Couple of weeks back I posted about blocking Inhoster which was oozing with spambots with one scraper in their midst and that scraper has finally surfaced.
The scraper's ID is:
IP Address: 85.255.116.178
User Agent: Snoopy v1.2
Which showed up on a page buried on this domain:
index-se.com (85.255.116.182)
What a concept, 2 IPs in Inhoster for one scraper.
Now let's dig for some dirt!
A reverse-IP lookup reveals the scraping IP address 85.255.116.178 is also the IP for FINDALLBEST.COM which looks just like index-se.com.
85.255.116.178: FINDALLBEST.COMDomain Name: FINDALLBEST.COM
Registrant:
N/A
Nekto (nekto@utopia.com)
Jamaica 17
Cuba
null,12476
CU
Tel. +543.56576767
The info for index-se.com claims to be from the US:
Domain Name: INDEX-SE.COM
Registrant:
Index SE
Index SE (admin@index-se.com)
67 Mt. Auburn St.
Cambridge
,02138
US
Tel. +617.4959659
85.255.116.182: SEARCHADULTSEX.COM:Domain Name: SEARCHADULTSEX.COM
Registrant:
N/A
Nekto (nekto@utopia.com)
Jamaica 17
Cuba
null,12476
CU
Tel. +543.56576767
So I got curious what else was between 85.255.116.178 - 182 and it was all the same crap:
85.255.116.179: right-pharmacy.comDifferent registrant but domain redirects to buy-soma-online.findallbest.com, there's a shock:
Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713
85.255.116.180: wagemax.comThis one is just a Plesk domain placeholder page at this time and another registrant.
Domain Name: WAGEMAX.COM
Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713
85.255.116.180: search-paga.comYes, same registrant and site looks like all the rest of the crap.
Domain Name: SEARCH-PAGA.COM
Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713
85.255.116.181: coolsearch.bizPay dirt! We found the domain linked to the other domains on 85.255.116.180
Domain Name: COOLSEARCH.BIZ
Domain ID: D6614592-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: ok
Registrant ID: DI_2271261
Registrant Name: Alexei Aniskevich
Registrant Organization: N/A
Registrant Address1: Moisavahe 64-1
Registrant City: Tartu
Registrant State/Province: Tartumsa
Registrant Postal Code: 50707
Registrant Country: Estonia
Registrant Country Code: EE
Registrant Phone Number: +372.715713
Registrant Email: alex@coolsearch.biz
When you go to coolsearch.biz it automatically takes you to: www.gigasearch.biz
Domain Name: GIGASEARCH.BIZ
Domain ID: D7182275-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: clientTransferProhibited
Registrant ID: DI_2191316
Registrant Name: Alexei Aniskevich
Registrant Organization: N/A
Registrant Address1: Sopruse pst 15
Registrant City: Tallinn
Registrant State/Province: Harjumsa
Registrant Postal Code: 50707
Registrant Country: Estonia
Registrant Country Code: EE
Registrant Phone Number: +372.715713
Registrant Email: alex@coolsearch.biz
85.255.116.181: your-searcher.comDomain Name: YOUR-SEARCHER.COM
Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713
Let us continue with more of this puzzle...Let's explore
gigasearch.biz a bit more:
69.50.163.9: gigasearch.bizWe did find some similar scraping in this range:
69.50.190.242 "Snoopy v1.2"
Actually, the range 69.50.*.* has a ton of scraping so seeing a link to this scraper and the Snoopy user again yet again was no surprise.
GigaSearch.biz is hosted on our old friends Intercage which hosted
Scraper #4 and
Scraper #6 which I think may be all the same scraper as everything just keeps linking them together from host to host, some similar IP ranges and the same user agent. Nothing concrete but all the circumstantial evidence is overwhelming that they may be somehow related.
Most amusing is all the links on gigasearch.biz redirect to find.fm, and this relationship could be interesting but I'm getting sick of chasing this scraper / spammer at this point.
The host of our busted scraping pals #4, #6 and #11:
OrgName: InterCage, Inc.
OrgID: INTER-359
Address: 1955 Monument Blvd.
Address: #236
City: Concord
StateProv: CA
PostalCode: 94520
Country: US
NetRange: 69.50.160.0 - 69.50.191.255
Let's see what else is on the Gigasearch.biz server:
69.50.163.9: blanksearch.bizThis domain is NSFW with raw porn all over it.
Domain Name: BLANKSEARCH.BIZ
Domain ID: D6761115-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: ok
Registrant ID: DI_3009123
Registrant Name: Ivars Kaupers
Registrant Organization: No
Registrant Address1: Skirgailos 15
Registrant City: Kaunas
Registrant Postal Code: 75128
Registrant Country: Lithuania
Registrant Country Code: LT
Registrant Phone Number: +370.571689
Registrant Email: ivars@blanksearch.biz
69.50.163.9: tgp-porno.netThis site brings up another of the same old porn links again.
Domain Name: TGP-PORNO.NET
Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Moisavahe 64-1
Tartu
Tartumsa,50707
EE
Tel. +372.715713
Last but not least, the server with find.fm hosts a few other garbage domains with the same links about pills and porn on them all, with "find.fm" on the bottom of the page which was a big shocker as well:
Domains on 64.111.196.119 (Find.fm)adultwebfind.com
carwebsearch.com
cashwebsearch.com
dmns4sale.com
gamblingwebsearch.com
pharmacywebsearch.com
travelwebsearch.com
your-needs.info
Well, that's all for now.
Needless to say, they can't hide for long as they leave a slimey trail that can be followed.
Scrape me again assholes, let's unravel the rest of your bullshit sites.
