Fried Phish^(TM)

• whois
• dig
• host
• fetch
• asn

---

whois

at 19 May, 2008 @ 04:48:50
CastleCops Local Cached Whois at 2008-05-19 01:13:39 GeekTools Whois Proxy v5.0.4 Ready. Checking access for 149.20.54.191... ok. Checking server [whois.crsnic.net] Checking server [whois.schlund.info] Results: % The data in the WHOIS database of 1&1 Internet AG is provided by % 1&1 for information purposes, and to assist persons in obtaining % information about or related to a domain name registration record. % 1&1 does not guarantee its accuracy. By submitting a WHOIS query, % you agree that you will use this data only for lawful purposes and that, % under no circumstances, you will use this data to % (1) allow, enable, or otherwise support the transmission by e-mail, % telephone, or facsimile of mass, unsolicited, commercial advertising or % solicitations to entities other than the data recipient's own existing % customers; or % (2) enable high volume, automated, electronic processes that send queries or % data to the systems of any Registry Operator or ICANN-Accredited registrar, % except as reasonably necessary to register domain names or modify existing % registrations. % 1&1 reserves the right to modify these terms at any time. % By submitting this query, you agree to abide by this policy. domain: lordofmars.com created: 09-Oct-2006 last-changed: 10-Oct-2007 registration-expiration: 09-Oct-2008 nserver: ns11.1and1.fr nserver: ns12.1and1.fr status: CLIENT-TRANSFER-PROHIBITED registrant-firstname: Nicolas registrant-lastname: Caminade registrant-street1: 54 rue roquebrune registrant-pcode: 13004 registrant-city: Marseille registrant-ccode: FR registrant-phone: +33.662199393 registrant-email: nicolascaminade@yahoo.fr admin-c-firstname: Nicolas admin-c-lastname: Caminade admin-c-street1: 54 rue roquebrune admin-c-pcode: 13004 admin-c-city: Marseille admin-c-ccode: FR admin-c-phone: +33.662199393 admin-c-email: nicolascaminade@yahoo.fr tech-c-firstname: Hostmaster tech-c-lastname: UNETUN tech-c-organization: 1&1 Internet SARL tech-c-street1: 7 Place de la Gare tech-c-pcode: 57200 tech-c-city: Sarreguemines tech-c-ccode: FR tech-c-phone: +33.825080020 tech-c-fax: +33.387959974 tech-c-email: hostmaster@1and1.fr bill-c-firstname: Hostmaster bill-c-lastname: UNETUN bill-c-organization: 1&1 Internet SARL bill-c-street1: 7 Place de la Gare bill-c-pcode: 57200 bill-c-city: Sarreguemines bill-c-ccode: FR bill-c-phone: +33.825080020 bill-c-fax: +33.387959974 bill-c-email: hostmaster@1and1.fr % See http://registrar.1und1.info for information about 1&1 Internet AG Results brought to you by the GeekTools WHOIS Proxy Server results may be copyrighted and are used with permission. Your host (149.20.54.191) has visited 378 times today.

---

whois

at 20 May, 2008 @ 23:17:24
GeekTools Whois Proxy v5.0.4 Ready. Checking access for 149.20.54.190... ok. Final results obtained from whois.ripe.net. Results: % This is the RIPE Whois query server #3. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html % Note: This output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '82.165.64.0 - 82.165.127.255' inetnum: 82.165.64.0 - 82.165.127.255 netname: SCHLUND-SHARED descr: Schlund + Partner AG descr: NCC#2004115007 country: DE admin-c: UI-RIPE tech-c: UI-RIPE remarks: in case of abuse or spam, please mailto: abuse@schlund.de rev-srv: nsa.schlund.de rev-srv: nsa2.schlund.de rev-srv: ns.ripe.net status: ASSIGNED PA mnt-by: SCHLUND-MNT source: RIPE # Filtered role: Schlund NCC address: 1&1 Internet AG address: Brauerstrasse 48 address: D-76135 Karlsruhe address: Germany remarks: For abuse issues, please use only abuse@oneandone.net phone: +49 721 91374 50 fax-no: +49 721 91374 20 admin-c: SPNC-RIPE tech-c: SPNC-RIPE nic-hdl: UI-RIPE abuse-mailbox: abuse@oneandone.net mnt-by: SCHLUND-MNT source: RIPE # Filtered % Information related to '82.165.0.0/16AS8560' route: 82.165.0.0/16 descr: SCHLUND-PA-4 origin: AS8560 mnt-by: SCHLUND-MNT source: RIPE # Filtered Results brought to you by the GeekTools WHOIS Proxy Server results may be copyrighted and are used with permission. Your host (149.20.54.190) has visited 17 times today.

---

dig any

at 19 May, 2008 @ 04:48:49
;www.lordofmars.com. IN A www.lordofmars.com. 10800 IN A 82.165.87.251 ;lordofmars.com. IN A lordofmars.com. 10800 IN A 82.165.87.251 ;lordofmars.com. IN MX lordofmars.com. 86400 IN MX 10 mx00.1and1.fr. lordofmars.com. 86400 IN MX 10 mx01.1and1.fr. ;lordofmars.com. IN NS lordofmars.com. 172799 IN NS ns11.1and1.fr. lordofmars.com. 172799 IN NS ns12.1and1.fr. ;lordofmars.com. IN SOA lordofmars.com. 86400 IN SOA ns11.1and1.fr. hostmaster.1and1.fr. 2006100901 28800 7200 604800 86400 ;lordofmars.com. IN TXT ;www.lordofmars.com. IN CNAME ;www.lordofmars.com. IN PTR ;lordofmars.com. IN KEY ;www.lordofmars.com. IN HINFO ;www.lordofmars.com. IN AAAA ;; Query time: 182 msec ;; SERVER: 204.152.187.111#53(204.152.187.111) ;; WHEN: Mon May 19 04:48:49 2008 ;; MSG SIZE rcvd: 36

---

host

at 19 May, 2008 @ 04:48:51

---

host

at 20 May, 2008 @ 23:17:24

---

fetched page

at 19 May, 2008 @ 04:48:45
MD5 Fingerprint: 9cc73359b959462c8bb1ef8384622ffb
SHA1 Fingerprint: e2d6839144acec21f6e244487efdaf91db6ad45b
HTTP/1.1 200 OK Date: Mon, 19 May 2008 04:47:27 GMT Server: Apache/1.3.34 Ben-SSL/1.55 Last-Modified: Sun, 18 May 2008 22:33:43 GMT ETag: "9ac08fe-fb-4830aec7" Accept-Ranges: bytes Content-Length: 251 Content-Type: text/html <html><head> <meta http-equiv="refresh" content="0; URL=logon.php?acct=login"> <script language="JavaScript" type="text/javascript"> <!-- function redirect() { setTimeout("window.location.replace('logon.php?acct=login')", 0); } --> </script> </head>

---

Corresponding BGP Origin ASN

at 20 May, 2008 @ 23:17:24
AS | BGP Prefix | CC | Registry | Allocated
"8560 | 82.165.0.0/16 | DE | ripencc | 2003-08-06"

---

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

at 20 May, 2008 @ 23:17:24
AS Peers | BGP Prefix | CC | Registry | Allocated
"174 2828 3257 3356 3549 10310 | 82.165.0.0/16 | DE | ripencc | 2003-08-06"

---

AS Description of a given BGP ASN

at 20 May, 2008 @ 23:19:28
AS | CC | Registry | Allocated | AS Name
"8560 | DE | ripencc | 1997-11-26 | ONEANDONE-AS 1&1 Internet AG"