Can't help myself.. Taking a look into some of these 32 domains sheds light on a few unmentioned Doppelganger domains still active and personas posting on Twitter. Quick 🧵
lebelligerant[.]io
Twitter Account: @lebelligerant
Image 1 - Homepage.
Image 2 - Translated Main Article.
Image 3 - Fresh tweets.
Note: The webmail subdomain mistakenly uses the 50statesoflie[.]media domain content, which was listed in the Doppelgange raffidavit.
interventionist[.]cc
Twitter Account: @Intrvntnst
Image 1 - Homepage.
Image 2 - Translated Main Article.
Image 3 - Fresh tweets.
Note: Same as above, multiple subdomains. First active around one month ago.
lesifflet[.]cc
Image 1 - Homepage.
Image 2 - Subdomain https.
Note: Interesting content theme, broken subdomain content. No indication its a legitimate (compromised) website.
derrattenfanger[.]io
Twitter: @Rattenfangernet
Image 1 - Homepage.
Image 2 - Main article (some, translated).
image 3 - Tweets.
Note: Lots of AI images on this one, plus heavy video use.
liesofwallstreet[.]io
Image 1/2 - Socials
Image 3 - Homepage
Note: No Twitter but an Instagram and Pinterest links 🤔
secrettribunal[.]online
Image 1 - Homepage.
Image 2 - Featured US/Ukraine article (translated).
Note: Fits into the Ukraine Domains cluster in the affidavit.
To wrap this up, the most odd..
ukraine-inc[.]com (not the .info listed in affidavit).
Features a multi episode cartoon series, and a 'hit' or 'Catch' @ZelenskyyUa game. 🤦♂️
/end of Doppleganger thread.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
I often get asked what tools I use for various aspects of threat research / analysis --
Here's a quick list of my favorites that most are not taking advantage of.. 🧵
1. Aeon Timeline (@AeonTimeline):
▪️ This is my replacement for most Maltigo-style mapping + time-lining chaotic events.
▪️ Everything I investigate starts with one of these to track pivots/clues.
▪️ $65 a year..
2. Validin (@ValidinLLC):
▪️ DNS History, infra pivots, timeline of use, host response searching, OSINT references, etc.
▪️ Quickly developing from great analyst feedback.
▪️ $ Free Community Version!
🔥 An upgraded and affordable passivetotal replacement.
This then leads us further back to a lesser known report from @Phylum_IO's research team. About a month ago they published details on an ongoing NPM campaign.
We can quickly see infrastructure overlaps with the JumpCloud + GitHub findings. 🌶️
Unfortunately the IOC file is no longer hosted there. Luckily our friends at AT&T (Alienvault OTX) pulled the IOCs back when that blog was posted: otx.alienvault.com/pulse/54c7e1e8…
ME is responsible for targeted attacks on human rights activists, human rights defenders, academics, and lawyers across India with the objective of planting incriminating digital evidence.
Targets and known victims include those involved in the Bhima Koregaon case, in which the evidence presented in the case was planted by the actor prior to arrests.