Profiling Russia's U.S Election Interference 2016 - An OSINT Analysis | WhoisXML API

White Papers

Read other articles

Profiling Russia's U.S Election Interference 2016 - An OSINT Analysis

Profiling Russia's U.S Election Interference 2016 - An OSINT Analysis

We decided to take a closer look at the U.S Election 2016 interference provoked by several spear phishing and malicious campaigns, courtesy of Russia, for the purpose of offering and providing actionable threat intelligence including possible attribution clues for some of the known participants in this campaign. We hope that way to potentially assist fellow researchers and Law Enforcement professionals on their way to track down and prosecute the cybercriminals behind these campaigns.

In this analysis, we’ll take a closer look at the Internet connected infrastructure behind the U.S Election 2016 campaign in terms of malicious activity and offer practical, relevant and actionable threat intelligence on their whereabouts.

Sample malicious and fraudulent C&C domains known to have participated in the U.S Elections 2016 campaign:

  • linuxkrnl[.]net
  • accounts-qooqle[.]com
  • account-gooogle[.]com
  • accoounts-google[.]com
  • account-yahoo[.]com
  • accounts-googlc[.]com
  • accoutns-google[.]com
  • addmereger[.]com
  • akamainet[.]net
  • akamaivirusscan[.]com
  • apple-icloud-services[.]com
  • apple-notification[.]com
  • arabianbusinessreport[.]com
  • azamtelecom[.]com
  • babylonn[.]com
  • baengmail[.]com
  • boobleg[.]com
  • chinainternetservices[.]com
  • com-hdkurknfkjdnkrnngujdknhgfr[.]com
  • combin-banska-stiavnica[.]com
  • cvk-leaks[.]com
  • fb-security[.]com
  • g00qle[.]com
  • global-exchange[.]net
  • googlesetting[.]com
  • hlbnk[.]com
  • homesecuritysystems-sale[.]com
  • icloud-localisation[.]com
  • imperialc0nsult[.]com
  • informationen24[.]com
  • interglobalswiss[.]com
  • intra-asiarisk[.]com
  • invest-sro[.]com
  • iphone-onlineshopping[.]net
  • kur4[.]com
  • lastdmp[.]com
  • localisation-apple-icloud[.]com
  • localisation-apple-support[.]com
  • localisation-mail[.]com
  • login-163[.]com
  • login-kundenservice[.]com
  • magic-exchange[.]com
  • mail-apple-icloud[.]com
  • mailpho[.]com
  • malprosoft[.]com
  • medicalalertgroup[.]com
  • megafileuploader[.]com
  • mfadaily[.]com
  • mfapress[.]com
  • militaryexponews[.]com
  • msoftonline[.]com
  • myaccountgoogle[.]com
  • myaccountsgoogle[.]com
  • mydomainlookup[.]net
  • mypmpcert[.]com
  • net-a-porter-coupon[.]com
  • newiphone-online[.]net
  • newiphone-supply[.]net
  • newreviewgames[.]com
  • nobel-labs[.]net
  • nvidiaupdate[.]com
  • obamacarerx[.]net
  • onlinecsportal[.]com
  • pass-google[.]com
  • password-google[.]com
  • paydaytoday-uk[.]com
  • pb-forum[.]com
  • planetaryprogeneration[.]com
  • regionoline[.]com
  • security-notifications[.]com
  • service-facebook[.]com
  • servicesupdates[.]com
  • set121[.]com
  • set132[.]com
  • set133[.]com
  • sicherheitsteam-pp[.]com
  • sicherheitsteam-pp[.]net
  • skypeupdate[.]com
  • smp-cz[.]com
  • soft-storage[.]com
  • solutionmanualtestbank[.]com
  • ssl-icloud[.]com
  • team-google[.]com
  • techlicenses[.]com
  • techlicenses[.]net
  • ua-freedom[.]com
  • updates-verify[.]com
  • us-mg7mail-transferservice[.]com
  • us-westmail-undeliversystem[.]com
  • us6-yahoo[.]com
  • vatlcan[.]com
  • wordpressjointventure[.]com
  • ya-support[.]com
  • yandex-site[.]com
  • yepost[.]com

Related malicious and fraudulent emails known to have participated in the U.S Elections 2016 campaign:

Sample related email known to have participated in the U.S Elections 2016 campaign: [email protected]

Sample Maltego Graph of a sample malicious and fraudulent domain registrant known to have participated in the U.S Election 2016 campaign

Sample Maltego Graph of a sample malicious and fraudulent domain registrant known to have participated in the U.S Election 2016 campaign

Sample related domains known to have participated in the U.S Elections 2016 campaign:

  • support-forum[.]org
  • oceaninformation[.]org
  • vodafoneupdate[.]org
  • succourtion[.]org
  • eascd[.]org
  • northropgruman[.]org
  • apple-iphone-services[.]com
  • localisation-security-icloud[.]com
  • applesecurity-supporticloud[.]com
  • icloud-iphone-services[.]com
  • icloud-id-localisation[.]com
  • apple-localisation-id[.]com
  • identification-icloud-id[.]com
  • cloud-id-localisation[.]com
  • support-security-icloud[.]com
  • identification-apple-id[.]com
  • localisation-apple-security[.]com
  • security-icloud-localisation[.]com
  • dabocom[.]com
  • quick-exchange[.]com
  • hygani[.]com
  • hztx88[.]com
  • sddqgs[.]net
  • qufu001[.]com
  • lutushiqi[.]com
  • gsctgs[.]com
  • tazehong[.]com
  • hthgj[.]com
  • kvistberga[.]com
  • bjytj[.]net
  • cqhuicang[.]com
  • softbank-tech[.]com
  • osce-press[.]org
  • maxidea[.]tw
  • sdti[.]tw
  • gmailcom[.]tw
  • zex[.]tw
  • gain-paris-notaire[.]fr
  • loto-fdj[.]fr
  • client-amzon[.]fr
  • idse-orange[.]fr
  • rgraduzkfghgd[.]com
  • jmhgjqtmhanoncp[.]com
  • stwdchstclovuzk[.]com
  • puxqtyrwzuzybgzehc[.]com
  • maatil[.]com[.]ng
  • surestbookings[.]com
  • asatuyouth[.]org[.]ng
  • hanna[.]ng
  • hostlink[.]com[.]ng
  • sirbenlimited[.]com
  • dce[.]edu[.]ng
  • eventsms[.]com[.]ng
  • krsbczmxwdsjwtizmx[.]com
  • alizirwzyjazurof[.]com
  • zslipanehule[.]com
  • cxotonspmjkxw[.]com
  • wpifmhyjkxyt[.]com
  • ngvsngpwdidmn[.]com
  • imperialvillas[.]com[.]ng
  • lipyhgpofsnifste[.]com
  • flexceeweb[.]com
  • fgfcpkdcnebgduls[.]com
  • shinjiru[.]us
  • supportchannel[.]net
  • couponofferte[.]com
  • psepaperindustrial[.]com
  • lakws[.]com
  • perplencorp[.]com
  • lbchemtrade[.]com
  • viaggibelli[.]com
  • liontitco[.]com
  • svendiamo[.]com
  • orogenicgroup[.]com
  • giudeviaggio[.]com
  • greenskill[.]net
  • siteseditor[.]net
  • e-mail-supports[.]com
  • biplen[.]com
  • infradesajohor[.]com
  • dealhot[.]net
  • suanmin[.]com
  • on9on9[.]com
  • accoutns-google[.]com
  • puroniq[.]com
  • sinqa[.]com
  • sadihadi[.]com
  • mrangkang[.]com
  • terumbu[.]com
  • phygitail[.]com
  • veraniq[.]com
  • potxr[.]com
  • icraw[.]com
  • thearoid[.]com
  • teempo[.]com
  • parblue[.]com
  • mydomainlookup[.]net
  • adrianvonziegler[.]net
  • zetindustries[.]com
  • researchs[.]com[.]ng
  • joymoontech[.]com
  • researchmaterials[.]com[.]ng
  • james823[.]com
  • oneibeauty[.]net

We’ll continue monitoring the campaign and post updates as soon as new developments occur.

Read other articles
Try our WhoisXML API for free
Get started
Have questions?

We are here to listen. For a quick response, please select your request type or check our Contact us page for more information. By submitting a request, you agree to our Terms of Service and Privacy Policy.

Or shoot us an email to