Security Market Segment LS
Friday, 15 February 2019 08:17

DNS manipulation used to track Venezuelans who join in aid distribution

DNS manipulation used to track Venezuelans who join in aid distribution Pixabay

A fake website, that is more or less an exact copy of one seeking humanitarian aid for Venezuela, has surfaced, with those who set it up having manipulated DNS records so that both resolved to the same IP - which was owned by the fake domain owner - when viewed from within the country.

This means that no matter which site one accesses in Venezuela, any data input will be available at the fake site.

Researchers from security firm Kaspersky Lab said the two sites resolved to different IPs when accessed from outside Venezuela.

The incident has occurred at a time when Venezuela is in political turmoil, with the US pushing for its elected leader, Nicolas Maduro, to step down and yield power to opposition leader Juan Guaidó. Washington has hinted that it may take military action to enforce its wish.

The site seeking aid, which has the domain name, was set up due to the fact that many people are in a precarious financial situation. On 10 February, Guaidó publicly called for volunteers to join a movement called Voluntarios por Venezuela” (Volunteers for Venezuela).

doman name one

Both genuine and fake sites resolve to the same IP in venezuela.

The members of this movement have expressed a willingness to help international organisations deliver aid to people who are in need.

The researchers did not disclose the name of the fake site, apart from saying that it was very similar to the genuine site.

The fake website appears to be aimed at collecting data about those who sign up as volunteers as the genuine site asks those who are signing up for their full names, personal ID, mobile numbers, whether they have a medical degree, a car, or a smartphone, and also where they live.

domain name two

From outside Venezuela, the two sites resolve to separate IPs.

The genuine site came online on 6 February while the fake site made its appearance five days later.

The Kaspersky researchers said the genuine site was registered on 4 February in the name of one Sigerist Rodriguez and hosted on Amazon Web Services.

The fake site had been registered with GoDaddy but since the privacy protection feature was used there was no way of ascertaining who had done the registration. It was initially hosted on GoDaddy and then moved to DigitalOcean.

The researchers offered no commentary as to the motives for the setting up of such a fake site.

But they offered this advice: "In this scenario, where the DNS servers are manipulated, it’s strongly recommended to use public DNS servers such as Google DNS servers ( and or CloudFlare and APNIC DNS servers ( and It’s also recommended to use VPN connections without a third-party DNS."

Graphics: courtesy Kaspersky Lab


You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer


QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.



iTWire can help you promote your company, services, and products.


Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments