-
-
Notifications
You must be signed in to change notification settings - Fork 10
/
Copy pathcia-2010-covert-communication-websites.bigb
8410 lines (7294 loc) · 387 KB
/
cia-2010-covert-communication-websites.bigb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
= CIA 2010 covert communication websites
{c}
{scope}
{tag=Ciro Santilli's naughty projects}
{tag=Ciro Santilli's data projects}
{tag=Open-source intelligence}
{tag=Digital preservation}
{title2=Iran, China}
This article is about <cutout (espionage)>[covert agent communication channel] websites used by the <CIA> in many countries from the late 2000s until the early 2010s, when they were uncovered by <counter intelligence> of the targeted countries circa 2011-2013. This discovery led to the imprisonment and execution of several assets in <Iran> and <China>, and subsequent shutdown of the channel.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/CIA_Star_Wars_website_promo.jpg]
{height=700}
\Video[https://www.youtube.com/watch?v=TFfuzZC5Qpc]
{title=How I found a <Star Wars> website made by the <CIA> by <Ciro Santilli>}
{description=Slightly edited VOD of the talk <Aratu Week 2024 Talk by Ciro Santilli>.}
{height=600}
The existence of such websites was first reported in November 2018 by Yahoo News: https://www.yahoo.com/video/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html[].
Previous whispers had been heard in 2017 but without clear mention of websites: https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html[]:
> Some were convinced that a mole within the C.I.A. had betrayed the United States. Others believed that the Chinese had hacked the covert system the C.I.A. used to communicate with its foreign sources. Years later, that debate remains unresolved.
\[...\]
From the final weeks of 2010 through the end of 2012, \[...\] the Chinese killed at least a dozen of the <CIA>[C.I.A.]’s sources. \[...\] One was shot in front of his colleagues in the courtyard of a government building — a message to others who might have been working for the C.I.A.
Most notably, starting in 2008, CIA contractor John Reidy started raising concerns about the security of the communication systems used, but he was silenced and ignored, leading to catastrophe.https://responsiblestatecraft.org/2022/10/18/the-cias-hypocrisy-on-sources-and-methods/{ref}https://digitaledition.chicagotribune.com/tribune/article_popover.aspx?guid=004be77e-70ef-414e-aac2-c431a2962844{ref}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/Yahoo_CIA_website_article.png]
{height=900}
Then in September 2022 a few specific websites were finally reported by Reuters: https://www.reuters.com/investigates/special-report/usa-spies-iran/[], henceforth known only as "the <Reuters article>" in this article.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/Reuters_CIA_website_article_banner.jpg]
{title=Banner of the <Reuters article>}
{height=800}
{source=https://www.reuters.com/investigates/special-report/usa-spies-iran/}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/www.reuters.com_investigates_special-report_usa-spies-iran_applet_reconstruction.jpg]
{title=Reuters reconstruction of what the applet would have looked like}
{height=850}
{source=https://www.reuters.com/investigates/special-report/usa-spies-iran/}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/Reuters_CIA_website_article_image_urls_arrow.jpg]
{title=Inspecting the <Reuters article> HTML source code}
{description=The <Reuters article> only gave one URL explicitly: <iraniangoals.com>. But most others could be found by inspecting the HTML of the screenshots provided, except for <Searching for Carson>[the Carson website].}
{height=600}
{source=https://www.reuters.com/investigates/special-report/usa-spies-iran/}
<Ciro Santilli> heard about the 2018 article at around 2020 while <Ciro Santilli's campaign for freedom of speech in China>[studying for his China campaign] because the websites had been used to take down the Chinese CIA network in China. He even asked on <Quora>: https://www.quora.com/What-were-some-examples-of-the-websites-that-the-CIA-used-around-2010-as-a-communication-mechanism-for-its-spies-in-China-and-Iran-but-were-later-found-and-used-to-take-down-their-spy-networks[] but there were no publicly known domains at the time to serve as a starting point. https://www.quora.com/profile/Chris-2110[Chris, Electrical Engineer and former Avionics Tech in the US Navy], even replied suggesting that obviously the <CIA> is so competent that it would never ever have its sites leaked like that:
> Seriously a dumb question.
So when <Ciro Santilli> heard about the 2022 article almost a year after publication, and being a <OurBigBook.com>[half-arsed web developer himself], he <Ciro Santilli's naughty projects>[knew he had to try] and find some of the domains himself using the newly available information! It was an irresistible real-life <capture the flag (cybersecurity)>. The thing is, everyone who has ever developed a website knows that its <attack surface> is about the <Size of Texas meme>[size of Texas], and the potential for <fingerprinting (cybersecurity)> is off the charts with so many bits and pieces sticking out. Chris, get fucked.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/CIA_2010_site_Quora_question_and_Chris_answer.png]
{title="Seriously a dumb question" <Quora> answer by Chris from the <US Navy>}
{height=550}
{source=https://www.quora.com/What-were-some-examples-of-the-websites-that-the-CIA-used-around-2010-as-a-communication-mechanism-for-its-spies-in-China-and-Iran-but-were-later-found-and-used-to-take-down-their-spy-networks/answer/Chris-2110}
In particular, it is fun to have such a clear and visible to anyone examples of the <USA spying on its own allies> in the form of <Wayback Machine> archives.
Given that it was reported that there were "more than 350" such websites, it would be really cool if we could uncover more of those websites ourselves beyond the 9 domains reported by Reuters!
This article documents the list of extremely likely candidates Ciro has found so far, mostly using:
* rudimentary IP range search on https://viewdns.info[] starting from the websites reported by Reuters
* heuristic search for keywords in domains of the <2013 DNS Census> plus <Wayback Machine CDX scanning>
more details on methods also follow. It is still far from the https://citizenlab.ca/2022/09/statement-on-the-fatal-flaws-found-in-a-defunct-cia-covert-communications-system/[885 websites reported by citizenlabs], so there must be key techniques missing. But the fact that there are no <Google Search> hits for the domains or IPs (except in bulk e.g. in <expired domain trackers>) indicates that these might not have been previously clearly publicly disclosed.
If anyone can find others, or has better techniques: <contact>{full}. The techniques used so far have been very heuristic, and that added to the limited amount of data makes it almost certain that several <IP range search>[IP ranges] have been missed. There are two types of contributions that would be possible:
* finding new IP ranges: harder more exiting, and potentially requires more intelligence
* better IP to domain name databases to <Find missing hits in IP ranges>[fill in known gaps in existing IP ranges]
Perhaps the current heuristically obtained data can serve as a good starting for a more data-oriented search that will eventually find a valuable fingerprint which brings the entire network out.
Disclaimer: the network fell in 2013, followed by fully public disclosures in 2018 and 2022, so we believe it is now more than safe for the public to know what can still be uncovered about the events that took place. The main author's political bias is <Ciro Santilli's campaign for freedom of speech in China>[strongly pro-democracy and anti-dictatorship].
May this list serve as a tribute to those who spent their days making, using, and uncovering these websites under the shadows.
If you want to go into one of the best <OSINT> <capture the flag (cybersecurity)>[CTFs] of your life, stop reading now and see how many Web Archives you can find starting only from the <Reuters article> as Ciro did. Some guidelines:
* there was no ultra-clean fingerprint found yet. Some intuitive and somewhat guessy data analysis was needed. But when you clean the data correctly and make good guesses, many hits follow, it feels so good
* nothing was paid for data. But using cybercafe <Wifi>'s for a few extra IPs may help.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/viewdns.info_activegameinfo.com_domain_to_IP_arrow.png]
{title=<viewdns.info> `activegameinfo.com` domain to IP}
{height=550}
{source=https://viewdns.info/iphistory/?domain=activegaminginfo.com}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/viewdns.info_aroundthemiddleeast.com_IP_to_domain_arrow.png]
{title=<viewdns.info> `aroundthemiddleeast.com` IP to domain}
{height=550}
{source=https://viewdns.info/reverseip/?host=66.175.106.140&t=1}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/dnscensus2013.neocities.org.png]
{title=<DNS Census 2013> website}
{description=
This source provided valuable historical domain to IP data. It was likely extracted with an illegal <botnet>. Data excerpt from the CSVs:
``
amazon.com,2012-02-01T21:33:36,72.21.194.1
amazon.com,2012-02-01T21:33:36,72.21.211.176
amazon.com,2013-10-02T19:03:39,72.21.194.212
amazon.com,2013-10-02T19:03:39,72.21.215.232
amazon.com.au,2012-02-10T08:03:38,207.171.166.22
amazon.com.au,2012-02-10T08:03:38,72.21.206.80
google.com,2012-01-28T05:33:40,74.125.159.103
google.com,2012-01-28T05:33:40,74.125.159.104
google.com,2013-10-02T19:02:35,74.125.239.41
google.com,2013-10-02T19:02:35,74.125.239.46
``
}
{height=574}
{source=https://dnscensus2013.neocities.org/}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-website-comms-methods.png]
{title=The four <communication mechanisms> used by the CIA websites}
{description=<Java> Applets, <Adobe Flash>, <JavaScript> and <HTTPS>}
{height=800}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/archive-tabs.png]
{title=You can never have enough <Wayback Machine> tabs open}
{description=This is how the end of the fingerprint pipeline looks like: as many tabs as you have the patience to go through one by one!}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/github.com_cirosantilli_expired-domain-names-by-day-2011.png]
{title=Expired domain names by day 2011}
{description=The scraping of <expired domain trackers> to Github was one of the positive outcomes of this project.}
{height=850}
{source=https://github.com/cirosantilli/expired-domain-names-by-day-2011}
\Video[https://www.youtube.com/watch?v=uh_q02eefFM]
{title=Compromised Comms by Darknet Diaries (2023)}
{description=
It was the <YouTube> suggestion for this video that made <Ciro Santilli> aware of the <Reuters article> almost one year after its publication, which kickstarted his research on the topic.
Full podcast transcript: https://darknetdiaries.com/transcript/75/
https://x.com/cirosantilli/status/1900278353065894324[Ciro Santilli pinged the Podcast's host Jack Rhysider on Twitter] and he ACK'ed which is cool, though he was skeptical about the strength of the fingerprints found, and didn't reply when clarification was offered. Perhaps the material is just not impactful enough for him to produce any new content based on it. Or also perhaps it comes too close to <sources and methods> for his own good as a presumably American citizen.
}
= Results
{parent=CIA 2010 covert communication websites}
= Selected screenshots
{parent=Results}
This section contains some of the most interesting and a few representative screenshots of the websites found.
We intentionally omit the screenshots already reported by the <Reuters article>.
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/starwarsweb.net.jpg]
{title=2010 <Wayback Machine> archive of https://web.archive.org/web/20101230033220/http://starwarsweb.net/[starwarsweb.net]}
{description=
The <Star Wars> one. Clearly branded websites like this are rare, which makes finding them all the much more fun. The <Reuters article> had two of them (<Searching for Carson>[Carson] and rastadirect.net), so these were probably manually selected from the full hit dataset, and did not serve specifically as entry points. Most of the websites are quite boring and forgetful as you'd expect.
The subtitle "Beyond The Unknown" may be a reference to the https://starwars.fandom.com/wiki/Unknown_Regions[Unknown Regions], an unexplored area of the galaxy in the Star Wars fictional universe.
\Image[https://web.archive.org/web/20250312060328if_/https://media.gettyimages.com/id/172984439/photo/little-jedi.jpg?s=2048x2048&w=gi&k=20&c=vKTUlTKpYtPcL8wQobbZMQEhU1CZefV7VlXxDExqZn8=]
{title=Stock photo of a Jedi boy from Getty Images used on https://web.archive.org/web/20101230033220/http://starwarsweb.net/[starwarsweb.net]}
{description=
The photo can still be licensed today as of 2025: https://www.gettyimages.co.uk/detail/photo/little-jedi-royalty-free-image/172984439[]. We found it by https://www.gettyimages.co.uk/search/2/image?phrase=jedi%20boy&sort=best&license=rf%2Crm[searching for "jedi boy" on gettyimages.co.uk]. The photo is credited to a `madisonwi`, presumably an alias based on the location <#Madison, Wisconsin>. Here's a random website about adoption that uses it: https://www.adoptionadvocates.net/star-wars-adoption-language/ and where it can be seen without the watermarks.
The droids can be seen e.g. at: https://www.amazon.co.uk/04-Kampf-Droiden-Superheftig-Jedi/dp/B004TINSW6[], a promotional material for a 2008 The Clone Wars television series audio CD and available as transparent PNGs without background in several sources. The Yoda art also seems to come from that show: https://rpggamer.org/page.php?page=4229[]. One can picture the contractor's children watching that show when a lightbulb popped over their heads.
}
{source=https://www.gettyimages.co.uk/detail/photo/little-jedi-royalty-free-image/172984439}
}
{height=1400}
\Image[https://github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/screenshots/alljohnny.com-2011.jpg?raw=true]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110207134126/http://alljohnny.com/[alljohnny.com]}
{description=Although alljohnny.com is one of the original <Reuters examples>, we are highlighting this screenshot here because the Reuters provided screenshot is from the extremely early https://web.archive.org/web/20040113025122/http://alljohnny.com/[2004 version of the site], and it is interesting to see how this unique example was later updated in this 2011 version, the only known such case so far. The lack of OPSEC awareness is mind blowing, them reusing a domain like that after so many years in a completely new threat environment and possibly for a new asset.}
{height=715}
{source=https://web.archive.org/web/20040113025122/http://alljohnny.com/}
\Image[https://github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/screenshots/webofcheer.com-scroll.jpg?raw=true]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110207150839/http://webofcheer.com/[webofcheer.com] scrolled to show Johnny Carson}
{description=This website is a fansite for various comedians. It is the second known reference to Johnny Carson after <Searching for Carson>[alljohnny.com], which was one of the original screenshots given in the <Reuters article>. There must have been some massive Johnny Carson fan among the CIA contractors a that time!}
{height=820}
{source=https://web.archive.org/web/20040113025122/http://alljohnny.com/}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/iranfootballsource.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110202091611/http://iranfootballsource.com/[iranfootballsource.com]}
{description=
The third Iranian football on top of the two other <The Reuters websites>[published by Reuters]: iraniangoalkicks.com and iraniangoals.com! Admittedly, this one is the most generic and less well designed one. But still. They pushed the theme too far!
The goalkeeper can be seen at: https://www.pixtastock.com/illustration/7323632[].
}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/www.dedrickonline.com.jpg]
{title=2010 <Wayback Machine> archive of https://web.archive.org/web/20101211095158/http://www.dedrickonline.com/[dedrickonline.com]}
{description=
The <German> one.
The CIA has had a few Germany espionage scandals in the 2010s:
* 2014 https://www.bbc.co.uk/news/world-europe-28243933[]: a German Intelligence Agency agent was arrested for spying for the CIA
* 2021 https://www.reuters.com/world/europe/us-security-agency-spied-merkel-other-top-european-officials-through-danish-2021-05-30/ U.S. spied on Merkel and other Europeans through Danish cables
* 2020 https://www.dw.com/en/how-the-uss-cia-and-germanys-bnd-spied-on-world-leaders/a-52358527 it was revealed that Germany and the USA had an agreement to spy on world leaders, notably via compromised Swiss company Crypto AG
}
{height=1600}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/lesummumdelafinance.com.jpg]
{title=2010 <Wayback Machine> archive of https://web.archive.org/web/20100514032916/http://lesummumdelafinance.com[lesummumdelafinance.com]}
{description=
A <French> one. Because it mentions VTT (Mountain Biking in French), it must focus France.
The arrow graph is very popular can be seen at: https://www.financialexpress.com/money/top-4-global-market-risks-for-2024-that-may-impact-your-finances-3346284/[] and many other sites. Source unknown.
}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/attivitaestremi.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110128162039/http://attivitaestremi.com/[attivitaestremi.com]}
{description=An <Italian> one about extreme sports.}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/noticiasmusica.net.jpg]
{title=2010 <Wayback Machine> archive of https://web.archive.org/web/20101230165001/http://noticiasmusica.net/[noticiasmusica.net]}
{description=
The <Brazilian> one.
In 2013 https://en.wikipedia.org/wiki/Glenn_Greenwald[Glen Greenwald] claimed that https://g1.globo.com/mundo/noticia/2013/07/vigilancia-dos-eua-ao-brasil-e-ponte-para-outros-paises-diz-jornalista.html[the espionage in Brazil was merely a bridge to other countries of interest such as China and Iran]
}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/economicnewsbuzz.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110207210053/http://economicnewsbuzz.com/[economicnewsbuzz.com]}
{description=The Korean one. Love the https://en.wikipedia.org/wiki/Kawaii[kawaii] style!}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/snapnewsfront.net.jpg]
{title=
2011 <Wayback Machine> archive of https://web.archive.org/web/20110107022935/http://snapnewsfront.net/[snapnewsfront.net]}
{description=The <Japanese> one.
The geisha can be seen at: https://www.shutterstock.com/image-vector/pretty-geisha-16813348[] by Larisa Frelke, assumed accounts: https://x.com/larra_vit | https://www.xing.com/profile/Larisa_Frelke
}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/philippinenewsonline.net.jpg]
{title=2010 <Wayback Machine> archive of https://web.archive.org/web/20101230191405/http://philippinenewsonline.net/[philippinenewsonline.net]}
{description=The Philippine one one.}
{height=1400}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/feedsdemexicoyelmundo.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110202190838/http://feedsdemexicoyelmundo.com/[feedsdemexicoyelmundo.com]}
{description=The Mexican one.}
{height=800}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/www.easytraveleurope.com.jpg]
{title=2012 <Wayback Machine> archive of https://web.archive.org/web/20120218052121/http://www.easytraveleurope.com/[easytraveleurope.com]}
{height=800}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/tee-shot.net.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110107045521/http://tee-shot.net[tee-shot.net]}
{description=One of the many golf-themed sites. Golf appears to be quite popular over in Langley. It's exactly what you'd expect for a mid-level spook to do in their free time!}
{height=900}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/nouvellesetdesrapports.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110128173433/http://nouvellesetdesrapports.com/[nouvellesetdesrapports.com]}
{height=900}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/pangawana.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110203201604/http://pangawana.com/[pangawana.com]}
{height=800}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/recuerdosdeviajeonline.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110202124633/http://recuerdosdeviajeonline.com/[recuerdosdeviajeonline.com]}
{height=1000}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/theworld-news.net.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20101226182928/http://theworld-news.net/[theworld-news.net]}
{height=800}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/www.kessingerssportsnews.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20100520013854/http://www.kessingerssportsnews.com/[kessingerssportsnews.com]}
{height=800}
\Image[https://raw.githubusercontent.com/cirosantilli/media/master/cia-2010-covert-communication-websites/screenshots/negativeaperture.com.jpg]
{title=2011 <Wayback Machine> archive of https://web.archive.org/web/20110207202401/http://negativeaperture.com/[negativeaperture.com]}
{height=1300}
= USA spying on its own allies
{c}
{parent=Results}
Being <Brazilian>, <Ciro Santilli> is particularly curious about the existence of a Brazilian-focused website one mentioned in the article, as well as in other <democracies>.
WTF the <CIA> was doing in Brazil in the early 2010s! Wasn't helping to install the <Military dictatorship in Brazil> enough!
Here are the democracies found so far, defining a democracy as a country with score 7.0 or more in the https://graphics.eiu.com/PDF/Democracy_Index_2010_web.pdf[Democracy index 2010]. In native language:
* <France> (6: http://cqcounter.com/whois/www/affairesdumonde.com.html[affairesdumonde.com], https://web.archive.org/web/20110203080503/http://guide-daventure.com/[guide-daventure.com], https://web.archive.org/web/20100514032916/http://lesummumdelafinance.com/[lesummumdelafinance.com], https://web.archive.org/web/20101015050644/http://football-de-luxe.com/[football-de-luxe.com], http://cqcounter.com/whois/www/romulusactualites.com.html[romulusactualites.com], https://web.archive.org/web/20110128111638/http://suparakuvi.com/[suparakuvi.com])
* <Germany>(2: https://web.archive.org/web/20101211095158/http://www.dedrickonline.com/[dedrickonline.com], https://web.archive.org/web/20100109023107/http://www.neighbour-news.com/[neighbour-news.com])
* <Italy> (2: https://web.archive.org/web/20110128162039/http://attivitaestremi.com/[attivitaestremi.com], https://web.archive.org/web/20110424044637/http://www.garanziadellasicurezza.com:80/[garanziadellasicurezza.com], https://web.archive.org/web/20101009032531/http://podisticamondiale.com/[podisticamondiale.com])
* <Spain> (3: https://web.archive.org/web/20110210112553/http://armashoy.com/[armashoy.com], https://web.archive.org/web/20120429042725/http://montanismoaventura.com/[montanismoaventura.com], http://cqcounter.com/whois/www/ordenpolicial.com.html[ordenpolicial.com])
* <Brazil> (2: https://web.archive.org/web/20101230165001/http://noticiasmusica.net/[noticiasmusica.net], http://cqcounter.com/whois/www/vejaaeuropa.com.html[vejaaeuropa.com])
* South Korea (1: https://web.archive.org/web/20110207210053/http://economicnewsbuzz.com/[economicnewsbuzz.com])
* Poland (1: https://web.archive.org/web/20101229154411/http://boxingstop.net[boxingstop.net])
In English, so more deniable:
* <Japan> (1: https://web.archive.org/web/20110107022935/http://snapnewsfront.net/[snapnewsfront.net])
* <Canada> (2: https://web.archive.org/web/20100512125752/http://kanata-news.com/[kanata-news.com], https://web.archive.org/web/20110208211139/http://mynewscheck.com/[mynewscheck.com])
* Philippines (1: https://web.archive.org/web/20101229100006/http://half-court.net/[half-court.net])
* <India> (1: https://web.archive.org/web/20110208032707/http://amishkanews.com/[amishkanews.com])
"Almost democracies":
* Croatia (2: http://cqcounter.com/whois/www/european-footballer.com.html[european-footballer.com], https://web.archive.org/web/20110207151935/http://stara-turistick.com/[stara-turistick.com])
* Thailand (1: https://web.archive.org/web/20110202143130/http://thefairwaysaregreen.com/[thefairwaysaregreen.com])
* Peru (1: https://web.archive.org/web/20110207112452/http://todosperuahora.com/[todosperuahora.com])
Ciro couldn't help but feel as if looking through the Eyes of <Sauron> himself!
It is worth noting that democracies represent just a small minority of the websites found. The Middle East, and Spanish language sites (presumably for Venezuela + war on drugs countries?) where the huge majority. But <Americans> have to understand that https://cirosantilli.com/china-dictatorship/dictatorships-tend-to-work-together[democracies have to work together and build mutual trust, and not spy on one another]. Even some of the enlightened people from <Hacker News> seem https://news.ycombinator.com/item?id=36279768[to not grasp this point]. The <USA> cannot single handedly maintain world order as it once could. Collaboration based on trust is the only way.
<Snowden>'s 2013 revelations particularly shocked USA allies with the fact that they were being spied upon, and as of the 2020's, everybody knows this and has "stopped caring", and or moved to <end-to-end encryption> by default. This is beautifully illustrated in the <Snowden (film)> when Snowden talks about his time in <Japan> working for <Dell> as an undercover <NSA> operative:
> <NSA> wanted to impress the <Japanese>. Show them our reach. They loved the live video from drones. This is <Pakistan> right now \[video shows CIA agents demonstrating drone footage to Japanese officials\]. They were not as excited about that we wanted their help to spy on the Japanese population. They said it was against their laws.
We bugged the country anyway, of course.
And we did not stop there. Once we had their communications we continued with the physical infrastructure. We sneaked into small programs in their power grids, dams, hospitals. The idea was that if Japan one day was not our allies we could turn off the lights.
And it was not just Japan. We planted software in <Mexico>, <Germany>, <Brazil>, Austria.
<China>, I can understand. Or <Russia> or <Iran>. Venezuela, okay.
But Austria? \[shows footage of <cow> on an idyllic <Alpine> mountain grazing field, suggesting that there is nothing in Austria to spy on\]
Another noteworthy scene from that movie is <video Aptitude test scene from the Snowden 2016 film>, where a bunch of new <CIA> recruits are told that:
> Each of you is going to build a covert communications network in your home city \[i.e. their fictitious foreign target location written on each person's desk, not necessarily where they were actually born\], you're going to deploy it, backup your site, destroy it, and restore it again.
= List of websites
{parent=Results}
As a <JSON>: https://github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/hits.json[]. <OurBigBook Markup> to <JSON> conversion helper \a[cia-2010-covert-communication-websites/bigb-to-json]:
``
cia-2010-covert-communication-websites/bigb-to-json cia-2010-covert-communication-websites.bigb
``
and new results that have been added to the list below can automatically be merged with \a[cia-2010-covert-communication-websites/bigb-to-json-merge]:
``
cia-2010-covert-communication-websites/bigb-to-json-merge > tmp.json
mv tmp.json ../media/cia-2010-covert-communication-websites/hits.json
``
The main criteria to consider a website as a hit is for it to have a <Wayback Machine> archive with an archived <communication mechanism>. <JS comms> are always quickly visually inspected, other mechanisms we look only at filename patterns for now. We also consider as hits websites that don't have archived comms (often the case for <CGI comms> but which have two ore more of the following supporting evidence:
* shares an IP range with other website
* a Wayback Machine archive or <cqcounter> screenshot strongly confirming visual style
* an archived broken link to the possible comms
Commented edge cases that didn't make the cut can be found mostly under <IP range search>{full} and <2013 DNS Census virtual host cleanup heuristic keyword searches>{full}.
|| ip
|| domain
|| <Wayback Machine>
|| language
|| country mentions
|| comms
|| theme
|| notes
| <Hits without nearby IP hits>[?]
| 24hoursprimenews.com
| https://web.archive.org/web/20090628052814/http://www.24hoursprimenews.com/[2009]
| English
|
| https://web.archive.org/web/20110128180323/http://24hoursprimenews.com/stories.jar[JAR]
| news
| split imageshttps://web.archive.org/web/20110128180410/http://24hoursprimenews.com/images/index_01.jpg{ref}https://web.archive.org/web/20110128180311/http://24hoursprimenews.com/images/index_02.jpg{ref}
| <Hits without nearby IP hits>[?]
| cyhiraeth-intlnews.com
| https://web.archive.org/web/20110129052403/http://www.cyhiraeth-intlnews.com/[2011]
| English
|
| https://web.archive.org/web/20110129052501/http://www.cyhiraeth-intlnews.com/cyber.jar[JAR]
| news
| https://en.wikipedia.org/wiki/Cyhyraeth "The cyhyraeth is a ghostly spirit in Welsh mythology, a disembodied moaning voice that sounds before a person's death." WTF! So the serious looking black actress lady is meant to represent the voice of death?. Split imageshttps://web.archive.org/web/20110129052434/http://www.cyhiraeth-intlnews.com/images/index_02.jpg{ref}https://web.archive.org/web/20110129052457/http://www.cyhiraeth-intlnews.com/images/index_03.jpg{ref}. `rss-items`. Here she is on Getty Images: https://www.istockphoto.com/photo/natural-style-for-the-individual-gm171403107-26684547 by Urilux
| <Hits without nearby IP hits>[?]
| dailynewsandsports.com
| https://web.archive.org/web/20130526130749/http://dailynewsandsports.com/[2013]
| English
|
| https://web.archive.org/web/20130823154922/http://dailynewsandsports.com/testmeter.jar[JAR]
| sports
|
| <Hits without nearby IP hits>[?]
| differentviewtoday.com
| https://web.archive.org/web/20110202185635/http://differentviewtoday.com/[2011]
| English
|
| https://web.archive.org/web/20110202185659/http://differentviewtoday.com/bwm.jar[JAR]
| news
| split images, JAR unarchived
| <Hits without nearby IP hits>[?]
| euronewsonline.net
| https://web.archive.org/web/20100206221718/http://euronewsonline.net/[2010]
| English
|
| https://web.archive.org/web/20130828000000*/http://euronewsonline.net/papers.jar[JAR]
| news
| a.newslink. The image of the woman reading newspapers reverse searches to https://www.istockphoto.com/photo/news-gm101581053-7410445[], iStock from Getty images
| <Hits without nearby IP hits>[?]
| europeannewsflash.com
| https://web.archive.org/web/20110201191814/http://europeannewsflash.com/[2011]
| English
|
| https://web.archive.org/web/20110201192135/http://europeannewsflash.com/users.jar[JAR]
| news
| Split imageshttps://web.archive.org/web/20110201192154/http://europeannewsflash.com/images/index_01.jpg{ref}https://web.archive.org/web/20110201192122/http://europeannewsflash.com/images/index_02.jpg{ref}
| <Hits without nearby IP hits>[?]
| farsi-newsandweather.com
| https://web.archive.org/web/20110202122304/http://farsi-newsandweather.com/[2011]
| Farsi
| Iran
| https://web.archive.org/web/20110202122354/http://farsi-newsandweather.com/steps.jar[JAR]
| news
| split imageshttps://web.archive.org/web/20110202122343/http://farsi-newsandweather.com/images/banner_01.jpg{ref}https://web.archive.org/web/20110202122347/http://farsi-newsandweather.com/images/banner_02.jpg{ref}
| <Hits without nearby IP hits>[?]
| financecentraltoday.com
| https://web.archive.org/web/20110203041325/http://financecentraltoday.com/[2011]
| English
|
| https://web.archive.org/web/20110203041347/http://financecentraltoday.com/report.jar[JAR]
| news, finance
| unusual `td > p > strong` article list. Copyright 2008.
| <Hits without nearby IP hits>[?]
| firstnewssource.com
| https://web.archive.org/web/20110203072201/http://firstnewssource.com/[2011]
| Farsi
| Iran
| http://web.archive.org/web/20110203072529/http://firstnewssource.com/btools.jar[JAR]
| news
| Copyright 2009. Split images. `rss-items`.
| <Hits without nearby IP hits>[?]
| global-view-news.com
| https://web.archive.org/web/20110201100028/http://global-view-news.com/[2011]
| English
|
| https://web.archive.org/web/20110201100059/http://global-view-news.com/ticker.jar[JAR]
| news
| split imageshttps://web.archive.org/web/20110201100034/http://global-view-news.com/images/banner_01.jpg{ref}https://web.archive.org/web/20110201100045/http://global-view-news.com/images/banner_02.jpg{ref}
| <Hits without nearby IP hits>[?]
| globaltourist.net
| https://web.archive.org/web/20101024140137/http://globaltourist.net/[2010]
| English
|
| https://web.archive.org/web/20101229090929/http://globaltourist.net/speed.jar[JAR]
| travel
| split imageshttps://web.archive.org/web/20101229090818/http://globaltourist.net/images/index_01.jpg{ref}https://web.archive.org/web/20101229090840/http://globaltourist.net/images/index_04.jpg{ref}, `rss-items`. speed.jar "speed test" JAR pattern. Seems to have been legit both before.
| <Hits without nearby IP hits>[?]
| hassannews.net
| https://web.archive.org/web/20101230175152/http://www.hassannews.net/[2010]
| Arabic
|
| https://web.archive.org/web/20101230175424/http://www.hassannews.net/hassannews.swf[SWF]
| news
| CSS or archive quite broken. Split imageshttps://web.archive.org/web/20101230175417/http://www.hassannews.net/images/aa_05.jpg{ref}https://web.archive.org/web/20101230175337/http://www.hassannews.net/images/aa_09.jpg{ref}. `rss-items`. http://cqcounter.com/whois/www/hassannews.net.html not found. The arabic title is "حسن الأخبار" (good news) and the domain seems to be a transliteration of it.
| <Hits without nearby IP hits>[?]
| health-men-today.com
| https://web.archive.org/web/20110207232317/http://health-men-today.com/[2011]
| Arabic
|
| https://web.archive.org/web/20110207232346/http://health-men-today.com/cardio.jar[JAR]
| news
| `rss-items`. Encoding broken. http://cqcounter.com/whois/www/health-men-today.com.html also broken. Same registrar as medicatechinfo.com: Jason Noll <IP and DNS metadata>. Closely related stock model image comically used as the image of the https://www.gaylifecentral.com/community/gayarabcentral[Gay Arab Central community] on the. Copyright 2008.
| <Hits without nearby IP hits>[?]
| inkfreenews.com
| https://web.archive.org/web/20110201180802/http://inkfreenews.com/[2011]
| English
|
| https://web.archive.org/web/20110201180802oe_/http://inkfreenews.com/break.jar[JAR]
| news
| split images, JAR unarchived
| <Hits without nearby IP hits>[?]
| internationalnewsworthiness.com
| https://web.archive.org/web/20110202031020/http://internationalnewsworthiness.com/[2011]
| English
|
| https://web.archive.org/web/20110202031111/http://internationalnewsworthiness.com/world.jar[JAR]
| news
| RSS, split images, JAR unarchived
| <Hits without nearby IP hits>[?]
| intlnewsdaily.com
| https://web.archive.org/web/20110202053416/http://intlnewsdaily.com/[2011]
| English
|
| https://web.archive.org/web/20110202053458/http://intlnewsdaily.com/region.jar[JAR]
| news
| `rss-items`
| <Hits without nearby IP hits>[?]
| intoworldnews.com
| https://web.archive.org/web/20110202054628/http://intoworldnews.com/[2011]
| English
|
| https://web.archive.org/web/20110202055300/http://intoworldnews.com/news.jar[JAR]
| news
| split images. Links to news websites from frontpage, not news themselves.
| <Hits without nearby IP hits>[?]
| iranfootballsource.com
| https://web.archive.org/web/20110202091611/http://iranfootballsource.com/[2011]
| Farsi
|
| https://web.archive.org/web/20110202091901/http://iranfootballsource.com/futbol.js[JS]
| sports, <football>
|
| <Hits without nearby IP hits>[?]
| iraniangoalkicks.com
| https://web.archive.org/web/20080211111124/http://iraniangoalkicks.com/[2008]
| Farsi
| <Iran>
| https://web.archive.org/web/20110202091917/http://iraniangoalkicks.com/clamping.jar[JAR]
| sports, <football>
|
| <Hits without nearby IP hits>[?]
| iraniangoals.com
| https://web.archive.org/web/20090411072857/http://iraniangoals.com/[2009]
| Farsi
| <Iran>
| https://web.archive.org/web/20110202091909/http://iraniangoals.com/journal.js[JS]
| sports, <football>
|
| <Hits without nearby IP hits>[?]
| latinamericanewsbeat.com
| https://web.archive.org/web/20100513190714/http://latinamericanewsbeat.com/[2010]
| English
|
| https://web.archive.org/web/20110201000000*/http://latinamericanewsbeat.com/today.jar[JAR]
| news
| split images
| <Hits without nearby IP hits>[?]
| magneticfieldnews.com
| https://web.archive.org/web/20100515102926/http://magneticfieldnews.com/[2010]
| English
|
| https://web.archive.org/web/20110201122820/http://purlicue-news.com/netspeed.jar[JAR]
| news
| rss, split images
| <Hits without nearby IP hits>[?]
| middle-east-newstoday.com
| https://web.archive.org/web/20100517070603/http://middle-east-newstoday.com/[2010]
| Farsi
|
| https://web.archive.org/web/20100517070625/http://middle-east-newstoday.com/kurds.js[JS]
| news
| rss, split images
| <Hits without nearby IP hits>[?]
| mideasttoday.net
| https://web.archive.org/web/20100923090646/http://mideasttoday.net/[2010]
| Farsi
|
| https://web.archive.org/web/20100923092301/http://mideasttoday.net/mideast.jar[JAR]
| news
| a.rss-item, split images, copyright 2008
| <Hits without nearby IP hits>[?]
| mydailynewsreport.com
| https://web.archive.org/web/20110207171340/http://mydailynewsreport.com/[2011]
| Pashto
| Afghanistan
| https://web.archive.org/web/20110207171354/http://mydailynewsreport.com/world.jar[JAR]
| news
| rss, split images
| <Hits without nearby IP hits>[?]
| mynepalnews.com
| https://web.archive.org/web/20110203000411/http://mynepalnews.com/[2011]
| English
|
| https://web.archive.org/web/20110203000411oe_/http://mynepalnews.com/nepali.jar[JAR]
| news
| split images, JAR unarchived. Nice swimsuit ad.
| <Hits without nearby IP hits>[?]
| newdaynewsonline.com
| https://web.archive.org/web/20110208031757/http://newdaynewsonline.com/[2011]
| English
|
| https://web.archive.org/web/20110208031828/http://newdaynewsonline.com/latesttools.jar[JAR]
| news
|
| <Hits without nearby IP hits>[?]
| networkconnectionsite.com
| https://web.archive.org/web/20110208004005/http://networkconnectionsite.com/[2011]
| English
|
| https://web.archive.org/web/20110208004203/http://networkconnectionsite.com/netnews.js[JS]
| news
| rss, split images
| <Hits without nearby IP hits>[?]
| news-latina.com
| https://web.archive.org/web/20110208065123/http://news-latina.com/[2011]
| English
|
| https://web.archive.org/web/20110208065133/http://news-latina.com/news.jar[JAR]
| news
| copyright 2007
| <Hits without nearby IP hits>[?]
| newsdelivered.net
| https://web.archive.org/web/20101226034643/http://newsdelivered.net/[2010]
| English
|
| https://web.archive.org/web/20101226034643oe_/http://newsdelivered.net/tours.jar[JAR]
| news
| rss, split images, JAR unarchived
| <Hits without nearby IP hits>[?]
| newsincirculation.com
| https://web.archive.org/web/20110208064836/http://newsincirculation.com/[2011]
| Arabic
|
| https://web.archive.org/web/20110208064944/http://newsincirculation.com/affairs.jar[JAR]
| news
|
| <Hits without nearby IP hits>[?]
| newsworldsite.com
| https://web.archive.org/web/20110208071937/http://newsworldsite.com/[2011]
| Pashto
| Afghanistan
| https://web.archive.org/web/20110208071946/http://newsworldsite.com/steps.jar[JAR]
| news
|
| <Hits without nearby IP hits>[?]
| opensourcenewstoday.com
| https://web.archive.org/web/20100930152116/http://www.opensourcenewstoday.com/[2010]
| Arabic
|
| https://web.archive.org/web/20110202050322/http://opensourcenewstoday.com/breaking.jar[JAR]
| news
| copyright 2010
| <Hits without nearby IP hits>[?]
| outlooknewscast.com
| https://web.archive.org/web/20110202115620/http://outlooknewscast.com/[2011]
| Farsi
| Iran
| https://web.archive.org/web/20110202115733/http://outlooknewscast.com/members.jar[JAR]
| news
|
| <Hits without nearby IP hits>[?]
| pars-technews.com
| https://web.archive.org/web/20110204140004/http://pars-technews.com/[2011]
| Farsi
| Iran
| https://web.archive.org/web/20110204140004oe_/http://pars-technews.com/cellphones.jar[JAR]
| news
| "pars" presumably means "Parsi" or something of the same root
| <Hits without nearby IP hits>[?]
| pondernews.net
| https://web.archive.org/web/20110106212939/http://pondernews.net/[2011]
| Arabic
|
| https://web.archive.org/web/20111021233539*/http://pondernews.net/reports.jar[JAR]
| news
| rss
| <Hits without nearby IP hits>[?]
| profile-news.com
| https://web.archive.org/web/20110128181622/http://profile-news.com/[2011]
| English
|
| https://web.archive.org/web/20110128181907/http://profile-news.com/speedtest.jar[JAR]
| news
| a.newslink
| <Hits without nearby IP hits>[?]
| purlicue-news.com
| https://web.archive.org/web/20110201122747/http://purlicue-news.com/[2011]
| English
|
| https://web.archive.org/web/20110201122820/http://purlicue-news.com/netspeed.jar[JAR]
| news
| split images, rss
| <Hits without nearby IP hits>[?]
| segomonews.com
| https://web.archive.org/web/20110131054130/http://segomonews.com/[2011]
| English
|
| https://web.archive.org/web/20110131054332/http://segomonews.com/myjar.jar[JAR]
| news
| rss, split images. TODO meaning of "segomo"? The https://en.wikipedia.org/wiki/Segomo[main Wikipedia hit] is a Gallo-Roman God, but the website is focused on Asia?
| <Hits without nearby IP hits>[?]
| shadesofnews.com
| https://web.archive.org/web/20110201184753/http://shadesofnews.com[2011]
| Arabic
|
| https://web.archive.org/web/20110201184827/http://shadesofnews.com/sports.jar[JAR]
| news
| a.rss-item, split images. Also has a second JAR at: https://web.archive.org/web/20131229092754/http://shadesofnews.com/sptgms213.jar
| <Hits without nearby IP hits>[?]
| sportsnewsfinder.com
| https://web.archive.org/web/20110210133439/http://sportsnewsfinder.com/[2011]
| Chinese
| China
| https://web.archive.org/web/20110210133446/http://sportsnewsfinder.com/scores.jar[JAR]
| news
| 体育新闻发现者 (sports news finder)
| <Hits without nearby IP hits>[?]
| techwatchtoday.com
| https://web.archive.org/web/20110127113203/http://techwatchtoday.com/[2011]
| English
|
| https://web.archive.org/web/20110201220252/http://techwatchtoday.com/Meter.jar[JAR]
| tech, news
| Marked copyright 2008. Split imageshttps://web.archive.org/web/20110201220125/http://techwatchtoday.com/images/index_01.jpg{ref}https://web.archive.org/web/20110201220207/http://techwatchtoday.com/images/index_02.jpg{ref}. https://web.archive.org/web/20180118191109/http://techwatchtoday.com/[Later legit].
| <Hits without nearby IP hits>[?]
| terrain-news.com
| https://web.archive.org/web/20110202060336/http://terrain-news.com/[2011]
| Pashto
| Afghanistan
| https://web.archive.org/web/20110202060511/http://terrain-news.com/internetspeed.jar[JAR]
| news
|
| <Hits without nearby IP hits>[?]
| todayoutdoors.com
| https://web.archive.org/web/20110228050804/http://todayoutdoors.com/[2011]
| English
|
| https://web.archive.org/web/20110228050838/http://todayoutdoors.com/fires.jar[JAR]
| sports, travel
| split imageshttps://web.archive.org/web/20110228050927/http://todayoutdoors.com/images/index_01.jpg{ref}https://web.archive.org/web/20110228050935/http://todayoutdoors.com/images/index_02.jpg{ref}
| <Hits without nearby IP hits>[?]
| todaysnewsreports.net
| https://web.archive.org/web/20100930172518/http://www.todaysnewsreports.net/[2010]
| Arabic
|
| https://web.archive.org/web/20101230050102/http://todaysnewsreports.net/communicate.jar[JAR]
| news
|
| <Hits without nearby IP hits>[?]
| weblognewsinfo.com
| https://web.archive.org/web/20110207145305/http://weblognewsinfo.com/[2011]
| English
|
| https://web.archive.org/web/20110207145431/http://weblognewsinfo.com/global.jar[JAR]
| news
| Split images, `rss-items`.
| <Hits without nearby IP hits>[?]
| wiredworldnews.com
| https://web.archive.org/web/20110208191615/http://wiredworldnews.com/[2011]
| English
|
| https://web.archive.org/web/20110208191739/http://wiredworldnews.com/development.jar[JAR]
| tech
| split images, copyright 2008
| 62.22.60.40
| travel-passage.com
| http://cqcounter.com/whois/www/travel-passage.com.html[2011]
| English, Chinese
|
|
| travel
| No Wayback Machine archives of toplevel, only of the 航空 Flight Reservations subpage: https://web.archive.org/web/20091118013330/http://travel-passage.com:80/service-flights.htm[]. The link to it can be seen from the cqcounter screenshot. The page contain an unusual mixture of Chinese and English. The Chinese title is 游行连接 (lit. travel connection)
| 62.22.60.42
| newsupdatesite.com
| https://web.archive.org/web/20110208071716/http://newsupdatesite.com/[2011]
| English
|
| https://web.archive.org/web/20110208071716oe_/http://newsupdatesite.com/update.jar[JAR]
| news
| split images, rss-item. JAR unarchived.
| 62.22.60.46
| flyingtimeline.com
| https://web.archive.org/web/20110207204610/http://flyingtimeline.com/[2011]
| English
|
| https://web.archive.org/web/20110207204640/http://flyingtimeline.com/aircraft.jar[JAR]
| airplanes
|
| 62.22.60.48
| currentcommunique.com
| https://web.archive.org/web/20110130162455/http://currentcommunique.com/[2011]
| English
| Egypt
| https://web.archive.org/web/20110130162717/http://currentcommunique.com/outdoor-activities-guide.swf[SWF]
| news
|
| 62.22.60.49
| telecom-headlines.com
| https://web.archive.org/web/20110202010914/http://telecom-headlines.com/[2011]
| English
|
| https://web.archive.org/web/20110202011432/http://telecom-headlines.com/situation.js[JS]
| tech
|
| 62.22.60.52
| collectedmedias.com
| https://web.archive.org/web/20110208064948/http://collectedmedias.com/[2011]
| French
|
| https://web.archive.org/web/20110208065035/http://collectedmedias.com/livestory.js[JS]
| news
| Marked copyright 2008
| 62.22.60.54
| romulusactualites.com
| http://cqcounter.com/whois/www/romulusactualites.com.html[2011]
| French
| France
|
| news
|
| 62.22.60.55
| thefilmcentre.com
| https://web.archive.org/web/20110202144854/http://thefilmcentre.com/[2011]
| English
|
| https://web.archive.org/web/20110202144926/http://thefilmcentre.com/modernfilm.js[JS]
| films
|
| 62.22.60.56
| traveltimenews.com
| https://web.archive.org/web/20110208063719/http://traveltimenews.com/[2011]
| English
|
| https://web.archive.org/web/20110208063737/http://traveltimenews.com/programa.js[JS]
| news
|
| 62.22.61.193
| awfaoi.org
| https://web.archive.org/web/20100607225131/http://www.awfaoi.org/[2010]
| <Arabic>
| Iraq
| https://web.archive.org/web/20110624203548/http://awfaoi.org/hand.jar[JAR]
| not-for-profit
| This was the first clear <.org hit> with comms we've been able to find. Title translation: "Arab women to help Iraq", so perhaps "awfaoi" stands for "Arab Women For A O? Iraq". This fits well into the .org theme. Marked copyright 2008.
| 62.22.61.197
| rc5sports.com
| https://web.archive.org/web/20110202093316/http://rc5sports.com/[2011]
| English
|
| https://web.archive.org/web/20110202093627/http://rc5sports.com/slides.jar[JAR]
| sports
| 62.22.61.198
| inside-vc.com
| https://web.archive.org/web/20110602073616/http://inside-vc.com/[2011]
| English
|
| https://web.archive.org/web/20110602073616/https://www.inside-vc.com/cgi-bin/capital.cgi[CGI]
| finance
| "vc" is a standard abbreviation for <venture capital>
| 62.22.61.200
| zerosandonesnews.com
| https://web.archive.org/web/20110209083732/http://zerosandonesnews.com/[2011]
| English
|
| https://web.archive.org/web/20110209084342/http://zerosandonesnews.com/zerosandonesnews.swf[SWF]
| news
| rss, split images
| 62.22.61.202
| bailsnboots.com
| https://web.archive.org/web/20110201234149/http://bailsnboots.com/[2011]
| English
|
| https://web.archive.org/web/20110201234514/http://bailsnboots.com/bailsnboots.swf[SWF]
| sports, cricket
| "Bail" is one part of the thing your're supposed to hit with th eball in cricket.https://en.wikipedia.org/wiki/Bail_(cricket){ref}
| 62.22.61.203
| the-cricketer-online.com
| https://web.archive.org/web/20110202124357/http://the-cricketer-online.com/[2011]
| English
|
| https://web.archive.org/web/20110202124706/http://the-cricketer-online.com/cricketer.jar[JAR]
| sports, cricket
| marked copyright 2009.
| 62.22.61.204
| hollywoodscreen.net
| https://web.archive.org/web/20110106082200/http://hollywoodscreen.net/[2011]
| English
|
| https://web.archive.org/web/20110106082232/http://hollywoodscreen.net/current.js[JS]
| films
|
| 62.22.61.206
| worldnewsnetworking.com
| https://web.archive.org/web/20110210043738/http://worldnewsnetworking.com/[2011]
| <Arabic>
|
| https://web.archive.org/web/20110210043750/http://worldnewsnetworking.com/wnn.jar[JAR]
| news
|
| 62.22.61.212
| nuestrasfinanzas.com
| https://web.archive.org/web/20110128201657/http://nuestrasfinanzas.com/[2011]
| Spanish
|
| https://web.archive.org/web/20110128201702/http://nuestrasfinanzas.com/ads.jar[JAR]
| finance
|
| 62.22.61.213
| sandstormnews.com
| https://web.archive.org/web/20110208085035/http://sandstormnews.com/[2011]
| Arabic
|
| https://web.archive.org/web/20110208085820/http://sandstormnews.com/sandstormnews.swf[SWF]
| news
| rss, split images
| 62.22.61.215
| the-tech-mind.com
| http://cqcounter.com/whois/www/the-tech-mind.com.html[2011]
| English
|
|
| technology, news
| https://web.archive.org/web/20130822184140/http://the-tech-mind.com/[Welcome to the US Petabox on Wayback Machine].
| 62.22.61.217
| court-masters.com
| https://web.archive.org/web/20110128080659/http://court-masters.com/[2011]
| English
|
| https://web.archive.org/web/20110129003221*/http://court-masters.com/rumors.jar[JAR]
| sports, tennis
|
| 62.22.61.219
| allworldstatistics.com
| https://web.archive.org/web/20110207151749/http://allworldstatistics.com/[2011]
| English
|
| https://web.archive.org/web/20110207151920/http://allworldstatistics.com/international.js[JS]
| statistics
|
| 62.22.61.220
| newsjaka.com
| https://web.archive.org/web/20110208065006/http://newsjaka.com/[2011]
| English
| Indonesia
| https://web.archive.org/web/20110208065144/http://newsjaka.com/journals.js[JS]
| news
| "jaka" presumably means https://en.wikipedia.org/wiki/Jakarta[Jakarta], the capital of Indonesia. There is a Indonesia section on the left sidebar. But the news are quite global however. Photo source: https://www.shutterstock.com/image-photo/little-boat-on-bratan-lake-front-5860873 depicts "Bratan lake in front of the Pura Ulu Danau temple" by Ine Beerten. Pinged her at: https://portfolio.inebeerten.be/#Contact[]
| 63.131.229.2
| fightskillsresource.com
| https://web.archive.org/web/20110203021154/http://fightskillsresource.com/[2011]
| English
|
| https://web.archive.org/web/20110203021205js_/http://fightskillsresource.com/tapout.js[JS]
| sports, martial arts
| Getty Images for the karate dude: https://www.istockphoto.com/photo/take-off-gm98702037-1196239
| 63.131.229.4
| unitedterritorynews.com
| https://web.archive.org/web/20110131154421/http://unitedterritorynews.com/[2011]
| English
|
| https://web.archive.org/web/20110131154504js_/http://unitedterritorynews.com/newsterritory.js[JS]
| news
|
| 63.131.229.9