaf[.]com
app-line[.]ir
afghanfeed[.]com
atlaspress[.]org
roushd[.]com
haghline[.]com
faryadmag[.]com
barchinews[.]com
pashtunews[.]com
reachpage[.]ir
darinews[.]com
raha-travel[.]com
sinasibsalamat[.]com
walifaqih[.]com
titisan[.]net
hpiiran[.]com
titisan[.]org
walifaqih[.]org
islamwilayah[.]com
mediaadil[.]com
syiahahlilbait[.]com
saintshepherd[.]com
walifaqih[.]info
newsaktual[.]com
hajez-sy[.]com
ansar-allah[.]com
online-traveler[.]com
Sample responding IPs for some of the domains known to have been historically registered using the same email addresses:
5[.]220[.]32[.]26
104[.]31[.]90[.]232
172[.]67[.]218[.]252
185[.]202[.]92[.]26
104[.]21[.]6[.]144
104[.]28[.]15[.]223
104[.]31[.]91[.]232
104[.]27[.]191[.]22
172[.]245[.]14[.]202
172[.]67[.]155[.]39
104[.]27[.]190[.]22
104[.]21[.]11[.]89
104[.]28[.]14[.]223
199[.]59[.]242[.]150
188[.]0[.]245[.]26
172[.]67[.]165[.]178
104[.]18[.]63[.]141
104[.]27[.]174[.]61
104[.]27[.]175[.]61
104[.]31[.]95[.]165
104[.]31[.]94[.]165
95[.]217[.]63[.]156
185[.]88[.]178[.]104
94[.]130[.]129[.]47
95[.]216[.]246[.]232
46[.]166[.]182[.]56
108[.]59[.]12[.]100
198[.]71[.]232[.]3
108[.]61[.]19[.]12
18[.]197[.]248[.]23
199[.]115[.]115[.]102
172[.]93[.]194[.]60
192[.]155[.]108[.]158
199[.]115[.]115[.]119
108[.]59[.]12[.]98
46[.]166[.]182[.]55
52[.]59[.]120[.]70
108[.]59[.]12[.]101
217[.]182[.]208[.]108
5[.]79[.]68[.]109
162[.]210[.]195[.]123
46[.]166[.]182[.]52
63[.]143[.]32[.]94
172[.]93[.]194[.]61
184[.]168[.]221[.]34
108[.]61[.]19[.]13
52[.]11[.]10[.]90
52[.]40[.]118[.]225
44[.]229[.]223[.]74
34[.]211[.]213[.]227
167[.]99[.]26[.]105
185[.]26[.]105[.]244
34[.]208[.]93[.]148
52[.]43[.]21[.]0
52[.]8[.]174[.]68
50[.]112[.]29[.]189
34[.]214[.]135[.]41
50[.]112[.]46[.]4
34[.]211[.]118[.]203
209[.]251[.]26[.]166
172[.]67[.]145[.]166
79[.]143[.]85[.]44
104[.]21[.]73[.]146
88[.]198[.]13[.]86
46[.]4[.]6[.]184
104[.]18[.]40[.]203
104[.]18[.]41[.]203
172[.]67[.]131[.]105
104[.]21[.]4[.]3
138[.]201[.]142[.]150
78[.]47[.]230[.]139
104[.]27[.]154[.]187
172[.]67[.]176[.]84
104[.]27[.]155[.]187
198[.]38[.]82[.]90
127[.]0[.]0[.]1
216[.]104[.]165[.]72
209[.]251[.]26[.]169
172[.]67[.]133[.]177
104[.]21[.]5[.]179
173[.]45[.]114[.]24
104[.]28[.]12[.]91
209[.]251[.]26[.]164
104[.]28[.]13[.]91
104[.]31[.]77[.]253
47[.]91[.]170[.]222
185[.]53[.]177[.]20
104[.]31[.]76[.]253
176[.]9[.]79[.]91
88[.]198[.]56[.]139
104[.]18[.]47[.]243
104[.]18[.]46[.]243
185[.]87[.]187[.]198
52[.]213[.]114[.]86
104[.]28[.]25[.]112
212[.]83[.]172[.]150
104[.]21[.]6[.]168
172[.]67[.]135[.]11
176[.]9[.]29[.]165
104[.]28[.]24[.]112
144[.]91[.]104[.]181
34[.]102[.]136[.]180
62[.]171[.]177[.]42
192[.]64[.]10[.]106
216[.]104[.]165[.]3
216[.]104[.]165[.]2
208[.]67[.]23[.]136
208[.]67[.]23[.]101
34[.]224[.]160[.]149
216[.]104[.]165[.]90
72[.]1[.]32[.]168
162[.]210[.]196[.]167
37[.]48[.]65[.]152
37[.]48[.]65[.]154
37[.]48[.]65[.]155
216[.]104[.]165[.]30
109[.]201[.]135[.]45
104[.]18[.]34[.]105
5[.]79[.]68[.]107
162[.]210[.]196[.]168
199[.]115[.]116[.]216
172[.]98[.]192[.]37
104[.]21[.]88[.]42
37[.]48[.]65[.]153
172[.]67[.]172[.]76
104[.]18[.]35[.]105
172[.]67[.]208[.]182
104[.]24[.]118[.]67
208[.]91[.]197[.]46
104[.]31[.]83[.]28
172[.]67[.]152[.]252
104[.]31[.]82[.]28
104[.]21[.]49[.]222
104[.]24[.]109[.]208
104[.]24[.]108[.]208
199[.]115[.]116[.]162
162[.]210[.]196[.]173
94[.]229[.]72[.]117
104[.]21[.]51[.]133
94[.]229[.]72[.]115
95[.]211[.]187[.]100
162[.]210[.]196[.]171
188[.]165[.]44[.]218
94[.]229[.]72[.]116
104[.]24[.]119[.]67
94[.]229[.]72[.]120
216[.]104[.]165[.]12
162[.]210[.]196[.]172
104[.]28[.]30[.]73
94[.]229[.]72[.]118
172[.]67[.]180[.]160
94[.]229[.]72[.]124
104[.]24[.]97[.]171
94[.]229[.]72[.]123
104[.]24[.]96[.]171
144[.]76[.]32[.]148
104[.]28[.]31[.]73
148[.]251[.]1[.]71
109[.]201[.]135[.]71
185[.]208[.]173[.]3
109[.]201[.]135[.]39
54[.]38[.]220[.]85
96[.]47[.]230[.]67
151[.]106[.]5[.]168
108[.]61[.]19[.]11
192[.]155[.]108[.]153
162[.]210[.]196[.]166
109[.]201[.]135[.]46
151[.]106[.]5[.]173
192[.]155[.]108[.]156
151[.]106[.]5[.]165
192[.]155[.]108[.]150
151[.]106[.]5[.]164
104[.]21[.]32[.]133
172[.]67[.]152[.]55
172[.]67[.]187[.]82
104[.]21[.]72[.]204
104[.]27[.]149[.]153
104[.]27[.]148[.]153
207[.]244[.]67[.]218
208[.]67[.]16[.]254
151[.]106[.]5[.]169
192[.]155[.]108[.]152
37[.]48[.]65[.]149
151[.]106[.]5[.]170
151[.]106[.]5[.]167
192[.]155[.]108[.]151
151[.]106[.]5[.]163
37[.]48[.]65[.]150
192[.]155[.]108[.]149
192[.]155[.]108[.]154
37[.]48[.]65[.]151
192[.]155[.]108[.]147
151[.]106[.]5[.]166
151[.]106[.]5[.]174
209[.]99[.]40[.]222
156[.]67[.]211[.]180
213[.]247[.]47[.]190
104[.]31[.]82[.]19
104[.]31[.]83[.]19
104[.]247[.]81[.]10
34[.]98[.]99[.]30
173[.]239[.]8[.]164
173[.]239[.]5[.]6
46[.]166[.]184[.]102
104[.]247[.]82[.]10
91[.]195[.]240[.]117
176[.]9[.]85[.]197
185[.]53[.]179[.]7
185[.]206[.]180[.]123
185[.]53[.]178[.]10
192[.]99[.]147[.]163
107[.]150[.]52[.]242
104[.]21[.]40[.]221
104[.]18[.]49[.]253
174[.]120[.]70[.]159
172[.]67[.]157[.]38
151[.]106[.]5[.]172
208[.]67[.]23[.]31
104[.]18[.]48[.]253
192[.]155[.]108[.]157
104[.]21[.]6[.]160
66[.]152[.]163[.]75
104[.]28[.]9[.]112
172[.]67[.]135[.]3
209[.]99[.]40[.]220
192[.]155[.]108[.]155
49[.]128[.]177[.]81
156[.]67[.]211[.]189
207[.]244[.]67[.]138
109[.]201[.]135[.]65
37[.]48[.]65[.]148
104[.]28[.]8[.]112
5[.]79[.]68[.]110
104[.]28[.]21[.]230
104[.]27[.]177[.]28
172[.]67[.]154[.]209
172[.]67[.]218[.]104
208[.]67[.]23[.]36
104[.]27[.]176[.]28
104[.]21[.]6[.]86
104[.]31[.]66[.]144
104[.]21[.]10[.]32
104[.]28[.]20[.]230
172[.]67[.]189[.]225
51[.]89[.]88[.]96
104[.]31[.]67[.]144
69[.]172[.]201[.]153
69[.]172[.]201[.]208
46[.]166[.]184[.]104
52[.]128[.]23[.]153
78[.]46[.]102[.]123
176[.]9[.]43[.]40
173[.]208[.]153[.]250
174[.]128[.]248[.]231
149[.]56[.]147[.]39
88[.]198[.]48[.]179
144[.]76[.]140[.]66
150[.]95[.]255[.]38
184[.]168[.]221[.]43
104[.]28[.]15[.]51
104[.]28[.]14[.]51
202[.]150[.]213[.]60
156[.]67[.]209[.]15
85[.]159[.]233[.]35
192[.]155[.]108[.]148
104[.]27[.]130[.]254
104[.]31[.]94[.]4
154[.]92[.]251[.]72
104[.]27[.]131[.]254
104[.]21[.]75[.]92
104[.]27[.]146[.]35
104[.]21[.]39[.]77
104[.]27[.]147[.]35
85[.]159[.]233[.]60
104[.]237[.]196[.]117
207[.]244[.]67[.]214
104[.]24[.]118[.]189
104[.]24[.]119[.]189
104[.]18[.]40[.]90
5[.]9[.]96[.]104
136[.]243[.]19[.]6
95[.]216[.]77[.]5
192[.]99[.]92[.]2
172[.]67[.]217[.]163
176[.]31[.]51[.]154
51[.]254[.]232[.]56
104[.]18[.]41[.]90
54[.]37[.]218[.]50
172[.]67[.]143[.]200
209[.]251[.]26[.]162
104[.]27[.]154[.]78
172[.]67[.]206[.]116
184[.]168[.]221[.]59
104[.]27[.]155[.]78
104[.]21[.]77[.]94
We’ll continue monitoring the campaign and post updates as soon as new developments take place.
Stay tuned!
No comments:
Post a Comment