Sign In
Create Account
8
This topic is locked
estMate, on Sep 11 2008, 02:07 AM, said:
hedgehog: These domains have been suspended, thank You
Suzi: We've suspended vids365.com. As for the false whois information - we don't allow this and even if there wasn't any Zlob on this domain name it'd be suspended after the investigation.
In case there really was some identity theft, we'll definitely deal with this. Please give me all information you have regarding the issue, why do you think that there was any identity theft, and we'll investigate this.
http://sunbeltblog.blogspot.com/2008/09/sc...-update_10.html all domains were already suspended
Suzi: We've suspended vids365.com. As for the false whois information - we don't allow this and even if there wasn't any Zlob on this domain name it'd be suspended after the investigation.
In case there really was some identity theft, we'll definitely deal with this. Please give me all information you have regarding the issue, why do you think that there was any identity theft, and we'll investigate this.
http://sunbeltblog.blogspot.com/2008/09/sc...-update_10.html all domains were already suspended
Regarding domains registered with stolen IDs, I have not contacted these people to confirm this, although I know someone who often does that. But, using some common sense, think about.. a domain serving rogue AV or malware, on an IP address with a number of other domains serving malware, and the other domains are registered to individuals in RU, Estonia, or CN, etc. then you have one or two registered to someone like a "John Jones at 123 Main St., Smalltown, USA" -- it's not likely that John Jones *really* registered that domain. In every similar case I'm aware of, when the registrant was called, they were confrimed to be ID theft victims.
Regarding false whois information, I used to report such domains with obviously false info here:
http://wdprs.internic.net/
In every case when the registrar was Estdomains, reporting it had no effect. So Igave up. I have not reported any there recently because in the past nothing was done.
Here is another domain being used to serve malware:
updatepanel.us/ctl/crfiles/tdssadw
updatepanel.us/ctl/crfiles/tdssl
updatepanel.us/ctl/crfiles/tdsslog
updatepanel.us/ctl/crfiles/tdssmain
updatepanel.us/ctl/crfiles/tdsspopup
updatepanel.us/ctl/crfiles/tdssserv
etc.
tdssserv is part of a nasty rootkit that makes many severe changes to the infected computer.
http://whois.domaint.../updatepanel.us <--- note the registrant information -- possibly another ID theft victim, unless it's false info.
Back to top
)
