Influencer Vaccine: Identifying Information Operations Infrastructure
summary
Case study shows cybersecurity techniques linking domain registration and hosting data to influence infrastructure: a registrant (records name and Yandex email) registers multiple sites seconds apart via Evo Plus, reverse WHOIS and passive DNS tie about 50 domains together, RiskIQ and Wayback reveal an extstat.info JavaScript collecting user-agent and serving ads, and a Chrome extension plus Xtab.info acted like a click‑fraud C2; core methods were WHOIS timestamp clustering and hosting collocation analysis.
AI-written summary · about
chapters (12)
- 0:00IRA and influence operations background
- 2:14Cybersecurity tracking influence ops
- 3:39Case study and research questions
- 5:27Finding registrant behind domains
- 8:00Linking registrant to IRA
- 10:14Infrastructure via reverse WHOIS
- 12:03Hidden scripts and fake news networks
- 15:37Iterating domains to uncover actors
- 17:23Hosting collocations and clustering
- 19:1550 domains linked to IRA
- 20:23Methods for domestic influence ops
- 22:32Q&A: Data collection ethics
related talks
32mSomething’s Phishy: See the Hook Before the Bait
21mWHOIS Your Daddy: Tracking Iranian-backed Cyber Operations...
29mThe Invisible War to Hijack Minds, Distort the Truth, and Impact Elections
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
28mFerris Bueller's Guide to Abuse Domain Permutations
47mDNS On Fire
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
40mDid Subdomain Abuse by BlackTech “Evolve”?