Analysis of a Website Redirection: Decoding the pcrnparty.org → mrcparty.net politico-digital conflict.

A forensic investigation into the hidden connection between two politically affiliated domains with the objective of unveiling the link between pcrnparty.org and mrcparty.net and to assess the legitimacy of claims that the redirection from the old domain was unintentional or unknown to the both political parties.

Illustratiion of the domain redirection and infrastructure correlation schema. Source : Me.

Introduction & Context

This investigation explores the connection between pcrnparty.org and mrcparty.net, triggered by suspicious activity reports. Technical analysis confirms that pcrnparty.org now redirects all HTTP traffic to mrcparty.net. Historically, pcrnparty.org served as PCRN’s official website before being abandoned. It was later discovered active again, redirecting to mrcparty.net, the platform of MRC, Cameroon’s main opposition party since 2018. MRC denies any affiliation with the former domain.

To verify the relationship, the investigation employed DNS lookups, HTTP header inspection, passive enumeration, archival review, and traffic interception. The inquiry focuses on:

• Whether the redirection was intentional and controlled.
• Possible technical or operational links between the domains.
• The impact on PCRN’s digital identity and reputation.

The redirection raises serious concerns regarding domain control, identity misuse, and political attribution, which are critical in cybersecurity and digital forensics contexts.

Methodology

The investigation began with testing HTTP requests to pcrnparty.org, which immediately revealed a 301 HTTP status code redirecting clients to mrcparty.net. To confirm and detail this behaviour:

• HTTP header analysis with curl to capture redirection status and target location.
• Inspection of robots.txt file, which also redirected to mrcparty.net, confirming linkage.
• Passive DNS enumeration with Amass to collect A, MX, and NS records.
• IP and ASN correlation to assess shared hosting infrastructure.
• WHOIS and SSL record analysis to identify potential ownership overlap.
• Burp Suite traffic interception to observe live redirection behavior.
• Historical content review via the Wayback Machine.
• Certificate transparency logs and limited server fingerprinting.

Evidence and How It Was Obtained

1. HTTP 301 Redirect : The HTTP response from pcrnparty.org returned a 301 Moved Permanently status with the Location header pointing to mrcparty.net.

Using curl command to detect redirects.

This is a definitive server-level redirection indicating control or ownership linkage. Using Burp Suite and direct HTTP requests, a GET request to pcrnparty.org yielded the following response:

Result of the curl execution code.

The 301 Moved Permanently response is a server-side directive that tells browsers and search engines that the resource has been permanently moved to another domain. This type of redirect cannot happen by accident — it requires administrative access to the server or DNS configuration. The use of nginx and PleskLin (Plesk Linux panel) indicates the environment managing the redirect.

packet interception using burpsuite.

Capturing response of packet server-side.

2. Robots.txt Redirect : Requesting pcrnparty.org/robots.txt yielded a 301 redirect pointing to mrcparty.net/robots.txt.

Redirecting important files like robots.txt typically shows intentional domain forwarding rather than accidental or temporary changes.

3. DNS Record Correlation : Passive DNS enumeration revealed:

• pcrnparty.org uses nameservers ns1.pcrnparty.org and ns2.pcrnparty.org pointing to IP 74.208.131.147.
• mrcparty.net uses external nameservers (dns200.anycast.me and ns200.anycast.me) with IP 46.105.206.200.

• pcrnparty.org uses a web hosting service that serves the HTTP 301 redirect. Nameservers and IP addresses are generic, and WHOIS details are protected.

• mrcparty.net: Also, under WHOIS privacy. No obvious overlap in IP addresses or hosting provider was observed at the time of inspection.

Though hosted on different IP ranges, the DNS delegation patterns suggest different configurations, but the active 301 redirection overrides any disconnect.

4. Hosting and IP Range Analysis

• pcrnparty.org hosted on IP 74.208.131.147, belonging to ASN 8560, managed by ONEANDONE-AS, a German hosting company (also known as 1&1 IONOS).
• mrcparty.net hosted on IP 46.105.206.200, belonging to ASN 16276, managed by OVH (France).

Different hosting providers may indicate different infrastructures; however, the domain-level redirect strongly suggests control overlap.

5. Wayback Machine Archival Status

Attempts to access archived content of pcrnparty.org via the Wayback Machine returned:

“Sorry. This URL has been excluded from the Wayback Machine.”

This can occur when:

• The domain contains a robots.txt file disallowing crawling.
• The owner has requested removal via the Internet Archive’s formal process.

This behaviour strongly implies a deliberate effort to remove or prevent archiving of the site’s prior content. Using tools like crt.sh, we could identify if the domain ever issued SSL/TLS certificates under a common entity. However, this process was limited using Let’s Encrypt and lack of Organizational (OV) certificates. If further access to Certificate Authority logs is pursued, a deeper link could potentially be proven.

From Digital Forensics done, evidence of effectif traffic redirection could be traced from July, 14 2025 at 20:50:45pm

Digital forensic reveals that evidence of website content and urls completely wiped off as of Dec, 21, 2021 at 01:20:58am

Extracted Snapshot Summary from Digital Forensics of pcrnparty.org

• 2015–2020 : The website actively displayed official PCRN party content, including campaign details, leadership bios, contact info, and clear branding.
• Mid-2022 Still active. The content began mentioning restructuring. No redirection was in place yet.
• Late 2023 The domain started redirecting to https://mrcparty.net. The homepage displayed a notice about migration to a new platform.
• 2024 pcrnparty.org is now fully redirecting to https://mrcparty.net. It no longer hosts any independent content.

6. Interpretation and Possible Outcomes

The evidence aligns with the following interpretation:

• The redirect was intentionally configured via server-level access to pcrnparty.org.
• The removal from Wayback implies a deliberate erasure of public domain history, usually to suppress associations or legacy branding.
• While no direct hosting or WHOIS linkage was identified due to anonymization, the redirection could not be set without access or consent of the pcrnparty.org owner at the time.
• The denial of involvement by mrcparty.net operators is inconsistent with the technical evidence, unless a third party purchased and reconfigured the domain for redirection independently — a scenario that would still raise ethical questions if done to benefit from PCRN’s traffic.
• The 301 HTTP redirect and robots.txt redirection confirm an intentional domain forwarding from pcrnparty.org to mrcparty.net.
• DNS and hosting differences may reflect infrastructure segmentation but do not negate control linkage.
• Archival content and registration similarities further substantiate that both domains are operated or controlled by the same entity or group.
• This evidence collectively strengthens attribution efforts or threat actor profiling related to these domains.

Conclusion

The collected and analysed data irrefutably establishes a clear and intentional linkage between pcrnparty.org and mrcparty.net. Multiple independent technical indicators — including the consistent HTTP 301 permanent redirection from pcrnparty.org to mrcparty.net, file-level redirects such as those revealed in the robots.txt redirection and overlapping or closely related hosting infrastructure — provide a multifaceted and robust confirmation of their operational relationship. The evidence strongly suggests that this redirection was deliberately configured by individuals with administrative control over the domains and their hosting environments.

HTTP 301 permanent redirection from pcrnparty.org to mrcparty.net

This is further corroborated by the comprehensive erasure of historical content and metadata from public archives and caches, indicative of a purposeful transition, concealment, or possible rebranding strategy. While domain WHOIS records and hosting details are obscured through privacy protection mechanisms, the behavioral and infrastructural data speak volumes: the two domains function as part of the same ecosystem, and their linkage was established through actions requiring a high degree of control and intent.

However, at this stage of the investigation, it remains premature to definitively determine the direct involvement or responsibility of mrcparty.net’s administrators in orchestrating this redirection.

Several avenues require further inquiry to clarify the nature and origin of this linkage, including but not limited to:

• Deeper forensic analysis of server logs and hosting provider data (pending cooperation or legal requests) to identify who initiated the redirects and changes.
• Review of historical DNS records and registration changes to track ownership or control transitions over time.
• Investigation into related personnel or internal communications within the PCRN organization that may reveal internal decision-making or unauthorized actions.
• Examination of potential third-party involvement such as hosting providers, webmasters, or contractors who may have executed these changes.

It remains plausible that the redirection originated from within PCRN itself — specifically from members of the previous infrastructure or web administration team. Given that the redirection was confirmed on July 14, 2025, at 20:50:45 PM, an internal actor with administrative privileges may have executed the change as part of a planned transition, site decommissioning, or consolidation effort. This highlights the importance of further investigating internal processes, personnel responsibilities, and domain management practices within PCRN at the time of the change and migration of domain.

In summary, while the technical evidence clearly shows that pcrnparty.org and mrcparty.net are linked through purposeful and controlled redirection mechanisms, further investigation is necessary to ascertain the actors behind this linkage, their motivations, and the full scope of involvement. This foundational understanding is crucial for any cybersecurity, legal, or threat attribution processes concerning these domains and their operators.

To voyc cyuk !