So; more tales from the “Account Terminated” swamp. I’m looking through my referrer spam from the last 24 hours and I decide to do a little whois checking.

Update: A regularly updated text file containing the 10 most recent domains to hit my servers is available here: http://boakes.org/referral-spam-domains

A few things I noticed:

1. Owner Jane Phill lives at “61 Street, Tel Aviv, Israel, IL, 49992″ according to the reachcasino.com information but at “61 Street, NYC NY, US, 10024″ according to the goapplyonline.com information. It’s a pretty safe bet that this is therefore a false address.
2. Owner Thomas Reece lives at “249 W 89 Street, NYC, NY, US, 10024″ according to the crepesuzette.com listing; a nicely similar address to Jane Phill’s false NYC address (and now also Randy Bill’s).
3. online-deals-4u.info has a different owner, but look (!) the admin contact is (as in the other cases) a “contact##@support-24×7.biz” entry – AND the IP address resolves to the same machine.
4. The admin contact for every one of these domains is an email address at “team-support-24×7.net” which is owned by a “Monika Stanes” (MS2183-GANDI) the team-support-24×7.net domain is administrered by gandi.net.
5. Cheat-Elite.com has a different owner, but just happens to resolve to the same address as Jane Phill’s domains – and hey look, it’s administered by good old team-support-24×7.net.
6. Try actually visiting the administrators web site… www.support-24×7.biz, team-support-24×7.net, support-4u.net, top-support.net – spot the common thread? Yep – it’s gandi.net. the one exception here is “marketing-support.info which currently has no DNS entry, so a quick whois lookup on them and (ahem) bingo it’s spammers registrar of choice gandi.net, again.
7. The server IP address for freakycheats.com (Thomas Reece) is the same as for most of Jane Phill’s domains, so as of 2005-02-02 we can see a definite link between these false identities.
8. As of St Patrick’s Day 2005 our old friend Jane Phill has turned up again, and now she’s working for “Marketing Ltd” and has registered 15 new poker-related domains.

About the Servers

It’ s possible to find out a little more about the servers which are being redirected to (rather than just the whois information on the domain name)…

The table of ne’er-do-well’s and their domains.