Blinder Tunnel: lure sites and relay of the Shelby espionage campaign against aviation and Gulf government targets

Exact hostnames, plus the favicon of the StarkMeet site so that copies of it on new domains also match. Three hosts are from the published reports: the relay g-prx.itugegape524[.]workers[.]dev, and meetonline[.]cam, drivegoogel[.]cam and asdfafadafg[.]online. The others are our own assessment, not taken from a sample: they sit on the servers that hosted the published domains or on neighbouring addresses, were set up between July and October 2026 through the same registrar with its default name servers, and follow the same naming. They are the Google-themed set spelled 'googe' (meetgooge[.]online, drivegooge[.]online, drive-googe[.]online, secure-googe[.]help, gsecurity[.]help, ukcentral[.]team), the government webmail set (mfakuwait[.]online, mail.mofakuwait[.]online, webmail.gcc-sg[.]cloud) and the meeting set (meetlogin[.]online, meetingonline[.]site with its login and m365 hosts, set up 2026-10-07). meetonline[.]cam moved on 2026-08-05 from 65.109.214.145 to 194.62.249.114, and meetlogin[.]online moved on 2026-09-15 to 77.223.215.140; these three addresses tie the sets together. abaddon.dotonehive[.]site points to the same server as drivegoogel[.]cam and asdfafadafg[.]online, 65.109.214.145, which relays HTTPS visitors to Google (they see Google's own certificate and error page) and shows a backgammon game over plain HTTP: cover pages, not content of its own. starkmeet[.]com is a working fake video-meeting site whose download page currently offers no file; it was registered on 2026-09-05, eleven days after the first known StarkMeet installer (2026-08-25), so its tie to the loader is an assessment. Most hosts are dormant: they relay to Google, show a default server page or refuse HTTPS, which is not a sign that they are harmless. Not included: employment-* and employerpanel* recruitment domains on the same hosting provider, which use a different registrar and are likely a separate operation.