This is another follow up to the post “Spammer Alert: milkcheesedns.com”
We’ve received a report that NameCheap finally took notice of spam issue with milkcheesedns.com and suspended the domain. An anonymous tipster fowarded us the message from NameCheap:
Hello,
This is to inform you that milkcheesedns.com domain was suspended. It is now pointed to non-resolving nameservers and will be nullrouted once the propagation is over. The domain is locked for modifications in our system.
Thank you for letting us know about the issue.
We checked the whois information on the domain name and it showed the following:
Domain Name: MILKCHEESEDNS.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: BLOCKEDDUETOSPAM.PLEASECONTACTSUPPORT.COM
Name Server: DUMMYSECONDARY.PLEASECONTACTSUPPORT.COM
Status: clientTransferProhibited
Updated Date: 18-may-2012
Creation Date: 27-feb-2012
Expiration Date: 27-feb-2013
Just today, we’ve uncovered another domain name registered by the same spammer; newbrandhosting.net.
We were tipped off regarding the continuing email spam from nimbleloaf.com. In the body of the email, links to questionableoverthrow.com.
Whois information on questionableoverthrow.com:
Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
Domain name: questionableoverthrow.com
Registrant Contact:
Technical Support ()
Fax:
PO Box 29502
Las Vegas, NV 89126
US
Administrative Contact:
Technical Support (domains@newbrandhosting.net)
+1.7026660363
Fax: +1.5555555555
PO Box 29502
Las Vegas, NV 89126
US
Technical Contact:
Technical Support (domains@newbrandhosting.net)
+1.7026660363
Fax: +1.5555555555
PO Box 29502
Las Vegas, NV 89126
US
Status: Locked
Name Servers:
ns1.grandfatherdns.com
ns2.grandfatherdns.com
Creation date: 10 May 2012 21:55:00
Expiration date: 10 May 2013 13:55:00
Note newbrandhosting.net email address and grandfatherdns.com name servers.
Whois information on grandfatherdns.com:
Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
Domain name: grandfatherdns.com
Registrant Contact:
Rails On Hosting
Sys Admin ()
Fax:
PO Box 660675
Dallas, TX 75266-0675
US
Administrative Contact:
Rails On Hosting
Sys Admin (domains@railsonhosting.com)
+1.7026660363
Fax: +1.7026660363
PO Box 660675
Dallas, TX 75266-0675
US
Technical Contact:
Rails On Hosting
Sys Admin (domains@railsonhosting.com)
+1.7026660363
Fax: +1.7026660363
PO Box 660675
Dallas, TX 75266-0675
US
Status: Locked
Name Servers:
dns1.registrar-servers.com
dns2.registrar-servers.com
dns3.registrar-servers.com
dns4.registrar-servers.com
dns5.registrar-servers.com
Creation date: 28 Feb 2012 00:17:00
Expiration date: 27 Feb 2013 16:17:00
Whois information on railsonhosting.com:
Domain Name: RAILSONHOSTING.COM
Registrant:
Rails On Hosting
Web Admin (contact@railsonhosting.com)
PO Box 105603
#88657
Atlanta
Georgia,30348
US
Tel. +404.6719366
Creation Date: 20-Aug-2010
Expiration Date: 20-Aug-2012
Domain servers in listed order:
ns1.planetonline.net
ns2.planetonline.net
ns3.planetonline.net
ns4.planetonline.net
Administrative Contact:
Rails On Hosting
Web Admin (contact@railsonhosting.com)
PO Box 105603
#88657
Atlanta
Georgia,30348
US
Tel. +404.6719366
Technical Contact:
Rails On Hosting
Web Admin (contact@railsonhosting.com)
PO Box 105603
#88657
Atlanta
Georgia,30348
US
Tel. +404.6719366
Billing Contact:
Rails On Hosting
Web Admin (contact@railsonhosting.com)
PO Box 105603
#88657
Atlanta
Georgia,30348
US
Tel. +404.6719366
The phone number provided for railsonhosting.com is 404-671-9366. It is actually the phone number for DEEP GREEN Waste & Recycling, LLC.
On railsonhosting.com contact page, the contact information is provided as follow:
214-666-6081
PO Box 660675 Dallas, TX 75266-0675
The number 214-666-6081 can also be found at greyscalehost.com contact page.
The number 214-666-6081 actually goes to a voicemail to someone’s office.
Whois information on greyscalehost.com:
Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
Domain name: greyscalehost.com
Registrant Contact:
Firstinline
System Administrator ()
Fax:
1608 S. Ashland Ave
Chicago, IL 60608
US
Administrative Contact:
Firstinline
System Administrator (domains@1stinlinehosting.com)
+1.3128782798
Fax: +1.3128782798
1608 S. Ashland Ave
Chicago, IL 60608
US
Technical Contact:
Firstinline
System Administrator (domains@1stinlinehosting.com)
+1.3128782798
Fax: +1.3128782798
1608 S. Ashland Ave
Chicago, IL 60608
US
Status: Locked
Name Servers:
ns2713.hostgator.com
ns2714.hostgator.com
Creation date: 06 Sep 2011 23:16:00
Expiration date: 06 Sep 2012 15:16:00
That’s not a surprise, it links back to 1stinlinehosting.com.
Whois information on newbrandhosting.net:
Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
Domain name: newbrandhosting.net
Registrant Contact:
NewBrandHosting
George Mason ()
Fax:
PO Box 10188
#88657
Newark, NJ 71014
US
Administrative Contact:
NewBrandHosting
George Mason (domains@newbrandhosting.net)
+1.9737184005
Fax: +1.5555555555
PO Box 10188
#88657
Newark, NJ 71014
US
Technical Contact:
NewBrandHosting
George Mason (domains@newbrandhosting.net)
+1.9737184005
Fax: +1.5555555555
PO Box 10188
#88657
Newark, NJ 71014
US
Status: Locked
Name Servers:
NS1.JUSTHOST.COM
NS2.JUSTHOST.COM
Creation date: 17 Apr 2012 18:35:00
Expiration date: 17 Apr 2013 10:35:00
newbrandhosting.net is using justhost.com name servers.
As you can see, both newbrandhosting.net and questionableoverthrow.com have the same administrative email address; domains@newbrandhosting.net.
The phone number listed for questionableoverthrow.com is 702-666-0363; the same voice recording for 3rdcloudhosting.com, 1stinlinehosting.com, coomahosting.com and 5thavehost.com.
The phone number listed for newbrandhosting.net (973-718-4005) is actually a fax line, and registered to CMS Constructions.
This number is also used as phone number for 1stinlinehosting.com.
Domain Name: 1STINLINEHOSTING.COM
Registrant:
1st Inline Hosting
Domain Admin (contact@1stinlinehosting.com)
PO Box 10188
#88657
Newark
New Jersey,71014
US
Tel. +973.7184005
Creation Date: 20-Aug-2010
Expiration Date: 20-Aug-2012
Domain servers in listed order:
ns1.planetonline.net
ns2.planetonline.net
ns3.planetonline.net
ns4.planetonline.net
Similar Modus Operandi with coomahosting.com using 786-350-1567 that turns out to be a number for ADES Emergency locksmith.
Domain Name: COOMAHOSTING.COM
Registrant:
Cooma Hosting
Cooma Hosting (admin@coomahosting.com)
PO Box 025250
#88657
Miami
Florida,33102
US
Tel. +786.3501567
Creation Date: 20-Aug-2010
Expiration Date: 20-Aug-2012
Domain servers in listed order:
ns1.planetonline.net
ns2.planetonline.net
ns3.planetonline.net
ns4.planetonline.net
On newbrandhost.com, the contact phone number listed is 773-938-0601.
It goes straight to voicemail, the same voicemail system used for 5thavehost.com and 3rdcloudhosting.com phone number as listed in domain name registration (202-505-1004).
Whois information on 5thavehost.com:
Domain Name: 5THAVEHOST.COM
Registrant:
5th Ave Host
5th Ave Host (web@5thavehost.com)
PO Box 3109
#88657
Houston
Texas,77253
US
Tel. +214.2969397
Creation Date: 20-Aug-2010
Expiration Date: 20-Aug-2012
Domain servers in listed order:
ns1.planetonline.net
ns2.planetonline.net
ns3.planetonline.net
ns4.planetonline.net
Whois information on 5thavehost.com:
Domain Name: 3RDCLOUDHOSTING.COM
Registrant:
3rdcloudhosting
Domain Admin (admin@3rdcloudhosting.com)
PO Box 3109
#88657
Houston
Texas,77253
US
Tel. +214.2969397
Creation Date: 20-Aug-2010
Expiration Date: 20-Aug-2012
Domain servers in listed order:
ns1.planetonline.net
ns2.planetonline.net
ns3.planetonline.net
ns4.planetonline.net
Whois information on nimbleoaf.com (abbridged):
Domain name: nimbleloaf.com
Registrant Contact:
5thAveHosting
Domains Mgmt ()
Fax:
PO Box 96503
Washington, DC 20090
US
Administrative Contact:
5thAveHosting
Domains Mgmt (domains@5thavehost.com)
+1.3235270448
Fax: +1.3235270448
PO Box 96503
Washington, DC 20090
US
Contact phone number from the respective sites:
– 1stinlinehosting.com | 312-878-2798 | It is going to a voicemail system.
– coomahosting.com | 847-505-0848 | It is going to a voicemail system, and the voice is the same with the one for 1stinlinehosting.com.
– 5thavehost.com | 202-505-1004 | It is going to a voicemail system in one ring, no options to leave any messages.
Contact phone number for 5thavehost.com from “whois nimbleloaf.com” is 323-527-0448, which is registered to Robert McGee in Los Angeles. The first part of the message says:
“Thank you for calling 3rd cloud hosting.”
It is the same voice from the 1stinlinehosting.com and coomahosting.com.
It is also the same voice from (702) 666-0363; the phone number for domains@newbrandhosting.net from questionableoverthrow.com.
34.03241-118.488406
