Is Moniker doing something fishy with referrers?

[labrocca]

So I had a problem with a couple of my sites that the referrer log was showing all these domains with poker pages that redirected to 888.com and various other poker sites. Not a big deal as I know how referrer scripts work. Well today I decided to investigate further to see if I could firewall the sites because usually it's from the same IP.

http://server5.theimagehosting.com/image.php?img=referrer.gif

So upon doing whois checks lo and behold...they are all registered at Moniker. Each has a seperate NameServer and each has a different whois owner. However I believe they all are using the same IP address.

What is Moniker doing? I have had zero issues with Moniker and found them to be excellent but I really can't say I like what I see in this. Also note my PSPforums is registered at Moniker. I do point the DNS to my servers though. Can Moniker see the traffic to my site as the registrar? Are they using that information to referrer spam me?

I am really confused and would like to get to the bottom of this. I wasn't sure where to post this so I hope this is the most appropriate place.

http://whois.sc/lizscottrawson.com
http://whois.sc/poker-4all.com
http://whois.sc/strega.us
http://whois.sc/unitedinchristchurch.org
http://whois.sc/wkelleylucas.com

64.234.220.141 This is the IP with the issue.

 

[Dave Zan]

Have you emailed Monte about this before posting here?

 

[labrocca]

I was planning on it eventually. I wanted to hear if anyone had any thoughts on this.

 

[Monte]

labrocca - I am totally confused by your post. Are you saying that by using our registrar that your traffic is in some way is being redirected even though the DNS being used is not ours?

I would like to clear this up and help you in any way I can so email me or my customer support department so we can resolve - thanks

 

[labrocca]

Well I am very doubtful that is the issue.

It could totally be coincidence too that all these referrer spammers are registered at Moniker. It makes me wonder though.

Can you tell me more about that IP address Monty. I find it very strange that those domains are all owned by different people and have different DNS but the IP of each DNS is the same. And the only real connection is that they are all Moniker registered. Also none of the domains resolve without the www. So that means they are setup the exact same. I find it impossible to believe these are names are owned by different people.

I would like some explanation to this.

Hey look I didn't notice a 6th one.
http://whois.sc/texasholdemcenteral.com

Moniker and same IP with a different owner.

I wonder if I change my refferer logs to top 100 instead of top 50 I would see even more of this.

The texasholdemcenteral (yes it's a typo domain) has the owner listed with a support-24x7.biz email address which only goes to a Moniker parking page.

http://whois.sc/support-24x7.biz

The LIZSCOTTRAWSON.COM site has TEAM-SUPPORT-24X7.NET as the owners email address. Guess what...

http://whois.sc/team-support-24x7.net

Also owned by Moniker.

This looks to me like I just ran into the shell game of sites. Any comments on this Monte? You have a great rep in my eyes but this looks sort of odd.

If you look at my original image of my referrer logs you can see how much action those sites have created on my server. Who should I send the bill to for the extra bandwidth?


Let's keep this going shall we...

UNITEDINCHRISTCHURCH.ORG

Whois owner has a TOP-SUPPORT.NET email.

http://whois.sc/top-support.net

Again shows Moniker as the whois registrar. There is also a familiarity with some of the names. I see a Role Betina, Role Monika, Darrion Daniella,Ron Miles, Phil Jane....I see some Smiths too. All the whois sites for all these domains have different names and different addresses. It just doesn't make any sense that this is legit whois information.

Some show parked at DomainSystems.com.

I really need to hear some comments from other DNFers about this. Should any of us be concerned over the practices at Moniker?

Hey look I found more evidence of the referrer spamming by MONIKER.
=========================================================
http://spam.tinyweb.net/article.php/broken-referrer-spam
http://www.franklinmint.fm/blog/archives/000276.html
http://photodude.com/article/2614/
http://www.codythefreak.net/vendetta/moniker.txt
http://www.annelisabeth.com/blog/archives/000151.html
http://www.wvmountainhome.com/blog/archives/category/site/spam/page/2/
=========================================================

Seems that Moniker is in the referrer spamming and fake whois information business suddenly. Do you really make that much money from it Monte? Is it really worth it?

 

[MediaHound]

It could totally be coincidence too that all these referrer spammers are registered at Moniker. It makes me wonder though.

I know one for sure that's registered at Moniker - ReferrerSpam.com :-D

But, seriously, Monte & Mike have much better things to do with their time than play around with referrer spam. They are among the absolute best registrars.

Oh, and when you say team-support-24x7.net is owned by Moniker, look again..

http://whois.sc/team-support-24x7.net

Also owned by Moniker.

Monika, Role
Monika
L. G. Smith Blvd.
82
Aruba
AW
AW
23A5 W1

It's owned by a `Monika`, not `Moniker`

 

[Dave Zan]

So upon doing whois checks lo and behold...they are all registered at Moniker. Each has a seperate NameServer and each has a different whois owner. However I believe they all are using the same IP address.

I am really confused and would like to get to the bottom of this. I wasn't sure where to post this so I hope this is the most appropriate place.

http://whois.sc/lizscottrawson.com
http://whois.sc/poker-4all.com
http://whois.sc/strega.us
http://whois.sc/unitedinchristchurch.org
http://whois.sc/wkelleylucas.com

64.234.220.141 This is the IP with the issue.

Just checked them all out and yup, all those domains' DNS use the same IP
address you posted above.

Just also did an IP WHOIS lookup and this comes up:

http://www.dnsstuff.com/tools/whois.ch?ip=64.234.220.141

OrgName: WebStream, Inc.
OrgID: WEBSTR
Address: 2200 West Commercial Blvd
Address: Suite 204
City: Fort Lauderdale
StateProv: FL
PostalCode: 33309
Country: US

NetRange: 64.234.192.0 - 64.234.223.255
CIDR: 64.234.192.0/19
NetName: WEBSTREAM-1
NetHandle: NET-64-234-192-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: WEB.WEBSTREAM.NET
NameServer: WW2.WEBSTREAM.NET
Comment:
RegDate: 2002-09-09
Updated: 2003-10-10

OrgAbuseHandle: ABUSE39-ARIN
OrgAbuseName: Abuse Investigations
OrgAbusePhone: +1-954-730-7405
OrgAbuseEmail: *****@webstream.net

OrgTechHandle: HOSTM11-ARIN
OrgTechName: Hostmaster
OrgTechPhone: +1-954-730-7405
OrgTechEmail: **********@webstream.net

Any luck with Webstream?

 

[Monte]

Webstream is a local company here but they are not our customer. The domains are registered here and the customer who owns those domains has an account here, at godaddy, and a few other registrars.

 

[labrocca]

Yeah I meant to say that Moniker was registrar not the owner.

Like I said it sounds pretty fishy what is going on. Moniker of course could simply be their registrar of choice. I have great respect for Moniker and Monte as I think they are the best registrar around. Whenever I send an email to their support it gets responded to fast and professional.

So Monte...I have a question for you. How do you guys feel about this referrer spammer being even associated with your company? Since it appears they are using bogus whois info I assume they could lose the domains with the proper complaint to someone.

Does anyone here know the procedure to get those domains taken away? Technically is the referrer spamming abuse? I personally referrer spammed once a couple years ago...at the time it seemed like a good idea. I am not sure what laws apply to these guys. Obviously it is not kosher traffic and is meant to attract traffic from webmasters checking logs. Also some logs are publicly linked and that could help them as well.

Hmm..this seems a complicated matter but interesting too.

 

[Monte]

We have a very strict policy on spammers. just send me the complete list of domains and I will report these to the owner and they will remove them. We do get complaints on a monthly basis with various accounts and we let the owners know, they address them and problem is solved. If they don't we take the DNS down and put the domains in a disputed account until resolved.

Email me the list please - monte@moniker and I will jump on it.

 

[namestrands]

monte.. always on the ball.. Kudos to you. Always great to see positive and reactive action to spammers and scammers.

 

[labrocca]

Done and thanks. Hopefully my IPFW rule will keep their spamming off my server. I believe I nailed their ip.

 

[Fennerty.com]

Ill conceived resolution. I and I know others also find that registrars playing judge and jury are a bad thing. Aspiring to be the next GoDaddy?

 

[MediaHound]

This isnt email spam, Monte - make sure you understand what he is talking about.

 

[Monte]

the names are/were associated to blog spamming and the registrant has removed them from creating this issue. Please let me know if this is not the case. I just received word back that the names have been taken care of.

Let me know if they have not.

 

[Theo]

Blog spamming is the easiest way to increase the visibility of a URL via blogs, as blogs dynamically list their "linkbacks".

 

[labrocca]

I have opted to htpasswd/htaccess all my log files.

Hopefully this will also resolve any future issues...I just love how others create work for me!