Saturday, January 11, 2014

Vampires and Their Strange Connections

This article is the continuation to an earlier article I posted that talks about the referral spam scourge blogspot bloggers must cope with: referrer spam from the VampireLeStat. For the curious, the original post provides some contextual background details about the research I did to see if I could learn more about who is behind the bot.

With the latest round of referral spam from VampireLeStat flooding the logs, I noticed another domain joining the faker fray. Name changes in regards to spam-bots are irrelevant because of the nature of a deviant beast is deception. What's interesting are the details that begin to form an almost Gestalt-like closure after I did a WhoIs search for the DNS registrar of the new name. A quick lookup turned up a common DNS provider who has enough recognition to have earned an entry in Wikipedia.

I took a peek at the Wikipedia article on the host and the first thing I noticed was interaction they had a legal battle with Neiman Marcus regard the use of what Neiman Marcus considered deceptive usage of variations on their trademarked name. This quote from Wiki article smelled badly of a familiar tactic:

"The companies declared the domain registrars Name.com and Spot Domain had registered over 40 domains of various misspellings, such as NeimanMarco.com and BerdgorfGoodman.com. These domains failed to show accurate contact information or provided false details"

My appetite to waste a little more time grew. Digging into the second article I discovered that the owner of domain host appears to be Bill Mushkin who lives in... drum roll... Denver Colorado. Who else had a business registered in Denver? Hmm, let me think? Oh yeah, Protected Domain Services did. Ah, but now it's time for the ba-dump-dump of the drum sticks. Mushkin had a connection with one of the other companies involved in the Neiman Marus lawsuit which was Field, Lake & Sky. Can you guess which state Field, Lake & Sky was doing business in? Wyoming. For those of you who went back and read my first posting, I talked about how Christian Investments LLC was listed in the Colorado business database as part of the contact information for Protected Domain Services and was registered to do business in Wyoming. Interesting indeed.