http://www.polizei.bayern.de/lka/news/presse/aktuell/index.html/136840
So a lot of scammers have been arrested, good. But why mention it here?
Let us take a look at some of the domain names mentioned by this official German police press report:
ewe-ewe.com
Registration Service Provided By: Heihachi Ltd. WHOIS-Protection
Contact: abuse@heihachi.net
Domain name: ewe-ewe.com
Registrant Contact:
Heihachi Ltd. WHOIS-Protection
Sergey Ershov ()
Fax:
Calle 53
Marbella, PA 10000
PA
Administrative Contact:
Heihachi Ltd. WHOIS-Protection
Sergey Ershov (support@heihachi.net)
507.6458546
Fax: 507.6458547
Calle 53
Marbella, PA 10000
PA
Technical Contact:
Heihachi Ltd. WHOIS-Protection
Sergey Ershov (support@heihachi.net)
507.6458546
Fax: 507.6458547
Calle 53
Marbella, PA 10000
PA
Status: Active
Name Servers:
ns1.heihachi.net
ns2.heihachi.net
Creation date: 09 Aug 2010 01:26:36
Expiration date: 09 Aug 2011 01:26:00
dress4style.com
Registration Service Provided By: Heihachi Ltd. WHOIS-Protection
Contact: abuse@heihachi.net
Domain name: dress4style.com
Registrant Contact:
Heihachi Ltd. WHOIS-Protection
Sergey Ershov ()
Fax:
Calle 53
Marbella, PA 10000
PA
Administrative Contact:
Heihachi Ltd. WHOIS-Protection
Sergey Ershov (support@heihachi.net)
507.6458546
Fax: 507.6458547
Calle 53
Marbella, PA 10000
PA
Technical Contact:
Heihachi Ltd. WHOIS-Protection
Sergey Ershov (support@heihachi.net)
507.6458546
Fax: 507.6458547
Calle 53
Marbella, PA 10000
PA
Status: Active
Name Servers:
ns1.heihachi.net
ns2.heihachi.net
Creation date: 30 May 2010 17:30:10
Expiration date: 30 May 2011 17:30:00
elektro-grosshandel24.com
Registration Service Provided By: Dinghost Limited
Contact: whois@protected-ns.info
Domain name: elektro-grosshandel24.com
Registrant Contact:
Dinghost Limited
Dimitri Povak ()
Fax:
Calle 53, Marbella
Panama, PA 10000
PA
Administrative Contact:
Dinghost Limited
Dimitri Povak (whois@protected-ns.info)
507.8321668
Fax: 1. 507.8321668
Calle 53, Marbella
Panama, PA 10000
PA
Technical Contact:
Dinghost Limited
Dimitri Povak (whois@protected-ns.info)
507.8321668
Fax: 1. 507.8321668
Calle 53, Marbella
Panama, PA 10000
PA
Status: Active
Name Servers:
ns1.heihachi.net
ns2.heihachi.net
Creation date: 09 Feb 2010 11:23:17
Expiration date: 09 Feb 2011 11:23:00
The last domain linked to Dinghost and Heihachi is just a continuation of the pattern
described on this blog after the Spamhaus attacks.
Similar domains linked to Heihachi and fraud can be found by simply using Google. You will quickly find the anti-abuse forums and victim forums are littered with these domains.
As such when the police report mentions the DDoS attacks linked to the arrested parties, it is no surprise. Heihachi has a dismal reputation of all things bad. Nothing good has yet been known to come from Heihachi, not even a mysterious .
This further makes you wonder how a domain name system can be subverted, corrupted and perverted as to be abused by criminals. It is also on record that Enom and their reseller Namecheap has been notified extensively of invalid whois details that Heihachi is using, also the activities of Heihachi.
If anything, the Heihachi can of worms will go down as a black mark against the credibility of the current registrar system and privacy abuse, which in itself is a danger to true accountable privacy.
Why? Let us look of all the whois issues linked to the actual Heihachi domain, where American registrars allowed the situation to continue and even acting as a proxy for them. Further Heihachi themselves were allowed to to act as a reseller and privacy proxy themselves for further criminality:
2008-09-05:
Heihachi is registered via EstDomains, EstDomains themselves
closed down later after being linked to illegal activities.
Registration Service Provider: LovingDomains.com - E-Gold Domain Registration
Website: http://www.lovingdomains.com
Accept Pecunix, e-Bullion, E-Gold, PayPal, MoneyBookers, WebMoney, Epassporte, Liberty Reserve, Fethard Finance and Capital Collect
Domain Name: HEIHACHI.NET
Registrant:
Heihachi Host
Peter Schneider (heihachi.web@gmail.com)
Mailgasse 42
Berlin
Berlin,10024
DE
Tel. +049.5545856852
Creation Date: 05-Sep-2008
Expiration Date: 05-Sep-2009
The red flag here is "Mailgasse 42" which cannot be found in Berlin. Postal code 10024 is also invalid. The telephone number is a geographical number linked to Hedemünden in Germany.
Conclusion: Serious whois issues exists for this domain and the details are not credible.
On or around 2008-12-04 the Heihachi.net domain is moved to the registrar Direct-I in a bulk transfer of the EstDomains domain portfolio and Estdomains is not longer an ICANN registrar.
2009-01-02:
On or around 2009-01-02 the domain's regsitration details changes:
Registrant:
Heihachi LTD
Heihachi.net (support@heihachi.net)
233 Middleton rd
Apt 1715
Glenside
Wellington,6037
NZ
Tel. +064.48311333
Looking at where this address is on map, leads to the industry and anti-abuse group jokes referring to Heihachi as "the reseller who lives in a tree".
We can clearly see from Google maps that 233 Middleton Rd, Glenside, Wellington will not ever be big enough for a building that could ever house an "apt 1715". Looking at this street corner property, shows it to be an undeveloped piece of property with only trees and not much more.
View Larger Map
2009-01-08:
For certain reasons, most likely Direct-I's low tolerance for Internet abuse, Heihachi moves away within a week of being transferred to Directi-I to Enom, using the Enom reseller Namecheap, also using their privacy protection:
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/
Domain name: heihachi.net
Administrative Contact:
NameCheap.com
NameCheap.com NameCheap.com (support@NameCheap.com)
+1.6613102107
Fax: +1.6613102107
8939 S. Sepulveda Blvd. #110 - 732
Westchester, CA 90045
US
However the domain registrant details is immediately changed back to the invalid address used previously:
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: http://www.namecheap.com/
Domain name: heihachi.net
Registrant Contact:
Heihachi.net
Heihachi Ltd WHOIS PROTECTION ()
Fax:
233 Middleton rd
Apt 1715
Glenside, State 6037
NZ
We also now see a bizarre
Heihachi Ltd WHOIS PROTECTION ().
At this stage, reports of invalid whois details and serious issues of criminality are being escalated to law enforcement and the Registrar Enom and reseller Namecheap.
2010-04-11:
In reaction to continued pressure, the domain name now adopts the proxy services of Namecheap:
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Domain name: heihachi.net
Registrant Contact:
WhoisGuard
WhoisGuard Protected ()
Fax:
8939 S. Sepulveda Blvd. #110 - 732
Westchester, CA 90045
US
Considering Heihachi themselves are in turn acting as a proxy for their clients that are later arrested, we need to consider how transparent and desibrable a proxy for a proxy itself is. What message is this sending out to the global internet community? We also need to ask how this situation ever was ever allowed to develop as it make a mockery of the whois requirements in the DNS system. Naturally this decision is questioned and escalated to to Enom and reseller Namecheap. ICANN is also copied on some of the communications.
2010-05-02:
Registration Service Provided By: Heihachi LTD.
Contact: support@heihachi.net
Visit: www.heihachi.net
Domain name: heihachi.net
Registrant Contact:
Heihachi.net
Heihachi Ltd WHOIS-PROTECTION ()
Fax:
Calle 53, Marbella
Bella Vista
Panama, PA 00000
PA
Heihachi now suddenly sports a Panama address. Of note is that Heihachi, despite it's dismal record of ignoring valid whois requirements and in fact being implicated in numerous criminal issues, is now an Enom reseller!
Not unsurprisingly, the registrant address shown here does not bear closer scrutiny. The published address is that of
the Panama City World Trade Centre!
It is possible that Heihachi may have an office or post box at this location and the lack of more exact details that would postal message persuant to the domain registration agreement to reach it, is just an honest oversight. Yet numerous telephone calls later to parties linked to the Panama City World Trade Centre, now indication can be found of Heihachi at this address.
Also linked to this address is telephone number +507.8321668. This is a VOIP (Voice over IP) number in Panama, indicating the number need not be linked to Panama as such, but the recipient may find himself anywhere where the internet reaches. To date no records can be found of anybody calling this number successfully, despite repeated efforts by numerous parties.
ICANN registrar Enom is made aware of these issues.
2010-05-18:
The Heihachi domain now sports Enom's "Whois Privacy Protection Service":
Domain name: heihachi.net
Registrant Contact:
Whois Privacy Protection Service, Inc.
Whois Agent ()
Fax:
PMB 368, 14150 NE 20th St - F1
C/O heihachi.net
Bellevue, WA 98007
US
Administrative Contact:
Whois Privacy Protection Service, Inc.
Whois Agent (prjcxxfb@whoisprivacyprotect.com)
+1.4252740657
Fax: +1.4259744730
PMB 368, 14150 NE 20th St - F1
C/O heihachi.net
Bellevue, WA 98007
US
Technical Contact:
Whois Privacy Protection Service, Inc.
Whois Agent (prjcxxfb@whoisprivacyprotect.com)
+1.4252740657
Fax: +1.4259744730
PMB 368, 14150 NE 20th St - F1
C/O heihachi.net
Bellevue, WA 98007
US
The registrant details stays proxied using Enom's privacy services to date, despite Enoms being aware of serious issues linked to this domain.
Heihachi also retains it's Enom reseller status.
Furthermore domains sold via Heihachi all sport "Registration Service Provided By: Heihachi Ltd. WHOIS-Protection" and these domains are regularly linked to fraud. The domains ewe-ewe.com, dress4style.com, elektro-grosshandel24.com mentioned earlier and indicated in the police report is all evidence of this abuse.
Also, Heihachi is implicated in numerous DDoS attacks in this time.
We need to now ask ourselves how we ever got to the stage where millions of dollars/euros were defrauded from internet users? How come one of the top American registrars allows this farce to continue?
The German authorities catching some of the perpetrators is small consolation, but cannot make up for the damage done in terms of financial loss nor loss of trust in the internet, all due to fraud.
Note: The mentioned Lego scams where scamming those that could least afford it over the Christmas period, the financially challenged, and where parents were simply trying to get the best Christmas present possible for the little money they had in a recession that Christmas. Needless to say these children are will grow up to remember a certain Christmas when Santa never came. Money for their presents went to criminals and indirectly American corporates.
There will be no recovery of financial losses for the victims to the fraud, many of them which should and would not have been if Enom and Namecheap followed the rules of their accreditation agreements and had not gamed the requirements of the DNS system.
The
recent USA court findings of Tucows not being responsible for abuse of their proxy services since the registrar accreditation allows no third party beneficiaries as per the , lays the foundation for much more similar abuse to the issue illustrated above. In a nutshell the ordinary user has no protection from ICANN either to ensure a healthy internet environment and ICANN can only be considered at best a mutual protection "club" for registrants, registrars and resellers. In the Heihachi saga the costs are being shifted to the authorities in Germany, while the profits are being diverted to criminals, some of who were caught, and unaccountable domains resellers and registrars who it appears chose self blinding.
At this stage I would like to say that Tucows is an excellent domain registrar and I consider them one of the best who proactively takes steps against abuse of their services. As such the Tucows court victory is a small personal consolation, but a sad day for the internet's ICANN unwashed.
Further it also flies directly against the sentiments voiced by President Obama in his document titled
In this document much is said in terms of fostering trust in the internet. We can only but hope that is a precursor to another "Heihachi" never being allowed to develop using American companies and resources to target foreign nationals, DDoS foreign and American infrastructure or any other party.
Heihachi has truly become a can of worms that could be well used by
ICANN and it's
SSAC as a case study of what not should be happening. We can ask what message this is sending out to the internet community and anyone contemplating using the DNS system for fraud.
It may be argued that perhaps the domain registrars and resellers were simply cooperating with the authorities. However the authorities actually set a date stamp on the initiation of the investigations:
Am 28.09.2009 meldete sich bei der Polizeiinspektion Nördlingen der Mitinhaber eines örtlichen Unternehmens. Der Grund lag in den zahlreichen Anfragen einiger Personen, die angeblich über die Internetseite „ja-kaufen.com“ (nicht mehr online)
Invalid and abuse reports to the sponsoring registrar were initiated well before this date.
