The Investigation

In theory, to find out who operates the parking service, we only need to figure out who owns the DNS servers that are used by domains using the service. To find a DNS server of this parking service, we conduct a whois lookup of the domain warezonly.com.

The whois information (shown below) tells us that the DNS servers are from the cnomy.com domain. Therefore, if we can find out who owns the cnomy.com domain, we know who runs the parking service.

Domain Name: WAREZONLY.COM 

Registrant:
    Private Registrations Aktien Gesellschaft
    Domain Admin        (domadmin@privateregistrations.bz)
    CNR of Granby & Sharpe St
    Suite K2134
    Kingstown
    Not Applicable,Kingstown
    VC
    Tel. +55.5430545527

Creation Date: 21-Jan-2006  
Expiration Date: 21-Jan-2008

Domain servers in listed order:
    sk.s1.ns58.cnomy.com
    sk.s2.ns58.cnomy.com
    
ICANN Registrar: 	ANSWERABLE.COM (I) PVT. LTD.	   
	   
IP Address: 	209.85.51.158 	   
IP Location 	United Arab Emirates - Direct Information Fzc 	

Conducting a whois search of cnomy.com, we get the results shown below. Interestingly, the owners of the cnomy.com domain are using a privacy service to protect their identity. Though this complicates things a little, it also hints at something very important. First of all, the whole point of a privacy service is to keep private information private. However, a company generally has no reason to use a privacy service because most companies do not have a private address. So it is reasonable to assume that this company has a less-than-legitimate reason for hiding its identity.

Domain Name: CNOMY.COM 

Registrant:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Creation Date: 21-Feb-2006  
Expiration Date: 21-Feb-2009

Domain servers in listed order:
    ns1.cnomy.com
    ns2.cnomy.com

Registrar:  DIRECT INFORMATION PVT LTD
 D/B/A PUBLICDOMAINREGISTRY.COM

Taking a second look again at the cnomy.com whois information, we see that the registrar of the domain PublicDomainRegistry, is a business of a company known as Direct Information. In some cases – and almost always true with big operations – the registrar of the domain is operated by the same company that owns the domain, so we can add Direct Information/PublicDomainRegistry to our very short list of suspects.

Who owns cnomy.com?

The key to solving our case is figuring out who owns cnomy.com. Although the whois records are privacy-protected, we still have other ways to find what we need. For instance, since cnomy.com has a website, one of the things we can do is take a look at the web hosting. The DNS servers in this case are cnomy.com, which tells us that the hosting is done in-house. In other words, the cnomy's webserver resides at the office of the company that operates the parking service.

Looking at the server’s information¹, we see that the IP address is 209.85.51.47 and that the location of the server is in the United Arab Emirates. But at the same time, we are being told that the webserver belongs to "Direct Information Fzc" Does Directi have an office in the UAE. As it turns out, the answer is "yes" according to page 12 of the Direct Corporate Profile, available for download from the directi website.²

PrivacyProtect.Org

Earlier we noticed that the registrant for cnomy.com is a privacy service called "PrivacyProtect.org". Searching for whois information on the privacyprotect.org domain, we see that although the registrant address is New Zealand, the website is hosted on a webserver on in Houston. A quick search of old whois records shows that earlier in 2007, the registrant was using Directi's Houston address, and directi.com DNS servers.

Cache Date:  2007-01-17  

Domain Name:PRIVACYPROTECT.ORG

Created On:23-Sep-2004 11:55:58 UTC
Last Updated On:11-Aug-2006 13:38:33 UTC
Expiration Date:23-Sep-2007 11:55:58 UTC

Registrant Name:Domain Manager
Registrant Organization:Privacy Protect, Inc
Registrant Street1:14781 Memorial Dr. Suite # 792
Registrant Street2:
Registrant Street3:
Registrant City:Houston
Registrant State/Province:Texas
Registrant Postal Code:77079
Registrant Country:US

Sponsoring Registrar:Direct Information PVT Ltd
 dba PublicDomainRegistry.com

Name Server:DNS1.DIRECTI.COM
Name Server:DNS2.DIRECTI.COM

Let's review the information:

1. cnomy.com is a DNS server used for the "Find Somthing Interesting" parking service
2. Cnomy.com is registered with PublicDomainRegistry, a Directi company, and hosted on a web server operated by Directi
3. The registrant of cnomy.com is privacyprotect.org, which is a privacy service operated by Directi

Let's make things interesting

A registrant search reveals that privacy.org has over 250 thousand domains registered.³ However, since Directi also runs at least one registrar, the domains registered by privacyprotect.org might actually be owned by 3rd parties. Does Directi itself own any "questionable" domains? And can we prove it? That will be the topic for the next section of the report.