Security Market Segment LS
Friday, 15 February 2019 08:17

DNS manipulation used to track Venezuelans who join in aid distribution

DNS manipulation used to track Venezuelans who join in aid distribution Pixabay

A fake website, that is more or less an exact copy of one seeking humanitarian aid for Venezuela, has surfaced, with those who set it up having manipulated DNS records so that both resolved to the same IP - which was owned by the fake domain owner - when viewed from within the country.

This means that no matter which site one accesses in Venezuela, any data input will be available at the fake site.

Researchers from security firm Kaspersky Lab said the two sites resolved to different IPs when accessed from outside Venezuela.

The incident has occurred at a time when Venezuela is in political turmoil, with the US pushing for its elected leader, Nicolas Maduro, to step down and yield power to opposition leader Juan Guaidó. Washington has hinted that it may take military action to enforce its wish.

The site seeking aid, which has the domain name, was set up due to the fact that many people are in a precarious financial situation. On 10 February, Guaidó publicly called for volunteers to join a movement called Voluntarios por Venezuela” (Volunteers for Venezuela).

doman name one

Both genuine and fake sites resolve to the same IP in venezuela.

The members of this movement have expressed a willingness to help international organisations deliver aid to people who are in need.

The researchers did not disclose the name of the fake site, apart from saying that it was very similar to the genuine site.

The fake website appears to be aimed at collecting data about those who sign up as volunteers as the genuine site asks those who are signing up for their full names, personal ID, mobile numbers, whether they have a medical degree, a car, or a smartphone, and also where they live.

domain name two

From outside Venezuela, the two sites resolve to separate IPs.

The genuine site came online on 6 February while the fake site made its appearance five days later.

The Kaspersky researchers said the genuine site was registered on 4 February in the name of one Sigerist Rodriguez and hosted on Amazon Web Services.

The fake site had been registered with GoDaddy but since the privacy protection feature was used there was no way of ascertaining who had done the registration. It was initially hosted on GoDaddy and then moved to DigitalOcean.

The researchers offered no commentary as to the motives for the setting up of such a fake site.

But they offered this advice: "In this scenario, where the DNS servers are manipulated, it’s strongly recommended to use public DNS servers such as Google DNS servers ( and or CloudFlare and APNIC DNS servers ( and It’s also recommended to use VPN connections without a third-party DNS."

Graphics: courtesy Kaspersky Lab

Read 2225 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here


The past year has seen a meteoric rise in ransomware incidents worldwide.

Over the past 12 months, SonicWall Capture Labs threat researchers have diligently tracked the meteoric rise in cyberattacks, as well as trends and activity across all threat vectors, including:

Encrypted threats
IoT malware
Zero-day attacks and more

These exclusive findings are now available via the 2022 SonicWall Cyber Threat Report, which ensures SMBs, government agencies, enterprises and other organizations have the actionable threat intelligence needed to combat the rising tide of cybercrime.

Click the button below to get the report.



It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site and prominent Newsletter promotion and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.


Sam Varghese

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News