{"id":8135,"date":"2012-05-19T21:40:21","date_gmt":"2012-05-20T04:40:21","guid":{"rendered":"http:\/\/37prime.wordpress.com\/?p=8135"},"modified":"2012-05-19T21:40:21","modified_gmt":"2012-05-20T04:40:21","slug":"spammer-alert-newbrandhosting-net","status":"publish","type":"post","link":"https:\/\/37prime.com\/news\/2012\/05\/19\/spammer-alert-newbrandhosting-net\/","title":{"rendered":"Spammer Alert: newbrandhosting.net"},"content":{"rendered":"

This is another follow up to the post \u201cSpammer Alert: milkcheesedns.com<\/a>\u201d<\/p>\n

We’ve received a report that NameCheap finally took notice of spam issue with milkcheesedns.com and suspended the domain. An anonymous tipster fowarded us the message from NameCheap:<\/p>\n

Hello,<\/p>\n

This is to inform you that milkcheesedns.com domain was suspended. It is now pointed to non-resolving nameservers and will be nullrouted once the propagation is over. The domain is locked for modifications in our system.<\/p>\n

Thank you for letting us know about the issue.<\/p><\/blockquote>\n

We checked the whois information on the domain name and it showed the following:<\/p>\n

Domain Name: MILKCHEESEDNS.COM
\nRegistrar: ENOM, INC.
\nWhois Server: whois.enom.com
\nReferral URL: http:\/\/www.enom.com
\nName Server: BLOCKEDDUETOSPAM.PLEASECONTACTSUPPORT.COM
\nName Server: DUMMYSECONDARY.PLEASECONTACTSUPPORT.COM
\nStatus: clientTransferProhibited
\nUpdated Date: 18-may-2012
\nCreation Date: 27-feb-2012
\nExpiration Date: 27-feb-2013<\/p><\/blockquote>\n

Just today, we’ve uncovered another domain name registered by the same spammer; newbrandhosting.net.<\/p>\n

We were tipped off regarding the continuing email spam from nimbleloaf.com. In the body of the email, links to questionableoverthrow.com.<\/p>\n

Whois information on\u00a0questionableoverthrow.com:<\/p>\n

Registration Service Provided By: Namecheap.com
\nContact: support@namecheap.com
\nVisit: http:\/\/namecheap.com<\/p>\n

Domain name: questionableoverthrow.com<\/p>\n

Registrant Contact:<\/p>\n

Technical Support ()<\/p>\n

Fax:
\nPO Box 29502
\nLas Vegas, NV 89126
\nUS<\/p>\n

Administrative Contact:<\/p>\n

Technical Support (domains@newbrandhosting.net)
\n+1.7026660363
\nFax: +1.5555555555
\nPO Box 29502
\nLas Vegas, NV 89126
\nUS<\/p>\n

Technical Contact:<\/p>\n

Technical Support (domains@newbrandhosting.net)
\n+1.7026660363
\nFax: +1.5555555555
\nPO Box 29502
\nLas Vegas, NV 89126
\nUS<\/p>\n

Status: Locked<\/p>\n

Name Servers:
\nns1.grandfatherdns.com
\nns2.grandfatherdns.com<\/p>\n

Creation date: 10 May 2012 21:55:00
\nExpiration date: 10 May 2013 13:55:00<\/p><\/blockquote>\n

Note newbrandhosting.net email address and grandfatherdns.com name servers.<\/p>\n

Whois information on grandfatherdns.com:<\/p>\n

Registration Service Provided By: Namecheap.com
\nContact: support@namecheap.com
\nVisit: http:\/\/namecheap.com<\/p>\n

Domain name: grandfatherdns.com<\/p>\n

Registrant Contact:
\nRails On Hosting
\nSys Admin ()<\/p>\n

Fax:
\nPO Box 660675
\nDallas, TX 75266-0675
\nUS<\/p>\n

Administrative Contact:
\nRails On Hosting
\nSys Admin (domains@railsonhosting.com)
\n+1.7026660363
\nFax: +1.7026660363
\nPO Box 660675
\nDallas, TX 75266-0675
\nUS<\/p>\n

Technical Contact:
\nRails On Hosting
\nSys Admin (domains@railsonhosting.com)
\n+1.7026660363
\nFax: +1.7026660363
\nPO Box 660675
\nDallas, TX 75266-0675
\nUS<\/p>\n

Status: Locked<\/p>\n

Name Servers:
\ndns1.registrar-servers.com
\ndns2.registrar-servers.com
\ndns3.registrar-servers.com
\ndns4.registrar-servers.com
\ndns5.registrar-servers.com<\/p>\n

Creation date: 28 Feb 2012 00:17:00
\nExpiration date: 27 Feb 2013 16:17:00<\/p><\/blockquote>\n

Whois information on railsonhosting.com:<\/p>\n

Domain Name: RAILSONHOSTING.COM<\/p>\n

Registrant:
\nRails On Hosting
\nWeb Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@railsonhosting.com)
\nPO Box 105603
\n#88657
\nAtlanta
\nGeorgia,30348
\nUS
\nTel. +404.6719366<\/p>\n

Creation Date: 20-Aug-2010
\nExpiration Date: 20-Aug-2012<\/p>\n

Domain servers in listed order:
\nns1.planetonline.net
\nns2.planetonline.net
\nns3.planetonline.net
\nns4.planetonline.net<\/p>\n

Administrative Contact:
\nRails On Hosting
\nWeb Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@railsonhosting.com)
\nPO Box 105603
\n#88657
\nAtlanta
\nGeorgia,30348
\nUS
\nTel. +404.6719366<\/p>\n

Technical Contact:
\nRails On Hosting
\nWeb Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@railsonhosting.com)
\nPO Box 105603
\n#88657
\nAtlanta
\nGeorgia,30348
\nUS
\nTel. +404.6719366<\/p>\n

Billing Contact:
\nRails On Hosting
\nWeb Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@railsonhosting.com)
\nPO Box 105603
\n#88657
\nAtlanta
\nGeorgia,30348
\nUS
\nTel. +404.6719366<\/p><\/blockquote>\n

The phone number provided for railsonhosting.com is 404-671-9366. It is actually the phone number for DEEP GREEN Waste & Recycling, LLC<\/a>.<\/p>\n

On railsonhosting.com contact page, the contact information is provided as follow:<\/p>\n

214-666-6081
\nPO Box 660675 Dallas, TX 75266-0675<\/p><\/blockquote>\n

The number 214-666-6081 can also be found at greyscalehost.com contact page.<\/p>\n

The number 214-666-6081 actually goes to a voicemail to someone’s office.<\/p>\n

Whois information on greyscalehost.com:<\/p>\n

Registration Service Provided By: Namecheap.com
\nContact: support@namecheap.com
\nVisit: http:\/\/namecheap.com<\/p>\n

Domain name: greyscalehost.com<\/p>\n

Registrant Contact:
\nFirstinline
\nSystem Administrator ()<\/p>\n

Fax:
\n1608 S. Ashland Ave
\nChicago, IL 60608
\nUS<\/p>\n

Administrative Contact:
\nFirstinline
\nSystem Administrator (domains@1stinlinehosting.com)
\n+1.3128782798
\nFax: +1.3128782798
\n1608 S. Ashland Ave
\nChicago, IL 60608
\nUS<\/p>\n

Technical Contact:
\nFirstinline
\nSystem Administrator (domains@1stinlinehosting.com)
\n+1.3128782798
\nFax: +1.3128782798
\n1608 S. Ashland Ave
\nChicago, IL 60608
\nUS<\/p>\n

Status: Locked<\/p>\n

Name Servers:
\nns2713.hostgator.com
\nns2714.hostgator.com<\/p>\n

Creation date: 06 Sep 2011 23:16:00
\nExpiration date: 06 Sep 2012 15:16:00<\/p><\/blockquote>\n

That’s not a surprise, it links back to 1stinlinehosting.com.<\/p>\n

Whois information on newbrandhosting.net:<\/p>\n

Registration Service Provided By: Namecheap.com
\nContact: support@namecheap.com
\nVisit: http:\/\/namecheap.com<\/p>\n

Domain name: newbrandhosting.net<\/p>\n

Registrant Contact:
\nNewBrandHosting
\nGeorge Mason ()<\/p>\n

Fax:
\nPO Box 10188
\n#88657
\nNewark, NJ 71014
\nUS<\/p>\n

Administrative Contact:
\nNewBrandHosting
\nGeorge Mason (domains@newbrandhosting.net)
\n+1.9737184005
\nFax: +1.5555555555
\nPO Box 10188
\n#88657
\nNewark, NJ 71014
\nUS<\/p>\n

Technical Contact:
\nNewBrandHosting
\nGeorge Mason (domains@newbrandhosting.net)
\n+1.9737184005
\nFax: +1.5555555555
\nPO Box 10188
\n#88657
\nNewark, NJ 71014
\nUS<\/p>\n

Status: Locked<\/p>\n

Name Servers:
\nNS1.JUSTHOST.COM
\nNS2.JUSTHOST.COM<\/p>\n

Creation date: 17 Apr 2012 18:35:00
\nExpiration date: 17 Apr 2013 10:35:00<\/p><\/blockquote>\n

newbrandhosting.net is using justhost.com name servers.<\/p>\n

As you can see, both newbrandhosting.net and questionableoverthrow.com have the same administrative email address; domains@newbrandhosting.net.
\nThe phone number listed for questionableoverthrow.com is 702-666-0363; the same voice recording for 3rdcloudhosting.com, 1stinlinehosting.com, coomahosting.com and 5thavehost.com.<\/p>\n

The phone number listed for newbrandhosting.net (973-718-4005) is actually a fax line, and registered to CMS Constructions.
\nThis number is also used as phone number for 1stinlinehosting.com.<\/p>\n

Domain Name: 1STINLINEHOSTING.COM<\/p>\n

Registrant:
\n1st Inline Hosting
\nDomain Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@1stinlinehosting.com)
\nPO Box 10188
\n#88657
\nNewark
\nNew Jersey,71014
\nUS
\nTel. +973.7184005<\/p>\n

Creation Date: 20-Aug-2010
\nExpiration Date: 20-Aug-2012<\/p>\n

Domain servers in listed order:
\nns1.planetonline.net
\nns2.planetonline.net
\nns3.planetonline.net
\nns4.planetonline.net<\/p><\/blockquote>\n

Similar Modus Operandi with coomahosting.com using 786-350-1567 that turns out to be a number for ADES Emergency locksmith.<\/p>\n

Domain Name: COOMAHOSTING.COM<\/p>\n

Registrant:
\nCooma Hosting
\nCooma Hosting\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (admin@coomahosting.com)
\nPO Box 025250
\n#88657
\nMiami
\nFlorida,33102
\nUS
\nTel. +786.3501567<\/p>\n

Creation Date: 20-Aug-2010
\nExpiration Date: 20-Aug-2012<\/p>\n

Domain servers in listed order:
\nns1.planetonline.net
\nns2.planetonline.net
\nns3.planetonline.net
\nns4.planetonline.net<\/p><\/blockquote>\n

On newbrandhost.com, the contact phone number listed is 773-938-0601.
\nIt goes straight to voicemail, the same voicemail system used for 5thavehost.com and 3rdcloudhosting.com phone number as listed in domain name registration (202-505-1004).<\/p>\n

Whois information on 5thavehost.com:<\/p>\n

Domain Name: 5THAVEHOST.COM<\/p>\n

Registrant:
\n5th Ave Host
\n5th Ave Host\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (web@5thavehost.com)
\nPO Box 3109
\n#88657
\nHouston
\nTexas,77253
\nUS
\nTel. +214.2969397<\/p>\n

Creation Date: 20-Aug-2010
\nExpiration Date: 20-Aug-2012<\/p>\n

Domain servers in listed order:
\nns1.planetonline.net
\nns2.planetonline.net
\nns3.planetonline.net
\nns4.planetonline.net<\/p><\/blockquote>\n

Whois information on 5thavehost.com:<\/p>\n

Domain Name: 3RDCLOUDHOSTING.COM<\/p>\n

Registrant:
\n3rdcloudhosting
\nDomain Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (admin@3rdcloudhosting.com)
\nPO Box 3109
\n#88657
\nHouston
\nTexas,77253
\nUS
\nTel. +214.2969397<\/p>\n

Creation Date: 20-Aug-2010
\nExpiration Date: 20-Aug-2012<\/p>\n

Domain servers in listed order:
\nns1.planetonline.net
\nns2.planetonline.net
\nns3.planetonline.net
\nns4.planetonline.net<\/p><\/blockquote>\n

Whois information on nimbleoaf.com (abbridged):<\/p>\n

Domain name: nimbleloaf.com<\/p>\n

Registrant Contact:
\n5thAveHosting
\nDomains Mgmt ()<\/p>\n

Fax:
\nPO Box 96503
\nWashington, DC 20090
\nUS<\/p>\n

Administrative Contact:
\n5thAveHosting
\nDomains Mgmt (domains@5thavehost.com)
\n+1.3235270448
\nFax: +1.3235270448
\nPO Box 96503
\nWashington, DC 20090
\nUS<\/p><\/blockquote>\n

Contact phone number from the respective sites:
\n– 1stinlinehosting.com | 312-878-2798 | It is going to a voicemail system.
\n– coomahosting.com | 847-505-0848 | It is going to a voicemail system, and the voice is the same with the one for 1stinlinehosting.com.
\n– 5thavehost.com | 202-505-1004 | It is going to a voicemail system in one ring, no options to leave any messages.<\/p>\n

Contact phone number for 5thavehost.com from \u201cwhois nimbleloaf.com\u201d is 323-527-0448, which is registered to Robert McGee in Los Angeles. The first part of the message says:<\/p>\n

\u201cThank you for calling 3rd cloud hosting.\u201d<\/p>\n

It is the same voice from the 1stinlinehosting.com and coomahosting.com.
\nIt is also the same voice from (702) 666-0363; the phone number for domains@newbrandhosting.net from questionableoverthrow.com.<\/p>\n","protected":false},"excerpt":{"rendered":"

This is another follow up to the post \u201cSpammer Alert: milkcheesedns.com\u201d We’ve received a report that NameCheap finally took notice of spam issue with milkcheesedns.com and suspended the domain. An anonymous tipster fowarded us the message from NameCheap: Hello, This is to inform you that milkcheesedns.com domain was suspended. It is now pointed to non-resolving … <\/p>\n

Continue reading “Spammer Alert: newbrandhosting.net”<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":11583,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[946,4],"tags":[598,2511,2619,2648,2769,936],"class_list":["post-8135","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-announcements","category-news","tag-can-spam-act","tag-resources","tag-scam","tag-security","tag-spam","tag-tech","post_format-post-format-standard"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pcNtU-27d","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/8135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/comments?post=8135"}],"version-history":[{"count":0,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/8135\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/media?parent=8135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/categories?post=8135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/tags?post=8135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}