Who Is WAQN.COM?
 

Maybe some shady shit going on.

I have my techs looking into it now...

Any idea who this is?...

Registrant:
Domains by Proxy, Inc.

DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: WAQN.COM
Created on: 29-May-06
Expires on: 29-May-11
Last Updated on: 30-May-10

Administrative Contact:
Private, Registration [email protected]
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2598

Technical Contact:
Private, Registration [email protected]
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2598

Domain servers in listed order:
NS1.JERZEEMEDIA.COM
NS2.JERZEEMEDIA.COM

was a free blog host.

yes still active. why?

May be directly or indirectly tied to these people.

Still checking it all out...

Domain name: crazyblogs.net

Registrant Contact:
OpenIT Systems Ltd
OpenIT Systems ()

Fax:
Rm. 813 8/F Hollywood Plaza
610 Nathan Road
Hong Kong, KL KL
HK

Administrative Contact:
OpenIT Systems Ltd
OpenIT Systems ([email protected])
+852.81701092
Fax: +1.5555555555
Rm. 813 8/F Hollywood Plaza
610 Nathan Road
Hong Kong, KL KL
HK

Technical Contact:
OpenIT Systems Ltd
OpenIT Systems ([email protected])
+852.81701092
Fax: +1.5555555555
Rm. 813 8/F Hollywood Plaza
610 Nathan Road
Hong Kong, KL KL
HK

Status: Locked

Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com

Having a malware issue, and I'm trying to connect the dots as I clean up one of my servers.

think he posts here.

Save a little detective work.

http://www.gofuckyourself.com/showthread.php?t=1008621

iframe issue seems to have originated from here...

Domain ID:D160516368-LROR
Domain Name:ZABILPPC.ORG
Created On:27-Oct-2010 09:51:30 UTC
Last Updated On:27-Dec-2010 03:48:31 UTC
Expiration Date:27-Oct-2011 09:51:30 UTC
Sponsoring Registrar:Regtime Ltd. (R1602-LROR)
Status:OK
Registrant ID:CO785685-RT
Registrant Name:Eduard Aleksandrov
Registrant Organization:Private person
Registrant Street1:Latishskih-Strelkov 1-48
Registrant Street2:
Registrant Street3:
Registrant City:Kazan
Registrant State/Province:RU
Registrant Postal Code:420087
Registrant Country:RU
Registrant Phone:+7.8432964725
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:[email protected]
Admin ID:CA785685-RT
Admin Name:Eduard Aleksandrov
Admin Organization:Private person
Admin Street1:Latishskih-Strelkov 1-48
Admin Street2:
Admin Street3:
Admin City:Kazan
Admin State/Province:RU
Admin Postal Code:420087
Admin Country:RU
Admin Phone:+7.8432964725
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:[email protected]
Tech ID:CT785685-RT
Tech Name:Eduard Aleksandrov
Tech Organization:Private person
Tech Street1:Latishskih-Strelkov 1-48
Tech Street2:
Tech Street3:
Tech City:Kazan
Tech State/Province:RU
Tech Postal Code:420087
Tech Country:RU
Tech Phone:+7.8432964725
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:[email protected]
Name Server:NS1.NAMESELF.COM
Name Server:NS2.NAMESELF.COM

He used to post here, fucked if I can remember the nickname though. Seemed like a decent guy, used to talk to whoever it was on ICQ back when they first launched the free blog host on waqn.com.

ding ding ding

All of my error pages were iframe infected, redirecting to ZABILPPC.ORG (see above).

Server cleaned, problem solved, but I still don't know how this happened...

When did it happen? I have been spending the past 10 hours cleaning up a similar mess myself.

I have not had anything like this happen in the past 2-3 years so I am also unsure how it was done as of right now.

Thread continues here...

fucking-around-and-business-discussion/1008676-please-read-security-issue.html

Your FTPd up to date? I can't remember but pure or pro had a nasty exploit.

My apologies for such a latent response; I was away on personal matters. Anyone caught buying or selling accounts on WAQN.com will be blacklisted immediately. The aforementioned list will be made public to prevent such actions from harming other hosts and webmasters alike. WAQN is experiencing an upgrade which is why the service has been a bit bouncy. My apologies for that as well. Please bear with us as we see through this. Our host, Mojo Host, is in the process and as everyone knows (or should know) their service far exceeds the expectations of their clientele.

If any wind is caught of buying/selling on WAQN.com, please feel free to e-mail me at [email protected] and I will investigate.

Best regards,

JM

BFT3K,

Sorry I meant to post in this window that you can contact me and I'll do my best to help get to the root of the issue with you. My other response is for the post regarding someone looking to buy accounts on WAQN.com.

Best regards,

JM
ICQ: 251-095-197

cliff notes?

Hey papill0n long time :-) I'm referring to this post: http://www.gofuckyourself.com/showthread.php?t=1008621

Regards,

JM