December 17, 2004 October is Koufax Pledge Drive month

Dementia, Domains, Patents and Spam

ICANNWatch has a plesant surprise today. If you bought a domain using a web browser with a forms interface and a mouse click, and it wasn't from GoDaddy (or its alter egos such as Wild West Domains), then you violated GoDaddy's patent.

To be fair, GoDaddy doesn't have a patent on dementia in the domain name business. Register.Com has a patent on a method to mine whois data, only slightly encumbered by the nit that their patent applies to the root zone, where it might be useful to discover new countries before anyone else. Dotster has a patent on programatically quering a whois server and conditionally invoking a notification mechanism. Nominum has a patent on everything criminally insane that Verisign's SiteFinder (now enjoined by ICANN in a phenominally rare moment of sanity) did -- turning a query or a typo for a non-existant name into a browser redirection to a penis enlargement, er, online casino, er, "your typo is available" Network Solutions retail store. Verisign has a patent on a form with two or more click-on boxes for top level domains. RareDomains (Michael Mann) has a patent on forming domain names from roots, stems and twigs.

Closer to home, Jonah's sleep event provided me the opportunity to find out which registrar(s) are contributory profiteers in the current texas hold'em unpaid ad insertion campaign. The sample consists of these names:

.com: australia-online-travel maloylawn monavaletoys mrgoicoechea texasproptax
.info: commodity-trading-4u currency-converter-4u currency-exchange-4u currency-trading-4u forex-4u forex-trading-4u forex-trading-system-4u online-forex-trading-4u vintage-watces-4u
.us: academyofic acrs hermosa vonormytexas

and these names:
.co.uk: 1stincomeracing digitaltwist fortisenterprises handmade2000 kardtoons philippestarckwatches sicarrow wayshell woodyracing

The registrar of record for the first group, the names in the .com (Verisign), .info (Afilias) and .us (Neustar) registries, is Markmonitor. The economic beneficiaries for that part of the spam payload are: $30 to Verisign, $45 to Afilias (or less), and $20 to NeuStar, and on the order of a dollar per name to Markmonitor to place the buys, or another $20. Total cost between $70 and $105.

The second group has the property that all registrations in the .co.uk domain are via Nominum, but what is more interesting is that all are made by an ... individualistic individual


THE REGISTRANT IS AN INDIVIDUAL WHO HAS ELECTED TO
HAVE THEIR ADDRESS OMITTED FROM THE WHOIS DATABASE

and the user's agent reference all are to afterdomains (not in url form for a reason), in the .co.uk domain, hosted by Fasthosts Internet of Gloucester, on RIPE-213 (213.0.0.0/8). This is redirected to ... bingohall (also not in url form for a reason), also in the .co.uk domain, hosted by Cytech Ltd. in Belize, on MIT-AQUAG-4 (66.212.227.112/28), which is a reassignment from MIT-BLK-01 (66.212.224.0/19), a direct assignment by ARIN to Mohawk Internet Technologies of Kahnawake, PQ. Sensibly, the British bingo parlor has a "fully licensed by the Kahnawake gaming Commission." claim in its about us blurb, and a 120x210 "KAHNAWAKE gaming commission" gif, and a claim to be affiliated with GlobalCom, who are in the 36 story steel and glass tower at 333 West Wacker tower which KanAm recently bought for $208m.

So, the Texas Holdem comments scam is being run out of Suite 1500 (link to exterior phots above), using the namespaces of the .com, .info, .us and .co.uk registry operators, and MarkMonitor as the buyer, and a $10,000 license (at first glance) from the Kahnawake GC (not an IGA operation, being (a) in Canada, and (b) on-line, and (c) in the UK and Belize), who retain operational control of the CIDR allocation the .co.uk name resolves into (in Belize). The nameserver operator is DNS-1995.NET, which doesn't resolve any of the names in the package (but remember, these are inserted weeks "behind" the current in the target blog, and so are not intended to be clicked up in the present, only to be indexed by ranking spiders, and possibly resolvable at some point in the future), and which in turn is an anonymous registration via the registrar Gandi.

It looks like there are deep pockets on West Wacker, and the pockets in San Francisco, Dulles, Dulles, Toronto and London are all deep as well (ordering intentional), and a vulnerale licensing claim. What we bloggers need to do is aggregate our nuisance claims and fletch all the wood with one legal eagle's tail feathers.

Apropos of nothing, our comment scamspamer of the moment is tataelxsi.co.in, which is sort of surprising. Usually its a dsl or cable M$ drone.

Posted by EBW at December 17, 2004 07:29 AM | TrackBack
Comments