Phishing contra VoluntariosXVenezuela mediante redirección DNS

What this source supports

• VE sin Filtro observed a visually identical phishing clone at voluntariovenezuela.com and DNS injection affecting requests for voluntariosxvenezuela.com inside CANTV/Movilnet networks
• the false form collected names, national identification numbers, email addresses and telephone numbers
• the researchers observed false answers even when querying external or nonexistent DNS resolvers and linked the false-domain registration information to a CONATEL office
• the tens-of-thousands estimate was an inference, not a measured victim count

Evidence limits

Primary technical research with reproducible-looking command output, but no raw packet captures or complete telemetry were published. State responsibility and the estimated scale remain researcher assessments, not an official admission or measured count.

Relevance to this case

Strongest technical source for the phishing clone, observed DNS manipulation, requested data fields and CANTV/Movilnet context.

What this source supports

• Kaspersky independently observed the legitimate and deceptive domains resolving inside Venezuela to the deceptive-domain owner's IP address
• the deceptive site was an almost identical mirror that appeared February 11 and Kaspersky classified it as phishing
• outside Venezuela the domains resolved differently
• the report did not identify a specific ISP or attribute the operator to the Venezuelan government

Evidence limits

Independent technical corroboration of the clone and location-dependent DNS result, but it does not name CANTV, prove the operator, quantify victims or connect the later published lists to the clone.

Relevance to this case

Independent primary technical corroboration of the phishing and DNS-manipulation mechanism.

What this source supports

• DFRLab documented that pro-Maduro accounts and websites began publishing personal-data lists on February 17
• DFRLab checked a 24-person sample: 22 national ID numbers matched the CNE register, 15 people were reached, and seven said they had accessed the platform over CANTV
• DFRLab could not reproduce the original DNS findings because the phishing pages were offline
• the inspected sample and later larger lists do not establish the total affected population or a complete chain from the clone to every published record

Evidence limits

Strong independent work for the sampled identities, interviews and public-list chronology. It depends on VE sin Filtro for the original DNS attribution, could not reproduce the offline pages and did not publish the raw dataset for privacy reasons.

Relevance to this case

Best independent source for the later publication of personal data and the limits of the verified sample.

What this source supports

• VICE reported the clone, redirection inside Venezuela and matching infrastructure findings from Kaspersky, CrowdStrike and local researchers
• CrowdStrike's government attribution was an expert assessment rather than an official admission or published forensic chain
• the article said effectiveness was unknown and hundreds could potentially have been affected
• related credential-phishing domains on the same IP do not prove that the VoluntariosXVenezuela clone collected passwords

Evidence limits

Contemporaneous independent reporting, but its operator attribution is quoted assessment, its potential victim estimate is not measured and some infrastructure screenshots concern related domains rather than the target clone.

Relevance to this case

Corroborating journalism and expert-attribution context, not primary proof of operator identity or affected count.