ALERT: Impersonation of legitimate advertising networks and companies
This investigation began after I was alerted to the fact that somebody has been posing as a Vonage representative, and using the domain vonage-inc.com while doing so.
The domain vonage-inc.com was created on 5 August 2009, and the ICANN Registrar is BIZCN.COM, Inc. It is hosted by Root Esolutions, Luxembourg (IP address 212.117.166.71).
Registrant details:
Vonage-Inc
Domain Administrator (itadmin@vonage-inc.com)
7322643911 fax 7322643911
4 South Holmdel Road
Holmdel NJ 07733
Interestingly, it looks like Vonage may have already taken control of vonage-inc.com. This is because domaintools.com reports that vonage-inc.com has an IP address of 212.117.166.71, and that it is using the name servers NS1.EVERYDNS.NET and NS2.EVERYDNS.NET but Robtex, on the other hand, reports that vonage-inc.com no longer has an IP address, and that it is using the name servers dns-auth-00.kewr0.s.vonagenetworks.net. dns-auth-00.kiad0.s.vonagenetworks.net. dns-auth-00.klax1.s.vonagenetworks.net and dns-auth-00.klga1.s.vonagenetworks.net.
My grateful thanks go to the gentleman who alerted me to the goings-on involving vonage-inc.com. His alert has led to the exposure of several other domains are could also be used to impersonate legitimate companies.
Several other domains can be found at same IP address that vonage-inc.com was using (212.117.166.71). All of the domains should be treated with extreme caution. When we bear in mind the warning that somebody has been posing as a Vonage representative while using the domain vonage-inc.com, I think it is safe to assume that somebody is planning to pose as (or is already posing as) a representative of Adconion, Carat, Fox Media, Lacoste, Orange or Pubmatic.
Here are details of other domains at IP 212.117.166.71 as at time of writing. All but one are redirecting visitors to other, legitimate, domains.
You will note that all of the domains, bar one, have the same ICANN Registrar, being BIZCN.COM, INC.
adconion-inc.com
ICANN Registrar: BIZCN.COM, Inc
Created 10 Aug 2009
Registrant:
adconion-inc.com
IT Admin (admin@adconion-inc.com)
498951490701 fax: 498951490701
Bayerstrasse 41
Muenchen Bavaria 80335
adconion-inc.com is currently redirecting visitors to the legitimate domain adconion.com (IP 89.110.133.18, ICANN Registrar Ascio Technologies, Inc, Registrant address Lindwurmstr.114, Muenchen, Bavaria 80337)
*****
adjimbo.com
ICANN Registrar: BIZCN.COM, Inc.
Created 9 June 2009
Registrant:
Registar services Co
Jack Omands (jacksosomands@gmail.com)
352691787
10 rue Large
Luxembourg Luxembourg 1918
Address as per web site: 260 Peachtree street, Suite 2200, Atlanta, Georgia 30303, US
Note: 260 Peachtree Street, Suite 2200, is a Regus property. Regus operates business centres, virtual offices, virtual PA's etc.
*****
carat-inc.com
ICANN Registrar: BIZCN.COM, INC
Created 10 August 2009
Registrant:
Carat-inc.com
IT Administrator (admin@carat-inc.com)
441179045055 fax: 441179045055
90 Great Portland Street
London London W1W 5QZ
carat-inc.com is currently redirecting visitors to the legitimate domain carat.com (IP 91.206.177.56, Aegis Group Plc, UK - ICANN Registrar GROUP NBT PLC AKA NETNAMES, Registrant: Aegis Group plc, 180 Great Portland Street, London W1W 5QZ)
*****
foxinteractivemedia-inc.com
ICANN Registrar: BIZCN.COM, INC
Created 10 August 2009
Registrant:
domain admin (admin@foxinteractivemedia-inc.com)
3102750087 fax: 3102750087
424 N. Beverly Dr
Beverly Hills CA 90210
foxinteractivemedia-inc.com is currently redirecting visitors to the legitimate domain fox.com (IP 80.67.66.57, Akamai Technologies, ICANN Registrar MARKMONITOR, INC, Registrant address: Intellectual Property Department, Twentieth Century Fox Film Corporation, PO Box 900, Beverley Hills CA 90213-0900)
*****
lacoste-ads.com (note, we have encountered lacoste-ads.com before, as discussed here:
http://msmvps.com/blogs/spywaresucks/archive/2009/04/23/1690197.aspx)
ICANN Registrar: NETFIRMS, INC
Created 2 March 2009
Registrant details hidden behind a WHOIS privacy protection service (Domain Privacy Group)
lacoste-ads.com is currently redirecting visitors to the legitimate domain lacoste.com (IP 199.93.55.126, ICANN Registrar Core Internet Council of Registrars, Registrant VIAL TRIBOULET catherine, Lacoste S.A., 8 rue de Castiglione, Paris)
*****
orangeadvertising-inc.com
ICANN Registrar: BIZCN.COM, INC
Created 10 August 2009
Registrant:
Orangeadvertising
Network Administrator: admin@orangeadvertising.us
441179045053 fax: 441179045053
6400 North Radcliffe St
Bristol Bristol BS9 4AU
GB
orangeadvertising-inc.com is currently redirecting visitors to the legitimate domain orange.com (IP 194.2.208.16, Telecom France, Registrant: Orange Personal Communications Services Limited, St James Court, Great Park Road, Almondbury Park, Bradley Stoke, Bristol, UK, Tel: )
Note: the domain orangeadvertising.us (used for the Network Administrator's contact email address) has never been registered.
*****
pubmatic-inc.com
ICANN Registrar: BIZCN.COM, INC
Created 10 August 2009
Registrant:
IT Admin (itadmin@pubmatic-inc.com)
6508562386 fax: 6508562386
675 El Camino Real
Palo Alto CA 94301
pubmatic-inc.com is currently redirecting visitors to the legitimate pubmatic.com (IP 69.163.146.58, New Dream Network Llc, California, Registrant: Pubmatic, Inc, PO Box 975, Palo Alto, CA 94302)
*******************************
Other domains in the same IP range:
IP: 212.117.166.74
brightadsnetwork.com (visually almost identical to adjimbo.com – see above)
Address as per web site: 2115 North Charles Street, North Baltimore
ICANN Registrar: BIZCN.COM, INC
Created 14 June 2009
Registrant:
RegServ Co
Norman Jason (normanjason01223@gmail.com)
2127340192
20 Washington Street
New York New York 10006
topleanpro.com
ICANN Registrar: BIZCN.COM, INC
Created 18 June 2009
Registrant:
Domains Inform Inc
Thomas Kleineberg (thomaskleinebergdomains@gmail.com)
498999216255
Maximillianstrasse 18
Munich Munich 80539
*****
IP: 212.117.166.73
ad-advanced.com (address as per web site is Suite 300, 8875 Hidden River Parkway, Tampa which is a Regus asset)
ICANN Registrar: BIZCN.COM, INC
Created 1 July 2009
Registrant:
Norman Sebring (nsebring@rit-consulting.com)
5116 New Centre Drive
WILMINGTON NC 28403
*****
dnzmg.com (web site address Suite 410, 6802 Paragon Place, Richmond, Virginia - another Regus asset)
ICANN Registrar: BIZCN.COM, INC
Created 1 July 2009
Registrant:
Magnetic Wave
Daryl Lewis (markstein@mwa.com)
3035568550 fax: 3035568550
235 Columbine Street
Denver CO 80206
*****
vertixgroup.com (web site address 3525 Piedmont Road, 7 Piedmont Center, Atlanta - this address is for the HP Business Centre, a member of the Regus Group Network)
ICANN Registrar: BIZCN.COM, INC
Created 1 July 2009
Registrant:
Mark Stein (pholexkapsilow@gmail.com) (Mark Stein again? See Daryl Lewis email above)
2158554688 fax: 2158554688
1202 Market Street
Philadelphia PA 19107