The Suspicious Domain
Author: 0xIDA
Platform: HTB · Category: osint · Difficulty: Very Easy
Platform: HTB | Category: OSINT | Difficulty: Very Easy
Target: 154.57.164.76:32504
Domain: alexmorgan-reviews.net
Solvers
Summary
WHOIS investigation of the domain alexmorgan-reviews.net — linked to the TechReviewer2024 / Alex Morgan fake review operation from the previous challenge. The domain was registered with NetRegistry Solutions Inc. and hosted on GitHub Pages. The fake review website targeted TechFlow products with negative reviews.
Methodology
1. Domain Intelligence Platform
The "DomainScope" interface exposed seven information panels:
WHOIS & Registration
Full WHOIS record for alexmorgan-reviews.net:
Domain Name: ALEXMORGAN-REVIEWS.NET
Creation Date: 2024-01-20T14:22:15Z
Registrar: NetRegistry Solutions Inc.
Domain Status: clientTransferProhibited
Registrant Contact:
Name: Alex Morgan
Organization: Morgan Tech Reviews LLC
Street: 1247 Silicon Valley Blvd, Suite 200
City: San Jose, California 95110
Phone: +1-408-555-0987
Email: alex.morgan@tempmail.com
DNS Records
4 A records pointing to GitHub Pages IPs:
185.199.108.153185.199.109.153185.199.110.153185.199.111.153
MX records: mail.alexmorgan-reviews.net (P10), backup.tempmail.com (P20)
Website Preview
Fake negative reviews of TechFlow Pro X1 (2/5 stars) and TechFlow Analytics Suite (1/5 stars), with a suspiciously positive review of CloudSync Enterprise (5/5 stars).
Threat Analysis
Cross-reference intelligence revealed:
- Shared Google Analytics ID:
G-TECHFLOW4472891 - Linked domains:
alexmorgan-reviews.com,alex-morgan.net+ 2 more - Email service: tempmail (disposable)
- All domains share identical contact info and nameservers
2. Answers
| # | Answer | Source |
|---|---|---|
| 1 | alex.morgan@tempmail.com | WHOIS Registrant email |
| 2 | +1-408-555-0987 | WHOIS Registrant phone |
| 3 | 2024-01-20 | WHOIS Creation Date |
| 4 | Morgan Tech Reviews LLC | WHOIS Organization |
| 5 | San Jose | WHOIS city |
| 6 | clientTransferProhibited | Domain Status |
| 7 | TechFlow | Website negative review targets |
| 8 | tempmail | Disposable email service used |
| 9 | 4 | GitHub Pages A records count |
Flag
HTB{alexmorgantempmailcom_20240120_morgantechreviewsllc}
Key Insights
- OPSEC failures: (1) Same disposable email service across all domains, (2) Past employment at RivalTech Inc. exposed on LinkedIn/ConnectPro, (3) Identical contact data across all domains linked via Google Analytics ID
- The operation cost-minimization strategy is typical of short-term astroturfing campaigns