Exposing a Rogue Domain Portfolio of Fake News Sites - An Analysis
0
In the following analysis I'll offer an URL compilation of fake news sites including additional personally identifiable email address accounts known to have been involved in these campaigns.
hxxp://addustuor[.]com
hxxp://al-jazirah[.]org
hxxp://al-shargh[.]com
hxxp://al-watan[.]co
hxxp://alarabyia[.]org
hxxp://alettehad[.]net
hxxp://aliraq-news[.]com
hxxp://aljlazeera[.]com
hxxp://alryiadh[.]com
hxxp://alwatannewspaper[.]net
hxxp://bbc-arabic[.]com
hxxp://belfercenter[.]net
hxxp://bloomberq[.]com
hxxp://braekingisraelnews[.]com
hxxp://breakingisraelnews[.]net
hxxp://brusslestimes[.]com
hxxp://budapestbaecon[.]com
hxxp://bundesergierung[.]de
hxxp://com-news-world[.]site
hxxp://com-users[.]info
hxxp://dawalhaq[.]com
hxxp://daylisabah[.]com
hxxp://democraticcoalition[.]net
hxxp://elwataannews[.]com
hxxp://emaratallyoum[.]com
hxxp://emaratalyuom[.]com
hxxp://foreignpoilcy[.]com
hxxp://foriegnpolicy[.]net
hxxp://haaaretz[.]com
hxxp://indepnedent[.]co
hxxp://israelhayom[.]net
hxxp://israellinarabic[.]com
hxxp://israelnationalnews[.]co
hxxp://israelnationalnews[.]net
hxxp://jerusaleimonline[.]com
hxxp://lesoir[.]info
hxxp://mesralarabiya[.]com
hxxp://mintpressnevvs[.]com
hxxp://nationalepost[.]com
hxxp://policito[.]com
hxxp://sharjah24[.]co
hxxp://shoruknews[.]com
hxxp://speigel[.]net
hxxp://thaguardian[.]com
hxxp://theatlatnic[.]com
hxxp://theglobeandmail[.]org
hxxp://theguaradian[.]com
hxxp://theheraldscotland[.]com
hxxp://thejerusalempost[.]org
hxxp://timesoffisrael[.]com
hxxp://timesofisraeil[.]com
hxxp://waradena[.]com
hxxp://washnigtonexaminer[.]com
hxxp://xn--aljaeera-4t0d[.]net
hxxp://xn--alnaaregypt-cm8e[.]com
hxxp://xn--arab21-6va[.]com
hxxp://xn--c-wpma[.]com
hxxp://xn--emaraalyoum-1b9e[.]com
hxxp://xn--etik-k54a[.]com
hxxp://xn--frace24-mkb[.]com
hxxp://xn--haarez-m17b[.]com
hxxp://xn--huffngtonpost-69b[.]com
hxxp://xn--israelinarabi-ugb[.]com
hxxp://xn--nationmaser-5b9e[.]com
hxxp://xn--ndependent-77a[.]com
hxxp://xn--plitico-d5b[.]com
hxxp://xn--r-2rm[.]com
hxxp://xn--sraelinarabic-29b[.]com
hxxp://xn--telocal-xt3c[.]com
hxxp://xn--theguardan-4ub[.]com
hxxp://xn--theguardia-dq2e[.]com
hxxp://Xn--wa-exs[.]com
Sample personally identifiable email address accounts known to have been involved in the campaign:
micheal[.]stone@mail[.]ee
scott[.]j[.]watson@mail[.]com
terrymills23@mail[.]com
janeverno@gmail[.]com
ted[.]turner@mail[.]ee
wilson[.]brown[.]flower@mail[.]com
matthew[.]carson@mail[.]ee
jamy[.]corouk@mail[.]com
alex[.]junior[.]1993@mail[.]ee
john[.]edwardtaylor@aol[.]com
fundacionprivacy@protonmail[.]com
akassam3@bloomberg[.]net
andrew[.]breitbart[.]huffingtonpost@mail[.]com
abi[.]aliyev@mail[.]ee
daniel[.]mamishga@mail[.]ee
johnson[.]marry[.]145@yandex[.]com
ckelly11@email[.]com
scottwatson2017@yandex[.]com
barak[.]may[.]1985@gmail[.]com
edward2kerry2@gmail[.]com
gugeky@gmail[.]com
ryan[.]wong86@aol[.]com
ckelly18@mail[.]com
jackson[.]mariani@mail[.]ee
mela[.]eddie@mail[.]ee
PrivateWhoisService@gmail[.]com
Jamal[.]Nasser[.]al[.]Suwaider@aol[.]com
1583926482@qq[.]com
m[.]son1@btclick[.]com
snow48059@gmail[.]com
john[.]p[.]patterson@mail[.]com
luke[.]metcalfe@email[.]com
kern_lali2@aol[.]com
john[.]patterson2@mail[.]com
leonardo[.]snow@mail[.]ee
jack[.]ferdinand@mail[.]ee
About Dancho Danchev
Independent Security Consultancy, Threat Intelligence Analysis (OSINT/Cyber Counter Intelligence) and Competitive Intelligence research on demand. Insightful, unbiased, and client-tailored assessments, neatly communicated in the form of interactive reports - because anticipating the emerging threatscape is what shapes the big picture at the end of the day. Approach me at dancho.danchev@hush.com
0 Comments: