Note: This OSINT analysis has been originally published at my current employers Web site https:\/\/whoisxmlapi.comwhere<\/a> Im currently acting as a DNS Threat Researcher since January, 2021.<\/p>\n Weve recently came across to a currently active free VPN domains portfolio which based on ourn research and publicly accessible sources appears to be run and operated by the NSA where the ultimate goal would be to trick users into using these rogue and bogus free VPN service providers in particular Iran-based users where the ultimate goal would be to monitor an eavesdrop on their Internet activities and weve decided to take a deeper look inside the Internet-connected infrastructure of these domains and offer practical and relevant threat intelligence and cyber attack attribution details on the true origins of the campaign.<\/p>\n In this case study well offer practical and relevant technical information on the Internet-connected infrastructure of this campaign with the idea to assist the security community on its way to track down and monitor this campaign including to offer actual cyber attack and cyber campaign attribution clues which could come handy to a security researcher or a threat intelligence analyst on their way to track down and monitor the campaign.<\/p>\n Original rogue portfolio of fake VPN service domains courtesy of the NSA:<\/p>\n bluewebx[.]com<\/p>\n bluewebx[.]us<\/p>\n irs1[.]ga<\/p>\n iranianvpn[.]net<\/p>\n IRSV[.]ME<\/p>\n DNSSPEEDY[.]TK<\/p>\n ironvpn[.]tk<\/p>\n ironvpn[.]pw<\/p>\n irgomake[.]win<\/p>\n make-account[.]us<\/p>\n make-account[.]ir<\/p>\n IRANTUNEL[.]COM<\/p>\n JET-VPN[.]COM<\/p>\n newhost[.]ir<\/p>\n homeunix[.]net<\/p>\n vpnmakers[.]com<\/p>\n hidethisip[.]info<\/p>\n uk[.]myfastport[.]com<\/p>\n witopia[.]net<\/p>\n worldserver[.]in<\/p>\n music30ty[.]net<\/p>\n misconfused[.]org<\/p>\n privatetunnel[.]com<\/p>\n aseman-sky[.]in<\/p>\n Related domain registrant email addresses known to have been involved in thecampaign:<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]COM<\/p>\n [emailprotected][.]cz<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n [emailprotected][.]com<\/p>\n Related domains known to have been involved in the campaign:<\/p>\n gaysexvideo[.]us<\/p>\n keezmovies[.]us<\/p>\n hitporntube[.]com<\/p>\n enjoyfreesex[.]com<\/p>\n allfreesextube[.]com<\/p>\n thegaytubes[.]com<\/p>\n sextubeshop[.]com<\/p>\n pornfetishexxx[.]com<\/p>\n ebonypornox[.]com<\/p>\n freepornpig[.]com<\/p>\n marriagesextube[.]com<\/p>\n searchporntubes[.]com<\/p>\n suckporntube[.]com<\/p>\n darlingmatures[.]com<\/p>\n pornretrotube[.]com<\/p>\n teensexfusion[.]net<\/p>\n rough18[.]us<\/p>\n teendorf[.]us<\/p>\n 1retrotube[.]com<\/p>\n typeteam[.]com<\/p>\n biosextube[.]com<\/p>\n hadcoreporntube[.]com<\/p>\n reporntube[.]com<\/p>\n telltake[.]com<\/p>\n asianprivatetube[.]com<\/p>\n hostednude[.]com<\/p>\n alfaporn[.]com<\/p>\n sexbring[.]com<\/p>\n porntubem[.]com<\/p>\n newerotictube[.]com<\/p>\n firstretrotube[.]com<\/p>\n oralsexlove[.]com<\/p>\n 1bdsmtubes[.]com<\/p>\n hairytubeporn[.]com<\/p>\n brunettetubex[.]com<\/p>\n tubelatinaporn[.]com<\/p>\n xxxgaytubes[.]com<\/p>\n analxxxvideo[.]com<\/p>\n analsexytube[.]com<\/p>\n aeroxxxtube[.]com<\/p>\n amateurpornlove[.]com<\/p>\n admingay[.]com<\/p>\n xxxretrotube[.]com<\/p>\n xxxshemaletubes[.]com<\/p>\n hotpornstartube[.]com<\/p>\n firsttrannytube[.]com<\/p>\n erotixtubes[.]com<\/p>\n 1pornstartube[.]com<\/p>\n <\/p>\n Visit link: Note: This OSINT analysis has been originally published at my current employers Web site https:\/\/whoisxmlapi.comwhere<\/a> Im currently acting as a DNS Threat Researcher since January, 2021. Continue reading
\nExposing a Currently Active Free Rogue VPN Domains Portfolio Courtesy of the NSA An OSINT Analysis - Security Boulevard<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"