Fried Phish^(TM)

• whois
• dig
• host
• fetch
• asn

---

whois

at 20 May, 2008 @ 22:38:54
GeekTools Whois Proxy v5.0.4 Ready. Checking access for 149.20.54.190... ok. Checking server [whois.crsnic.net] Results: CRSNIC has no information for that domain. Results brought to you by the GeekTools WHOIS Proxy Server results may be copyrighted and are used with permission. Your host (149.20.54.190) has visited 14 times today.

---

whois

at 20 May, 2008 @ 22:40:37
GeekTools Whois Proxy v5.0.4 Ready. Checking access for 149.20.54.190... ok. Final results obtained from rwhois.gnax.net. Results: Referring data: OrgName: Global Net Access, LLC OrgID: GNAL-2 Address: 1100 White St SW City: Atlanta StateProv: GA PostalCode: 30310 Country: US ReferralServer: rwhois://rwhois.gnax.net:4321 NetRange: 63.247.64.0 - 63.247.95.255 CIDR: 63.247.64.0/19 OriginAS: AS3595, AS16626 NetName: GNAXNET NetHandle: NET-63-247-64-0-1 Parent: NET-63-0-0-0-0 NetType: Direct Allocation NameServer: DNS1.GNAX.NET NameServer: DNS2.GNAX.NET NameServer: NS1.GNAX.NET NameServer: NS2.GNAX.NET Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE Comment: ******************************************** Comment: Reassignment information for this block is Comment: available at rwhois.gnax.net port 4321 Comment: ******************************************** RegDate: 2003-04-11 Updated: 2007-06-01 RAbuseHandle: ABUSE745-ARIN RAbuseName: GNAX ABUSE RAbusePhone: +1-404-230-9150 RAbuseEmail: abuse@gnax.net RNOCHandle: ENGIN7-ARIN RNOCName: GNAX ENGINEERING RNOCPhone: +1-404-230-9150 RNOCEmail: engineering@gnax.net RTechHandle: ENGIN7-ARIN RTechName: GNAX ENGINEERING RTechPhone: +1-404-230-9150 RTechEmail: engineering@gnax.net OrgAbuseHandle: ABUSE745-ARIN OrgAbuseName: GNAX ABUSE OrgAbusePhone: +1-404-230-9150 OrgAbuseEmail: abuse@gnax.net OrgNOCHandle: ENGIN7-ARIN OrgNOCName: GNAX ENGINEERING OrgNOCPhone: +1-404-230-9150 OrgNOCEmail: engineering@gnax.net OrgTechHandle: ENGIN7-ARIN OrgTechName: GNAX ENGINEERING OrgTechPhone: +1-404-230-9150 OrgTechEmail: engineering@gnax.net # ARIN WHOIS database, last updated 2008-05-19 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. Rwhois server data: %rwhois V-1.5:003fff:00 rwhois.gnax.net (by Network Solutions, Inc. V-1.5.7.3) network:Class-Name:network network:ID:164.63.247.64.0/19 network:Auth-Area:63.247.64.0/19 network:Network-Name:ESERVERS-485 network:IP-Network:63.247.72.16/29 network:Organization;I:ESERVERS network:Tech-Contact;I:engineering@gnax.net network:Admin-Contact;I:engineering@gnax.net network:Created:20030703 network:Updated:20030703 network:Updated-By:hostmaster@gnax.net network:Class-Name:network network:ID:1044.63.247.64.0/19 network:Auth-Area:63.247.64.0/19 network:Network-Name:GNAX network:IP-Network:63.247.77.28/20 network:Organization;I:GNAX Internal Device network:Tech-Contact;I:engineering@gnax.net network:Admin-Contact;I:engineering@gnax.net network:Created:20070606 network:Updated:20070606 network:Updated-By:engineering@gnax.net %ok

---

whois

at 20 May, 2008 @ 22:44:50
GeekTools Whois Proxy v5.0.4 Ready. Checking access for 149.20.54.190... ok. Checking server [whois.crsnic.net] Checking server [whois.gandi.net] Results: % GANDI Registrar whois database for .COM, .NET, .ORG., .INFO, .BIZ, .NAME % % Access and use restricted pursuant to French law on personal data. % Copy of whole or part of the data without permission from GANDI % is strictly forbidden. % The sole owner of a domain is the entity described in the relevant % 'domain:' record. % Domain ownership disputes should be settled using ICANN's Uniform Dispute % Resolution Policy: http://www.icann.org/udrp/udrp.htm % For inquiries about 'by policy' protection, please check directly % with the appropriate registry (Eurid, AFNIC) % % Acces et utilisation soumis a la legislation francaise sur % les donnees personnelles. % Copie de tout ou partie de la base interdite sans autorisation de GANDI. % Le possesseur d'un domaine est l'entite decrite dans % l'enregistrement 'domain:' correspondant. % Un desaccord sur la possession d'un nom de domaine peut etre resolu % en suivant la Uniform Dispute Resolution Policy de l'ICANN: % http://www.icann.org/udrp/udrp.htm % Pour obtenir les informations en status 'Protected by policy', contactez % directement le registre concerne (Eurid, AFNIC) % % Date: 2008/05/21 00:27:09 domain: whidbeyreserve.com owner-address: PO Box 000 owner-address: 98239 owner-address: Unknown owner-address: Washington owner-address: United States of America admin-c: RM884-GANDI tech-c: RM884-GANDI bill-c: RM884-GANDI nserver: ns25.dnsprotect.com nserver: ns26.dnsprotect.com reg_created: 2007-08-11 22:04:49 expires: 2008-08-11 22:04:49 created: 2007-08-12 00:04:08 changed: 2007-08-12 00:04:08 person: Robert Martin nic-hdl: RM884-GANDI address: PO Box 000 address: 98239 address: Unknown address: Washington address: United States of America phone: +1.1231231234 e-mail: bob@tobysuds.com lastupdated: 2007-09-27 13:01:52

---

dig any

at 20 May, 2008 @ 22:38:54
; <<>> DiG 9.3.4-P1 <<>> www.whidbeyreserve.com ANY ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51514 ;; flags: qr ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.whidbeyreserve.com. IN ANY ;; ANSWER SECTION: www.whidbeyreserve.com. 14399 IN CNAME whidbeyreserve.com. whidbeyreserve.com. 14399 IN MX 0 whidbeyreserve.com. whidbeyreserve.com. 172799 IN NS ns25.dnsprotect.com. whidbeyreserve.com. 172799 IN NS ns26.dnsprotect.com. whidbeyreserve.com. 14399 IN A 63.247.72.18 ;; ADDITIONAL SECTION: ns25.dnsprotect.com. 172799 IN A 72.9.239.130 ns26.dnsprotect.com. 172799 IN A 70.85.84.52 ;; Query time: 8 msec ;; SERVER: 204.152.187.111#53(204.152.187.111) ;; WHEN: Tue May 20 22:38:53 2008 ;; MSG SIZE rcvd: 185

---

dig any

at 20 May, 2008 @ 22:44:50
; <<>> DiG 9.3.4-P1 <<>> whidbeyreserve.com ANY ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54923 ;; flags: qr ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;whidbeyreserve.com. IN ANY ;; ANSWER SECTION: whidbeyreserve.com. 14050 IN MX 0 whidbeyreserve.com. whidbeyreserve.com. 172450 IN NS ns25.dnsprotect.com. whidbeyreserve.com. 172450 IN NS ns26.dnsprotect.com. whidbeyreserve.com. 14050 IN A 63.247.72.18 ;; ADDITIONAL SECTION: ns25.dnsprotect.com. 172450 IN A 72.9.239.130 ns26.dnsprotect.com. 172450 IN A 70.85.84.52 ;; Query time: 0 msec ;; SERVER: 204.152.187.111#53(204.152.187.111) ;; WHEN: Tue May 20 22:44:43 2008 ;; MSG SIZE rcvd: 167

---

host

at 20 May, 2008 @ 22:38:54

---

host

at 20 May, 2008 @ 22:40:37

---

host

at 20 May, 2008 @ 22:44:50

---

fetched page

at 20 May, 2008 @ 22:38:56
MD5 Fingerprint: 3e153fbcf923214aba9573a52487a441
SHA1 Fingerprint: 8020240d43a03d509ec1925fecb800e9d56e2416
HTTP/1.1 200 OK Date: Tue, 20 May 2008 22:21:18 GMT Server: Apache Vary: Accept-Encoding X-Powered-By: PHP/4.4.2 Content-Type: text/html Transfer-Encoding: chunked <html><head> <meta HTTP-Equiv="refresh" content="0; URL=do.php?cmd=SignIn"> <script type="text/javascript"> loc = "do.php?cmd=SignIn" self.location.replace(loc); window.location = loc; </script> </head>

---

fetched page

at 20 May, 2008 @ 22:40:38
MD5 Fingerprint: d41d8cd98f00b204e9800998ecf8427e
SHA1 Fingerprint: da39a3ee5e6b4b0d3255bfef95601890afd80709

---

Corresponding BGP Origin ASN

at 20 May, 2008 @ 22:40:38
AS | BGP Prefix | CC | Registry | Allocated
"3595 | 63.247.64.0/19 | US | arin | 2003-04-11"

---

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

at 20 May, 2008 @ 22:40:38
AS Peers | BGP Prefix | CC | Registry | Allocated
"209 1239 1299 3491 3549 3561 16626 | 63.247.64.0/19 | US | arin | 2003-04-11"

---

AS Description of a given BGP ASN

at 20 May, 2008 @ 22:44:51
AS | CC | Registry | Allocated | AS Name
"3595 | US | arin | 1994-05-17 | GNAXNET-AS - Global Net Access, LLC"