Official Report for the Police Regarding the Domain gudusy.com Alibaba Network Analysis & Mall Online Store Fraud Report

This technical report is prepared to provide detailed information about one of the 300 active domains involved in fraud activities under the term "Pig Butchering". Based on comprehensive and thorough OSINT analysis, it was found that all of these 300 domains follow a common pattern and share similar information. This report, as an example of the findings of the conducted research, is presented with the purpose of informing and providing valid evidence to the Cyber Police of the Islamic Republic of Iran. It is important to note that effective measures are being taken to identify and trace the perpetrators of these fraud activities.

1. Initial Domain Details

Domain Name: gudusy.com

DNS Records (Domain Name Servers):

2. Reasons for Investigating This Domain

Evidence of Multiple DNS Changes: This domain has frequently changed its DNS servers, which may indicate an attempt to conceal or evade identification.

Use of Cloudflare: This suggests an attempt to hide the true identity of the hosting servers.

Possible Involvement in Suspicious Activities:

If there is evidence of phishing, cyber fraud, malware, or cybersecurity threats, documented information should be provided.

3. DNS Change History Table

4. Recommended Actions for Police Investigation

1. Examine hosting records and associated IPs.
2. Analyze the website content and investigate suspicious activities.
3. Search security databases for related reports.
4. Check WHOIS domain registration details.
5. Identify similar or related domains.

5. Request for Legal Actions

• Block the domain at both national and international levels.
• Request additional information from DNS providers and Cloudflare.
• Collaborate with international entities to identify and trace the perpetrators.

6. Attachments

Related documentation including network logs, email samples, screenshots of suspicious pages, IP addresses, and technical analysis reports.

Conclusion

Considering the frequent DNS changes, use of Cloudflare, and the potential link to suspicious activities, it is recommended that this domain be thoroughly investigated by the police and security agencies.

Signature and Reporter's Information:

(Insert your information here. If anonymity is required, use official channels for anonymous reporting.)

Technical and Detailed Report for Cyber Police

Subject: DNS Records Analysis of the Domain gudusy.com and Its Potential Link to Suspicious Activities

Report Prepared by: [Your Name or Relevant Organization]

Report Date: [Date of Report Preparation]

Severity Level: High / Medium / Low (Depending on the Threat Type)

1. Introduction

This report examines the DNS record changes of the domain gudusy.com. The analysis indicates multiple changes in the Name Servers (NS) and Start of Authority (SOA) records between 2022 and 2025. The technical review suggests abnormal behavior and a potential link between this domain and cyber activities of concern.

2. Analyzed DNS Records

2.1 SOA (Start of Authority) Records

SOA Record Analysis: The multiple changes in MName and Serial suggest a frequent change in the DNS provider. The domain switched from Alibaba Cloud to Cloudflare, indicating an effort to obscure information.

2.2 NS (Name Server) Records

NS Record Analysis: The domain experienced multiple changes in its Name Server records, transitioning between different providers (from Alibaba Cloud to Cloudflare), which is uncommon and could be a sign of effort to mask server information.

3. Conclusion

The analysis of the DNS records for the domain gudusy.com suggests suspicious activities due to frequent changes in the domain's authoritative name servers, coupled with abnormal SOA serial number increments. These irregularities should be further investigated by the authorities to determine the nature of the activities associated with this domain.

The consistent switch between hosting providers, especially moving to Cloudflare, may be an attempt to mask the domain’s operations. It is advised that relevant cyber security authorities review any associated IPs, traffic, and related digital assets for further suspicious behavior.

Recommendations: Based on these findings, it is recommended to monitor any outgoing/incoming traffic associated with this domain and trace its connections to potential botnets or cyberattack campaigns. Further collaboration with hosting and DNS providers may be necessary.

Complete OSINT Report on DNS History of gudusy.com Domain

Prepared by: [Your Name or Organization]

Report Date: [Exact Date of Report]

Importance Level: High / Medium / Low

Domain Status: Frequent changes in DNS servers, potential connection to suspicious activities

1. Introduction

This report is based on information gathered from CompleteDNS and other OSINT sources and analyzes the DNS changes of the gudusy.com domain. Frequent changes in nameservers (NS) and the history of domain drops and re-registrations may indicate malicious activities.

In the DNS history table of the gudusy.com domain, it is evident that the primary DNS servers for the domain, such as ns1.judns.com and ns2.judns.com, appear in the early dates. Furthermore, the jm1.dns.com and jm2.dns.com servers appear later in the DNS history. These servers represent the domain's original DNS before the records were transferred to Cloudflare's proxy servers (denver.ns.cloudflare.com and noor.ns.cloudflare.com). These DNS changes and transitions suggest that the primary DNS servers of the domain in the early stages, before connecting to the Cloudflare proxies, were ns1.judns.com and ns2.judns.com. This information technically shows that before using proxy services, which hide the actual server information, the DNS servers jm1.dns.com and jm2.dns.com played a key role in managing DNS traffic.

These changes were made to hide the identity of the primary servers and prevent them from being detected. A closer inspection reveals that this strategy is designed to avoid detection and tracking of activities on the internet. The transition to Cloudflare proxy services provides a layer of obfuscation and protection, making it difficult for authorities to access the real server information. This indicates that the DNS path is indirectly serving fraudulent or illegal activities.

2. Analysis of DNS Changes

2.1. Analysis of Domain Creation and Deletion History

• The domain was deleted in 2013 and re-registered after 8 years in 2021.
• Hosting on multiple nameservers (Hichina, DNS.com, Juming, Cloudflare) indicates unusual activity.
• These changes are typically seen in domains used for temporary activities such as phishing, malware, or C2 servers.

2.2. Analysis of Nameserver (NS) Changes

[This section will provide details about how the nameserver changes affect the security of the domain and its traffic. You can provide specific examples of potential security threats or malicious activities associated with nameserver switching. The rapid switching might indicate an attempt to evade detection.]

3. Conclusion

Based on the DNS history, frequent nameserver changes, domain deletions, and the use of proxies like Cloudflare, it is reasonable to conclude that this domain might be associated with suspicious activities. These DNS strategies are common in domains used for hosting illegal or fraudulent content.

It is recommended to monitor this domain closely for any further unusual behavior, and potential blocking or blacklisting actions should be considered for higher-risk environments.

OSINT Report - Analysis of the IP Address for the Domain gudusy.com

Prepared by: [Your Name or Organization]

Report Date: [Exact Date of Report]

Importance Level: High / Medium / Low

Status: Analysis of Domain Connectivity and Security

1. Introduction

This report provides details of the IP analysis connected to the domain gudusy.com. Data obtained from the DNS History Lookup shows that this domain was connected to IP address 47.104.252.109 from June 17, 2022, to January 27, 2024. The purpose of this report is to investigate the history and connections of this IP address in order to detect suspicious activities, phishing, malware, or other cybersecurity threats.

2. Technical Details of IP: 47.104.252.109

2.1. Registration and Geographical Information

2.2. Infrastructure Analysis and IP History

This IP is owned by Alibaba Cloud (Aliyun), a public cloud service provider that can be used for both legitimate and suspicious sites.

Based on previous OSINT research, domains hosted on Aliyun servers are sometimes linked to phishing, spam, and malware activities.

DNS history indicates that this domain has been hosted on this IP for 18 months (2022-2024), which could be a sign of a stable and organized activity.

3. Analysis of Communications and Potential Threats

3.1. Investigation in Cyber Threat Intelligence Databases

• ✅ Investigation of 47.104.252.109 in security databases like AbuseIPDB, VirusTotal, ThreatCrowd for malware, phishing, or DDoS attack reports.
• ✅ Analyzing the connection of this IP with other suspicious domains hosted on Alibaba Cloud.

3.2. Investigation of Connections with Known Cyberattacks

• 📌 Review of records related to online fraud and botnets that have been active on Aliyun servers.
• 📌 Cross-referencing this IP with known IP addresses from previous attacks to detect possible links to ongoing threats.

4. Suggested Actions for Cyber Police

• ✅ Request additional information from Alibaba Cloud: Official request to Alibaba for domain registration and ownership details.
• ✅ Review firewall and network logs: Monitoring network traffic to identify suspicious connections with this IP.
• ✅ Block connections with this domain in organizational and governmental networks if malicious activities are confirmed.
• ✅ Share this report with CERT centers and cyber police for further investigation and legal actions.

5. Conclusion

IP: 47.104.252.109 is owned by Alibaba Cloud (Aliyun) and hosted the domain gudusy.com from June 2022 to January 2024.

Frequent changes in DNS and hosting on different servers indicate an attempt to hide the true identity and potentially harmful cyber activities.

It is recommended that cyber police and security centers conduct further investigations on this IP and its connections.

Prepared by: [Your Name or Organization]

Report Submission Date: [Date of Report]

Contact for More Information: [Email/Phone Number]

Attachments (if needed):

• 📌 Additional OSINT analysis on this IP
• 📌 Screenshots related to abuse reports
• 📌 List of other domains hosted on this IP

⚠ Confidential - This report is for the use of security agencies and cyber police only.