Note: This OSINT analysis has been originally published at my current employer’s Web site – https://whoisxmlapi.com where I’m currently acting as a DNS Threat Researcher since January, 2021.
We’ve recently came across to a currently active free VPN domains portfolio which based on ourn research and publicly accessible sources appears to be run and operated by the NSA where the ultimate goal would be to trick users into using these rogue and bogus free VPN service providers in particular Iran-based users where the ultimate goal would be to monitor an eavesdrop on their Internet activities and we’ve decided to take a deeper look inside the Internet-connected infrastructure of these domains and offer practical and relevant threat intelligence and cyber attack attribution details on the true origins of the campaign.
In this case study we’ll offer practical and relevant technical information on the Internet-connected infrastructure of this campaign with the idea to assist the security community on its way to track down and monitor this campaign including to offer actual cyber attack and cyber campaign attribution clues which could come handy to a security researcher or a threat intelligence analyst on their way to track down and monitor the campaign.
Original rogue portfolio of fake VPN service domains courtesy of the NSA:
bluewebx[.]com
bluewebx[.]us
irs1[.]ga
iranianvpn[.]net
IRSV[.]ME
DNSSPEEDY[.]TK
ironvpn[.]tk
ironvpn[.]pw
irgomake[.]win
make-account[.]us
make-account[.]ir
IRANTUNEL[.]COM
JET-VPN[.]COM
newhost[.]ir
homeunix[.]net
vpnmakers[.]com
hidethisip[.]info
uk[.]myfastport[.]com
witopia[.]net
worldserver[.]in
music30ty[.]net
misconfused[.]org
privatetunnel[.]com
aseman-sky[.]in
Related domain registrant email addresses known to have been involved in the campaign:
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]COM
[email protected][.]cz
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
[email protected][.]com
Related domains known to have been involved in the campaign:
gaysexvideo[.]us
keezmovies[.]us
hitporntube[.]com
enjoyfreesex[.]com
allfreesextube[.]com
thegaytubes[.]com
sextubeshop[.]com
pornfetishexxx[.]com
ebonypornox[.]com
freepornpig[.]com
marriagesextube[.]com
searchporntubes[.]com
suckporntube[.]com
darlingmatures[.]com
pornretrotube[.]com
teensexfusion[.]net
rough18[.]us
teendorf[.]us
1retrotube[.]com
typeteam[.]com
biosextube[.]com
hadcoreporntube[.]com
reporntube[.]com
telltake[.]com
asianprivatetube[.]com
hostednude[.]com
alfaporn[.]com
sexbring[.]com
porntubem[.]com
newerotictube[.]com
firstretrotube[.]com
oralsexlove[.]com
1bdsmtubes[.]com
hairytubeporn[.]com
brunettetubex[.]com
tubelatinaporn[.]com
xxxgaytubes[.]com
analxxxvideo[.]com
analsexytube[.]com
aeroxxxtube[.]com
amateurpornlove[.]com
admingay[.]com
xxxretrotube[.]com
xxxshemaletubes[.]com
hotpornstartube[.]com
firsttrannytube[.]com
erotixtubes[.]com
1pornstartube[.]com
1asiantube[.]com
18mpegs[.]com
maturediva[.]com
elitematures[.]com
vipmatures[.]com
pcsextube[.]com
porn-vote[.]com
pornbrunettes[.]com
maturedtube[.]com
alfatubes[.]com
maturetubesexy[.]com
justhairyporn[.]com
hotblowjobporn[.]com
homemadetubez[.]com
homemadexx[.]com
golesbiansex[.]com
fuck-k[.]com
freebdsmxxx[.]com
emeraldporntube[.]com
dosextube[.]com
bigtitslove[.]com
yoursex[.]sexy
tubez[.]sexy
japaneseporn[.]win
hdfuck[.]me
tubelesbianporn[.]com
vipebonytube[.]com
vipamateurtube[.]com
largematuretube[.]com
latinosextube[.]com
xxxhardest[.]com
tubebigtit[.]com
tubesexa[.]com
realfetishtube[.]com
pornways[.]com
Related domains known to have been involved in the campaign:
qhbzkj[.]cn
mmbrbdf[.]cn
daosidanbao[.]cn
txxutmgs[.]cn
sdhsyl[.]cn
butrxmgp[.]cn
aiin[.]com[.]cn
xuxinwuliu[.]cn
qaqbhvnb[.]cn
hnldfm[.]cn
tjtyfs[.]cn
china-sum[.]com
bjyfjh[.]cn
lianstea[.]cn
shufaxuetang[.]cn
wdjjsc[.]cn
hjstory[.]cn
domcc[.]cn
918mzj[.]com
chninvest[.]cn
jfcng[.]com
nksale[.]cn
davidzhu[.]cn
tswfg[.]cn
realpornmovies[.]xyz
freepornosvideo[.]xyz
xxxpornomovies[.]xyz
sexbring[.]com
discountsale[.]xyz
howmanyweeksinayear[.]net
nutridot[.]xyz
doomyaffiliate[.]com
gacha3[.]online
hollybox[.]store
slimevideoyoutube[.]com
gooogle[.]site
vtrpic[.]com
hg301[.]com
pornvv[.]com
voonage[.]com
pornonada[.]com
uscab[.]com
pornoporntube[.]com
beaces[.]com
spaziotorte[.]com
spermix[.]com
eyew[.]com
pornky[.]com
cosmos-nc[.]com
pornlow[.]com
topbridal[.]com
coolporntube[.]com
pornotubevideos[.]com
freshporntv[.]com
pornushkin[.]com
pornodayiz[.]com
fjser[.]com
egreenfusion[.]com
ahbest[.]net
cvm[.]cn
spccsd[.]com
kozw[.]com
finalyearprojects[.]net
ylciyuiw[.]com
ylcimgsm[.]com
ylcddldz[.]com
ylchzhvb[.]com
rhshh[.]cn
ylcksqag[.]com
coodj[.]com
ylckigoa[.]com
qzguangda[.]com
ylcawqoq[.]com
laohe360[.]net
ylcxzlxd[.]com
miracure-bio[.]com
nmhxt[.]com
bjaiweiyi[.]com
hermankardon[.]com
ybcvideo[.]com
vindowsad[.]net
hpimsummit[.]com
wilmassage[.]com
cpfpz[.]com
gaysexvideo[.]us
keezmovies[.]us
ylcaiyay[.]com
lewan123[.]com
tbtmzk[.]com
haigouusa[.]com
ztmzp[.]com
hacctv[.]com
zuikuho[.]com
enping1[.]com
xgfxw[.]com
xzkywx[.]com
alotof-people[.]com
choreographyourhealth[.]us
acwt[.]us
somethinglovely[.]us
onlinestock-investing[.]us
lionheartgallery[.]us
host4bit[.]us
computerpartsdirect[.]us
sjb152[.]com
sjb513[.]com
sjb073[.]com
sjb458[.]com
sjb632[.]com
sjb272[.]com
sjb190[.]com
bighank[.]com
funskip[.]com
funnyjp[.]com
n6i[.]com
forgoodfuture[.]com
dzhfgj[.]cn
wbag[.]com
ceducation[.]cn
ahound[.]com
kenchu[.]net
bigsaks[.]com
7l0[.]com
psichiomega[.]us
blankparkzoo[.]us
ujdah[.]us
my-ask[.]com
yourtutor[.]us
cbdemon[.]us
anweigps[.]cn
szdjt[.]cn
yooyle[.]com[.]cn
maturediva[.]com
ccy-sj[.]com[.]cn
ntdoc[.]cn
024jk[.]cn
cd8888[.]cn
tlmlj[.]cn
bjostore[.]com
lockhan[.]cn
yangqiu[.]cn
bigaq[.]com
szca[.]org[.]cn
cnturtle[.]com[.]cn
gzycdz[.]cn
pdshdzz[.]cn
zhjzzz[.]cn
szms678[.]com[.]cn
taifengzd[.]com
100airport[.]cn
rtchache[.]com
dtcs[.]com[.]cn
szhychem[.]cn
lqqz[.]net
hyfk[.]net
geoer[.]cn
jjzyhhy[.]cn
goroog[.]cn
ey-x[.]com
yabtsf[.]cn
blzyds[.]cn
dgtdzs[.]cn
118km[.]cn
ad-cct[.]com
52huimin[.]com
zeshangze[.]com
0971jz[.]com
scxzt[.]cn
sjzxwg[.]cn
yhyizhneit[.]com
51hikao[.]com
holomovie[.]xyz
alisale[.]xyz
itangv[.]com
qhlqq[.]com
pdsyicheng[.]com
sjb925[.]com
sjb312[.]com
sjb301[.]com
yun034[.]com
zhc240[.]com
youpindaojia[.]cn
We’ll continue monitoring the campaign and post updates as soon as new developments take place
Stay tuned!
*** This is a Security Bloggers Network syndicated blog from Dancho Danchev's Blog – Mind Streams of Information Security Knowledge authored by Dancho Danchev. Read the original post at: http://ddanchev.blogspot.com/2022/01/exposing-currently-active-free-rogue.html
