Petroliam Nasional Berhad v. GoDaddy.com, Inc.

Filing 124

Declaration of Nima Kelly in Support of 119 Administrative Motion to File Under Seal Motion for Partial Summary Judgment and Appendix in Support filed byGoDaddy.com, Inc.. (Attachments: # 1 Declaration Greg Schwimer ISO Plaintiff's Administrative Motion to Seal, # 2 Proposed Order, # 3 Exhibit A Part 1 to Proposed Order, # 4 Exhibit A Part 2 to Proposed Order, # 5 Exhibit A Part 3 to Proposed Order, # 6 Exhibit A Part 4 to Proposed Order, # 7 Exhibit A Part 5 to Proposed Order, # 8 Exhibit A Part 6 to Proposed Order, # 9 Exhibit A Part 7 to Proposed Order)(Related document(s) 119 ) (Slafsky, John) (Filed on 11/9/2011)

lnternetArchiveWavbackMachine

PageI ofl

fiIfifi$ffi$fr${ffi$f,lfinil
:i:r:L?..ts.F;.q,,ff
Searched for

*u
"['..,.,j

search cornpa Archivepases
re

.carnfunchat.com

77 Results

Note some duplicates are not shown, See all.
x denotes when site was updated.
Material typically becomes available here 6 months after collection. See FAQ,

SearchResultsfor Jan 01, 1996- Jun 25, 2009
1996 1997 1998 1999 2000
2001
2002
2003
2004
2005
2006
2007
2008 2009
0
0
0
0
0
0
16 pages
19 pages
9 pages
6 pages
6 pages
13 pages
5 pages
pages pagespages pages pages 2 pages
pages
*1 a n 2 1 . 2 O O 2J a n 2 8 . 2 0 0 3J a n 2 2 . 2 0 0 4 F e b 0 6 . 2 0 0 5 * O c t 0 6 . 2 0 0J a n 0 5 . 2 0 0 7 * J a n 0 4 , 2 0 0 8
J
*
*
Ju|25.200
*
6*

Apr02.2007
Jun07.2007*
Auo07.2007
Nov04.2007
Dec04.2007

Home I Help
InternetArchive I Terms of Use I PrivacvPolicv

APP098
http://web,
archive. glweb*/http://www.camfunchat.
or
I
com

CONFIDENTIAL

1212U2009

GD-000616

Internet
ArchiveWavbackMachine

""
Enter Address:
Web
:ditp;i

PageI of 1

I ilti

Takg.Me..
BaCI{,,',,',,,,i Search
Adv.

*

ri..iiiiiitrrririiirriii

r r.

!.aii!r

ilti

Compare Archive Pages

pet
Sea d for hftp:llwww. ronastowe
rche
r.net

1O Results

x denoteswhen site was updated,
Materialtypicallybecomesavailablehere 6 months after collection.
SeeFAe.

for
SearchResults Jan 01, 1996- Jun 25,2009
1996 1997 1998 1999 2000 2001 2002
0
0
0
0
0
0
0
pages
pages g e s a g e s a g e s a g e s .i .,
pa
p
p
p
p

2003

2004

2005

4 pages

1 pages

1 pages

2007 2008 2009
0
0
0
4 pages pages
pages
pages
2006

x
x
Jul13,2003 Jun07,2004 04,2005 Feb17,2006x
Feb

Home I Help
Internet
Archive I Termsof Use I PrivacvPolicv

APP099
http'.Iw eb.
I
v
archi e.org/web * lhttp'.I www.petronastower.et
I
I
n

CONFIDENTIAL

1212U2009

GD-000617

Whols Search
Results

PageI of2

2417Sales & Support [phone]
Geate AccoJnt I Foroot Passrord I Sion Out

HoME
Domains

Hosting

Email

^"r"Jli|lt

Site Builders

Business

Deals the Day
of
MarKerprace

empty

usD
Support&
codrinunity

SSL Certificates

Bob's Video
Btog

Meola

My
Account

WHOIS
Domain
Check

Resellers

PETRONASTOWER.NET
Show MyProducts
All

Checkto addthesealternate
PEIROwASfOt,lrER
domainnames.

[

sAvEt !
.tNro $0.89'ry1

Select All

.ono $9.9e',yf
sAVEr E .ME $s.swyr
sAvrr ! .uost $7.ss.,Vr
sAvEt [

snver ! .etz $e.ee',yr
snver
.US $e.sary,

Gheck to add these similar PEIROITIISI OWER.NETdomain names.
YOU can negotiate anything.
I quick tips for doing it right.
Plus... a Smoking Hot Blonde!
"lnformaliveand to the point .." - Belinda

$9.99*4/rS{VEr MYPETRONASTOWER
N..
E THEPETRONASTOWER...
E

Select All

$999. /rSAVEr E NEWPETRONASTOWER. gg?rSAVEt
$9

$9.99*4/TSAVEIBESTPETRONASTOWER..
$9.99-/YTSAVEISPETRONASTOWER.NE..,
E FREEPETRONASTOWER.
$9.99*/YTSAVEI
E
E
NET
E ..RoNASTowERsrE

.
$9.99'4/rsAVEl sreeerRor,rAsTowER.
I

$9.99.,ysAVEr .RoNASToWERoNL|NE.NET $999-ryr
f]
SAVEI

E out tnepernoNAsTow... $9.99*/yrSAVE| ...ROT.TRSTOWERSTORE.NET
$9.99*lyrSAVE| STOREPETRONASTOWE...
$e.99'/yrSAVE!
!
E
Check to add these Premium domain names. ffi

Sehct All

!

MarvelTower.corn$480.00

I

TowerMaintenance.corn
$995.00

I

gToaer.com94,995.00
Lightnin

I

g.com $1,588.00
TowerAdvertisin

!

To,rrerApartments.com
$2,388.00

I

TowerBroodcasting,com
$1,588O0

tj iiiiii??

$1.99* OMATNS
D

i i i i i i i j i I i I i ??i: I

:i:::::l
l:::::::;9*#:ll{i.:{i*F.:f

!#4!
'Plus ICANN tus of
$0.18 per domsin nme yeil
".CA dffiain namgs will b€ registsBd hrough Go Daddy Domains Canada, Inc., a CIRA certified rogisbar

No quantitylimitlWith every
product buy*
you
new,non-domain
Interested in this
domain name?
helpyouget it.

$1.99 Domain Names

World-Class Web Hosting
featurinq
99.90.6
uptime.
fee setu

APP100
http:II who.godaddycom/lVhols.aspx? ain-p etron
.
dom
astower.
net&prog i d-g odad
dy

CONFIDENTIAL

1212U2009

GD-000618

Whols Search
Results

Page2 of 2

The datacontained GoDaddy
in
com,lnc.'s\rVHOlS
database,
whilebelieved the company be reliable, provided is"
by
to
is
"as
with no guarantee warranties
or
regardingits accuracy.
This
information provided the sole purposeof assisting
is
for
you
in obtaininginformation
aboutdomainnameregistration
records.
Any use of this data for any other purposeis expressly
forbidden
withoutthe priorwritten
permission GoDaddy.com, By submitting inquiry,
of
Inc.
an
you agreeto thesetermsof usageand limitations warranty.In particular,
of
you agree not to use this data to allow,enable,or otherwisemake possible,
dissemination collectionof this data, in part or in its entirety,for any
or
purpose,
suchas the transmission unsolicited
of
advertising
and
solicitations any kind,including
of
spam You further
agree
not to use this data to enablehighvolume,automated roboticelectronic
or
processes
designed collect compile datafor any purpose,
to
or
this
including
purposes.
mining
this datafor yourown personal mmmercial
or
Pleasenote:the registrant the domainname is specified
of
in the "registranf'field. mostcases,
In
GoDaddy.com,
Inc.
is not the registrant domainnameslistedin this database.
of
Registrant:
DavidDaash
AvenidaLazaro
Colonia
Las Brisas
Mexico.Mexico64780
Mexico
Registered
through:GoDaddy.com, (http://wwv.godaddy.com)
Inc.
Domain
Name:PETRONASTOWER.
NET
Createdon: 08'May-03
Erpireson: 08-May-10
Last Updatedon: 02-May-09
Administrative
Contact:
Schoenekess,
Heikoddd_privat@hotmail
com
BPM195226
372 OId Skeet
London,
London
ECI V 9AU
UnitedKingdom
+44.2076636606
TechnicalContact:
Schoenekess,
[e-mail]
BPM195226
372 Old Skeet
London,
LondonECI V 9AU
United
Kingdom
[phone]
Domainserversin listedorder:
NSSg.DOMAI NTROL.COM
NCO
NS4O.
DOMAI
NCONTROL.COM
RegistryStatus:clientDeleteProhibited
RegistryStatus:clientRenewProhibited
RegistryStatus:clientTransferProhibited
RegistryStatus:clientUpdateProhibited
See Underlying
RegistryData
ReoortInvalid
Whois

Sign up forspEcial offers:
Account Manager
My Account
My Renewals
My Upgrades
Accounl Settings
Grstomer lnformation
Order History
Geate Accounl

Enteryouremail addres€
Shopping
* Offer Disclaimers
Domain Seardr
ProductCatalog
ProductAdvlsor
Gift Cards
co Daddy Mobile
Todat's Offers

Resources
\tVebmail
\A/FlOlSsearcfr
ICANN Contrmation
Affiliates
Connec{ with Us
Gadgets/Wdgets
Site Map

HelpandSupport
Telephone
Support Sales
&
Billing
Supporl
Email Support
Our
Team
Frequenty
AskedQuestlons
UsefsGuides
Report
Spam
TestOurProducts

About Go Daddy
Careers
Security Center
Company Info
News Center
Customer Testimonials
Vvhat's New
Legal
Markeling Propomls

GoDaddy.com is the world's No. 1 |CANN-accredited domain name regisfar for .COM, NET, ORG, INFO, .BlZ and US domain extensions. Source: RegistrarsTATs.com
Copyright @ 1999 - 2009 coDaddy.com, Inc. All rights reserved.

APP101
http: I who.
godaddy.
I
com/Whols.
aspx?
domain-petronastower.
net&prog_i
d:godaddy

CONFIDENTIAL

1212112009

GD-000619

eNom- domainname,web sitehosting,email,registration

PageI of4

Become a domain reseller todav! Learn More
Register

Transfer

Register Domain
A
Domains Hosting

Email

SSL Certificates More Products

Resellers

Get Started

My Cart

>
> WhoisSearch
Hp-n-q Dp_m-arru

Yi-ew.our -v lib.ra.ry.
hp.lp.idep.

Search
WhoisRecords
ilitiif{iili::il{fji::t:llffi{:i:i:]i11

Enter domain search
a
to

*f'.ffi'ffiW",##ij$

Featured
domainnames
Premium Domains
.TV
i" morning.tv

$4,500 i ,rose.tv

$5,000

l"'industry.tv

$5,000 i"',keith.w

$1,750

i"'goodwill.tv

$5,000 i"'pueblo.tv

$4,500

Y-l-ew-In-pr-e

Exclusively at NameJet

efd05,p.o.m
phppryithjat.aanil

*i;1ll
l:d:1:

Youmaybe interested these
in

APP102
http://www.
enom.
comiwhoisidefault.
aspx?DomainName-camfunchat.
com

CONFIDENTIAL

1212U2009

GD-000620

eNom- domainname,web sitehosting,email,registration

RelatedDomains
i
f

"
"'

Page2 of 4

Premium Domains
.TV

cam ngossip.com

i"' funchat.tv

camgameschat.com

j

concierge.tv

l"' riverfunchat.com

i"' sarah.tv

i'"' camfunconfab.com

i"' postcard.tv

i'-' camhumourchat.com

l''' benefit.tv

Y-ie-w-mpr-e

s100
$1,000
$s00
$1,000
$500

View more

Backorder at NameJet
sunchase-solar.com

c
unchaxtE
d:ga.l!s.ry. om.
bunchable.com
funchaldowntownbris com
a.
outrunchalet.com
Vlew more

The best products available!
Domains
,iii;ii;;,;i:ii:i:i:i:i:

or
a
.iilji;i1i.ii;ii Resister transfer domain
name

,*Enht
4i*:iilL#

';iitiii.'".'.'""" PfOtgCt
lD
qn
, ..i]iii Kp..ep.yqur.ds.marr(.s).Hfo.ffBf

ffi

ffiffi

Privat-e.

RichContent
eonJcxlrplly.
r.elplanL
cqolc-nL
fo..r
y.oxr.w-ebB.ite.

SSL Gertificates
Web Hosting
PowerfrrlWindows@ Linux
&
F.eatunrrg.Y-.sn$.igru.s.-E$.&.Qp.o.Trust
plallo.nns.

SSL certificates

Business
Listing

y.o.r.{
Sptfu
snd..U-.{!.each.the.p.ascr..o.f
domain

it+iiffi pop Email

i.'',
iiijl,,, g;i $g-sgle- -cpa-m:prqt-e-o!-ed
-4{d-e-m-atl

'flfi$iifi.l..fs

Web Site Creator
qkir-g -srt-E-H
Buld.a.
er-e.a!.!s -w-eb
minutes

Instant Mobilizer
y-o.Br.site
C-r-ea-tc--a.msb.ile.v.e.ni-o,n.-o-f
ffihiffi

in seconds

Adding value with branded services

" RatePoint
ffi*Hw,g*F*r*,ff
i\i:'r:)i:':'''
:;::i:"':::i:i:i::::

grow bruiness'
their Get
t*HflJ;,Hi;:?';*Ttifr,lHiJ.,lJ#'i:f,1"f:iT1i'#,5.LTi:tT#

APP103
http://www.
enom.
com/whoi
s/default.
aspx?DomainName-camfunchat.
com

CONFIDENTIAL

r212U2009

GD-00a621

eNom- domainname,web sitehosting,email,registration

Page of4
3

WHOISInformation
Visit AboutUs.org for more information about ca.mfu.a-s_h_al-c.o.m
Ab.s.u1Us.l.-c.aefu
nshaL.e.o.
m
Registrant:
nJa
Heiko Schoenekess
BPM 195226
372 Old Street
London London ECIV 9AU GB

Get Noticed on the Internet! Increasevisibility for this domain name by listing it at .Wt!flry,W.hgit-'hU-surg.l.SlipJlltg!,g9Ul

Administrative:
nla
Heiko Schoenekess

BPM r9s226
372 Old Street
London London ECIV gAU GB
t u i*r ri rr<rtGii irtirr,r i [ .r-:n
rrt
Technical:
nla
Heiko Schoenekess
BPM 195226
372 Old Street
London London ECIV 9AU GB
d * tl.,ir:'ivattEi':+trir e il . cr)nr
Nameserver:
NS2.KOLIDO.NET
NSI.KOLIDO.NET
NS3.KOLIDO.NET
Updated-date:
2009-06-02I 3:49:09.000
Created-date: 1-07-0323:28:20.000
200
Registration-expiration-date:
2010-07-03
23:28:19.000
Status registrar:
lock
Domain: carnfunchat.com
Please
Note: Accessto eNom's Whois information is for informational purposesonly. eNom makesthis information available "as is," and doesnot
its
quaranJeg accuracy.The compilation, repackaging,disseminationor other use of eNom's Whois information in its entirety, or a substantialportion
thereof, is expresslyprohibited without the prior written consentof eNom by accessing
and using our Whois information, you agreeto theseterms.
BackorderDomain

Enter a domain aboveto searchthe Whois records.

ba.qk t_op
tpA!..o.u.tUs.l
Cso-te.-cL.U-s.l-c.er.ests.l
H-elp
l
$-Erv.ic.es.l l h.isne l lt4anteaanse
N-e-rry.s
l kess.Relea.cee
l l${t-p.rc lv{ap
l $i!s
Awards & Achievements

{,S#i{Snn
*
l.$8:rrn.n'ire
E: S ii::{!.l .::':lltlt:i:tlllr:
Msr-eAw-ard$..&.
A-shie.vsrrLe-nts

Payment Options
i"""""""""i

W#$ffi
1r+uw,r+s{,i
Vip.wPn-ciae.
D.eh.ilc

Copyright@ 1998-2009
eNom Inc. All righe reserved.
Tegtls & e-_ondrti-sns
I Pnyacy pslicy

APP104
http://www.enom.
com/whois/default.
aspx?DomainName-camfunchat.
com

CONFIDENTIAL

ttt
iiirl:*i;:'
ri'*',n,:o+
"JrrJ,,

1212U2009

GD-000622

eNom- domainname,web sitehosting,email,registration

Page4 of 4

APP105
http://www.
enom.
com/whois/default.
aspx?DomainNamrcamfunchat.
com

r212U2009

CONFIDENTIAL

GD-000623

VISIT-X - AmateurWebcamCommunity

Page of3
I

Who is online

(163)
Girls

Boys(20)

C oupl es (18)

Feti sh (32)

Free galleries

Atl

New

Top rated

Hotties

BigTits

Chubby

Flirt

Live.

Register For Free
Tattoos/Piercings

Instant access

User:

Password:

LostPassword?

Register For Free

http.//www.vi sit-x.netl?w--6944&ws:0 90 I 002

CONFIDENTIAL

APP106

1212U2009

GD-000624

VISIT-X - AmateurWebcamCommunity

Page2 of 3

DarkTemptation
0ralBitch
online
online
ffiffi
ffi ffiH
Hot Clips

Shop

Hot Clips

Allinclusive4U
online
ffif"EiH jfl
E
HotClips

Sabrinahot69
online
ffi ffi f;lt

http://www.vi sit-x.netl?w- 6944&ws-0 90I 002

CONFIDENTIAL

APP107

1212v2009

GD-000625

VISIT-X - AmateurWebcamCommunity

Page of3
3

1

- \A/hois online
- Free galleries

CONFIDENTIAL

3

4

5

6

7

8

9

- RegisterCam
- Host login

- Register Free
For
- Instant
access
- RSS-Feed

http://www.vi sit-x.netJ w: 6944&ws=09 I 002
?
0

2

- AffiliateProgram
- Terms of Service

- VlSlT-X TV
on
- Venus2009

- lmprint
- Support
- Protection minors
of

APP108

10

1'

Feec

ffifP
This
@1 9

1212U2009

GD-000626

Petronastower.net andName Server
DNS
Lookup- Who.is

gr,**
iii;ii
.;iiti.. i!iii,,',rr,,..
,,
..i:i:ii:tiiii....

Whois

Site lnfo

Name Suqgest

EAa
tiffitriffiliffii_,H.b
P9=
iroor-s
i erns

PageI of 2

PremiumNames Web Search DNS Whois Index lP

R
i DNS g-c.91_d9
L,,,,Whuu,1=,,,Soa,eictr,,,J

Petronastower.net andName
DNS
Server
Lookup

i Traceroute
i Name
Server
Search
iRos uy eoogte
:'
lP
i. M YReal
i. Server
i Linux
Video
Server
i Linux
Domain
;

Ads by Google

DNS.
DHCP IPAM
&
Secureand scalable
core network
seruices
with Infoblox
appliances.
unrvrru.altaware.com

^'tus {l'l*gtr
u1r

Find lnfo On Your Search
How Do I Find My Primary
And Secondary
Dns Servers
\qnryryv.lnfo.com

: www.Bing.comfravel

Kuala
Lumpur
Malaysia
Know BeforeYou Go.
Read Reviewsfrom RealTravelers.
umnv.TripAdvisor.com

P-EI IIASI9}ryF E N UEg-E-BY-EB9
B, I A
II
B-SName Server

lP

Location

ns39.domaincontrol.
com

Fly Cheap to Kuala i
Lumpur
i
7oalo KualaLumpuri
off
AirfareCompareKualai
LumpurFlights Save i

-Lu
Kuala mpu
r.Flig
hts.Asia.cori

ns40.domaincontrol.
com
ping petronastower.
net

P_EIB_qNA_s_T9-v,yE.B,llEI._s_g..A..BF_c_g..B.D_.
ns39.domaincontrol.com

Email

i Workgroup Clusters
based
i nMOOpteron
scalable
HPC
: shared
: SeruerSolutions

NameServer

[e-mail]

Serial Number 2007040100

DNS , DHCP & IPA M
S ec ur eand s c a l a b l e
core network services
wit h I nf oblo x
appliances.
www.altaware.com

I hours

Retry

2 hours

Expiry

i www.nor-tech.com/amd

Refresh

7 days

Minimum

1 day

PETRONASTOWER.NET RECORDS
DNS

Record

Type

TTL

Priority

Content

mai petronastower. C N A ME t hour
L
net

pop.secureserver.
net

petronastower.net A

64.202.189.170
(Scottsdale, US)
AZ,

hfip://www.who.i s/dns/petronastower.
net/

CONFIDENTIAL

APP109

t hour

t212U2009

GD-00a627

Petronastower.net andName Server
DNS
Lookup- Who.is

petronastower.net MX
petronastower.net MX

Page2 of 2

t hour

0

smtp.secureseryer.net

t hour

10

mailstorel.secureserver.
net

petronastower.net NS
petronastower.net NS

t hour

ns39,
domai
ncontrol.com

t hour

ns40.
domai
ncontrol.
com

petronastower.net SOA

1 day

ns39.domaincontrol.
com.
dns.jomax. 20070401
net.
00
288007200 60480086400

www.petronastower.net
CNAME t hour

petronastower.net

gt_o_FpFIEg-l\lASIpl^/_E_B,ftFI
BELAIEPQgtyTAIt)f
jomax.net secureserver.net
domaincontrol.com

GiveUs Feedbackbluerider.com, info,WkiName,
tld
DomainReqistration
@2005-2009
Who,is

http:/iwww.who.i s/dns/petronastower.
net/

CONFIDENTIAL

APP110

1212U2009

GD-000628

IIT|{L puBlIC "-//w3C//mD
8nr,
{.01//EX"
4/strlc!.drdn>
"ht!p://w.uJ.org/Tp/htrt

<tDocTypB

<titl€>r,ive
Vid6o ch6t
<META h46=ridosc!1ptid"
<flues€r
<f!@
<f.d€

- hot W€b.ffi
.*a"na=""...

r( bold€r=ion>
!@s=i1001,
slc='thttp://lw.cafunchat,cm.
rranebo!d€!='.0"
norest26
/>

- sery
Iiv6

C.ngi!1s
</ritte>
adult
lt6b c.G
and chat.

fldebord6!-nOn

Nud€ s€ly

cdgllts,

t€6ns,

fesbiaNr

voy6ur,

coupt6s,

dat€ut

vid€o

ad

chat..'>

/>

APP111

CONFIDENTIAL

GD-000629

APP112

APP113

From:
Sent:
To:
Cc:
Subject:

Emergency
Response
Team<mycert@mycert. my>
Malaysi Computer
org.
a
Wednesday,
December
2,20098:16PM
[e-mail]
[e-mail]
9
Re: [MyCERT-200 l20l 1065922]: ReportingIncident : Domain Infringement

--..-BEGIN
PGPSIGNED
MESSAGE--.-Hash:
SHA1
DearAbuse
Team,
MyCERT
a
received report
a
from an organization
regarding domainregistered
underyouradministration hosta fakewebsite the original
website
which
that
of
is can be foundat v\ n A/.petronas.com.
Domainpetronastower.net
:
petronastower.
net
URL : http://vrrunr.
lP : 64.202.189.170
Domain
Name:
PETRONASTOWER.NET
Registrar:
GODADDY.COM,
lNC.
godaddy.
\MtoisServer:
whois.
com
Referral
URL:http://registrar.godaddy.com
NameServer:
NS39.
DOMAI
NCONTROL.COM
NameServer:
NS40.DOMAINCONTROL.COM
Status clientDeleteProh
:
ibited
clientRenewProh
Status:
ibited
Status clientTransferProh
:
ibited
pdateProh
:
ibited
Status clientU
Updated
Date:02-may-2009
Creation
Date:08-may-2003
Expiration
Date:08-may-2910
pornographic contents
The domain hosting
is
web
fromhttp://unnnr.camfunchat.com
purposes this can createa likelihood
of
whichcan be usedforfraudulent
and
confusion theirclients.
to
As of at thistime,MyCERT
site
has confirmed the abovedisputed is still
that
yourassistance investigate the above
activeonline. wouldappreciate
to
on
We
siteandto closethe domain soonas possible.
as
your prompt
We appreaciate
response.
Kindly
to
retain abovesubject
the
header
containing:[MyCERT-200912411065922]
ensureeffective
response.
Regards,
- -Juanita
---lnrliala---U UI IL'ID-

Inc.
OrgName:
GoDaddy.com,
OrglD:
GODAD
Address:
14455N Hayden
Road
Address:
Suite226
City:Scottsdale
StateProv:
AZ
APP114

CONFIDENTIAL

GD-001804

PostalCode:
85260
Country:
US
ge:
NetRan 64.202.160.0 64.202.91.255
1
CIDR:
64.202.160.0/19
NetName:
E-l
GO-DAD
DY-SOFTWAR NC
NetHandle:
NET-64-202-1
60-0-1
Parent:
NET-64-0-0-0-0
NetType.
Direct
Allocation
NameServer: 1.SECURESERVER.
NET
CNS
NameServer:
CNS2.SECURESERVER.
NET
NameServer:
NET
CNS3.SECURESERVER.
Comment:
RegDate:
2OO2-10-22
Updated:
2007-06-14
OrgAbuseHandABUSE5-ARl
le:
1
N
OrgAbuseName:
AbuseDepartment
+
OrgAbusePhone:1-480-624-2505
OrgAbuseEmail
: [e-mail]
OrgNOCHandle: 124-ARl
NOC
N
OrgNOCName:
Network
Operations
Center
+1
OrgNOCPhone: -480-505-8809
Org [e-mail]
N
:
OrgTechHandle: 124-ARIN
NOC
OrgTechName:
Network
Center
Operations
+1
OrgTechPhone: -480-505-8809
OrgTech
Email [e-mail]
:
Malaysia
Emergency I E-mail:
[e-mail]
Computer
Response
Team
Hotline: [phone]
1
Cyber999
I
(MyCERT)
| Fax:[phone]
(603)89926969
CyberSecurity
Malaysia
I Phone:
Level7, Sapura@Mines
hour:0830-1730
MYT(Mon-Fri)
I Office
7, Jln Tasik,
5850
The Mines
24x7Phone:
019-266
|
Resort
43300SeriKembanganSMS:019-281
3801
City,
I
Selangor.
MALAYSIA
I URL:http://mycert.org.my/
Disclaimer:
The information
sentfrommycert.org.my
transmitted electronic
in
mailmessages
person(s) entity(ies)
domainis intended
onlyfor the
or
to
whichit is addressed,
the
and may contain
represents views/points MyCERT
of
information
issues.
extracted
fromvarious
otherreliable
sources security
on
MyCERT
therefore
doesnot acceptliability any errors, omissions the
or
in
for
contents thismessage,
of
transmission
and
whichariseas a result e-mail
of
provided.
consequences to mis-applying the technical
lf
due
of
solutions/steps
you havereceived emailby mistake,
please
at
this
notifyMyCERT [phone]
or emailus at [e-mail]
.-.--BEGIN
PGPSIGNATURE-.-.Version:
GnuPG
vZ.A.1 (FreeBSD)
1
APP115

CONFIDENTIAL

GD-001805

po
g
iEYEARECAAYFAkSXO3SAGkQO FclK27XH9RwCghzO2hhS1VOG
NYAQ9Xvku M/
BA
+dSeHh
KkcAn UqPZc+l UExUMX1
R2q
N
s/D
=lbOn
-.---END
PGPSIGNATURE--...

APP116

CONFIDENTIAL

GD-001806

From:
Sent:
To:
Cc:
Subject:

[e-mail]
December
2,20098:39PM
Wednesday,
[e-mail]
[e-mail]
Follow-Upfor US-CERTIncident
number
INC000000066795

US-CERT requesting
is
in
which
assistance removing activemalware beinghosted
an
site
within yow netblock
greatlyappreciate assistance terminating shutting site
your
affectour constituency.
would
in
or
this
US-CERT
down. destination
The
website hosting malicious andtheURL is active,
is
a
code
accessible hosting
and
'hxxp'with
malware. is thefirst attempt remove malicious
This
to
tlis
code
from thenetwork(please
replace
'http').Please
assist in a timely rernoval this IIRL from anyrelated
us
of
domains:
URL: hxxp//www[dot]petronastower.net
IP Address:
64.202.1,89.17
0
godaddy.com
Domains
hosted thisIP address:
on
Theowner/operator this website
of
mayor maynotbeaware website
maycontain
malicious
code.TheUSthis
CERTis requesting this website removed
from publicaccess theowner/operator deleted
has
that
be
until
the
malicious
content.
Please
investigate traffrcandreference
this
INC000000066795
regarding host.USthis
CERTis interested leamingof theoutcome
in
ofyour investigation
VIR
TheUnitedStates
Computer
Emergency
Readiness
Team
Department Homeland
of
Security
National
Cyber
Division/Operations
Security
Phone:
1-888-282-0870
Arlington,Virginia
E-mail [e-mail]
:
qov
Website:
www.us-cert.
EmailAttaohment
:

APP117

CONFIDENTIAL

GD-001807

From:
Sent:
To:
Subject:

<[e-mail]>
AbuseDepartment
GoDaddy
Thursday,
1:16PM
December 20Q9
3,
DaddySOC<[e-mail]>
Go
INC000000066795]
[FWD: Follow-Upfor US-CERTlncidentnumber

Attention SOC,
We have been notifiedof a possiblebreachof security.pleasereviewthe messagewe have forwardedto
you from the complainant.
you determine
If, after investigating situation,
this customer
or
this
that no actionshouldbe taken against
pleasereplyto this message the AbuseDepartment respond the
you needmore information
will
to
and
(if
complainant necessary) closeout the issue.
or
If you determine
from Go Daddyplease
take the appropriate
course
that this situationmeritsa response
of actionbased your SOP,
on
Thankyou for investigating complaint.
this
Sincerely,
Spamand AbuseDepartment
GoDaddy.com
24/7 Abuse
Department
Hotline:[phone]
ARID1019

Message
Original
Subject:
Follow-Up US-CERT
for
Incident
numberINC000000066795
From:[e-mail]
Date:Wed,December
42,20099:38 pm
To: [e-mail]
Cc: [e-mail]
t----I

tr_l is requesting
withinyour
in
site beinghosted
US-CERT
assistance removing activemalware
an

your assistance
in
netblock
wouldgreatlyappreciate
whichaffectour constituency.
US-CERT
is
website hosting malicious
a
codeand
terminating shutting
or
this site down,The destination
This is the first attemptto removethis
the URLis active,accessible hostingmalware.
and
'hxxp'with 'http').Please
malicious
replace
assistus in a timely
codefrom the network(please
removal this URL
from any related
of
domains:
net
URL: h>o<p//www[dot]petronastower.
IP Address64.242.189.
:
170
godaddy.com
Domains
hosted this IP address:
on
Theowner/operator this website
may contain
malicious
may or may not be awarethis website
of
from publicaccess
code.The US-CERT requesting
is
until the
that this websitebe removed
has
investigate trafficand reference
owner/operator deleted
this
the malicious
content.Please
INC000000066795
in
regarding host.US-CERT interested learning the outcome your
is
of
of
this

APP118

CONFIDENTIAL

GD-001808

investigation
V/R
The UnitedStatesComputer
Emergency
Readiness
Team
Depaftment Homeland
of
Security
National
Division/Operations
CyberSecurity
Phone:
1-888-282-0870
Arlington,
Virginia
E-mail SOC@us-ceft
:
.gov
Website www.
:
us-cert.qov
EmailAttachment
:

APP119

CONFIDENTIAL

GD-001809

From:
Sent:
To:
Cc:
Subject:

VincentKoski <[e-mail])
Thursday,
December 20098:46PM
3,
<[e-mail]>
GoDaddyAbuseDepartment
Go DaddySOC<[e-mail]>
RE: [FWD: Follow-Upfor US-CERTIncident
number
INC000000066795]

Abuse,
Reviewing domain
this
whichis served
contains
a
complaint| found it is hosted parkwobAndlhe index.html
that
on
of
fame srcreference carnfunchat.com, appears be an adult
to
which
to
site. I seeno indicalion thedomain
that
petronastower.net
contains malicious
any
code.
Name: oetronastower.net
Address:
64.202.189.170
Name: p,fwd-!O1
.prod.mesa1
.secureseryer.net
Address:
64.202.1
89.170
$ wgetpetronastower.net
-2005-12-03
21:40:31- htto://oetron
astowe nev
r.
petronastower.net...
Resolving
64.202.1
89.170
Connecting petronastower.netl64.202.1
to
89.1
701:80...
connected.
HTTP
request
sent,
awaiting
rcsponse... OK
200
Length: 5 [te]d/htmll
81
Saving
to:'index.html'
'LIAA/3C//DTD 4.01//EN'
<!DOCTYPE
HTML
HTML
PUBLIC
'>
wlvw.w3.oro/TRYhtm
"http:/
<html>
<head>
<title>Live Video Chat - hot Webcams - Sexy Camgids <nifle>

<META
lesbians,
name="description"
content="Free adult
live
WebCams chat.
and
Nude
sery camgirls,
teens,
content="legendary, visit,
lars,
webcam,
\oyeur,
couples,
amateur
videoandchat,5<META
name="keywords"
private,
porno,
guys,nude,
porn,
teen,models,
men,
webcarns, cams, girls,frce,video,
cam,
Iive,
women,
lesbians,
pussy,
teen,sex,)oo(,
adult,
naked"
sely,webcam,
camgirls,
home
cam9,
videochat, video,
free
</head>

<frameset
rows="1
00%,*"
border="o">
<frame
src=,'X!tpl[A4
/>
A4Sq!!fu!gIgL@8,tamebordeF,'o,'
<frame
f|ameborder="0"
noresize
/>
<fiameset>
->
<!- pageok
<!- 01 ->
<t- -->

<html>
Vincent Koski
J.
MCSA:
Security
A+,Netwoft+,
Security+,
56ry6r*
lT-Security
Secu Analyst
rity
GoDaddy
Software
'14455
North
Hayden
Road
Scottsdale. 85260
AZ
480-505-8800 4868
ext.

APP120

CONFIDENTIAL

GD-001810

Please
contact diredsupervisor [e-mail].
my
at
with
Thismessage fromGo Daddy
is
Soft\,vare. message anyattachments contain
This
and
may
contidential
information,
andareintended fortheindividual entity
only
or
or
identified
above
astheaddressee.
lfyou arenottheaddressee, if
thismessage beenaddressed youin eror, youarenotauthorized read,
to
copy, distribute message
or
this
and
has
to
(including copies) notify
anysttachments, we askihatyouplease
and
the
and
delete message attachments
this
and
all
sender retum
by
e-mail by phone [phone].
or
at
Original
Message
Subject:
for
Incident
INC000000066795]
number
[FWD:Follow-Up US-CERT
<[e-mail]>
From:"GoDaddy
AbuseDepartment"
Date:Thu,December 20092:16 pm
03.
To: "Go Daddy
SOC" <[e-mail]>
Attention
SOC,
please
We havebeennotified a possible
reviewthe message have
we
of
breach security,
of
forwarded you from the complainant.
to
you
If, afterinvestigating situation, determine
this
this
that no actionshouldbe takenagainst
please
customer you needmoreinformation
or
replyto this message the AbuseDepartment
and
(if
will respond the complainant necessary) close the issue.
to
or
out
If you determine
from Go Daddyplease
take the
that this situationmeritsa response
appropriate
course actionbased your SOP.
of
on
Thankyou for investigating complaint.
this
Sincerely,
Spamand Abuse
Department
GoDaddy.com
24/7 AbuseDepartment
Hotline:[phone]A5
ARID1019

Message
Original
Subject:
Incident
Follow-Up US-CERT
for
numberINC000000055795
From:[e-mail]
Date:Wed,December
42,20099:38 pm
To: [e-mail]
Cc: [e-mail]

US-CERT requesting
is
in
assistance removing activemalware
site beinghosted
an
withinyour netblock
whichaffectour constituency.
wouldgreatlyappreciate
US-CERT
your assistance terminating shutting
in
website
is
or
this sitedown.The destination
hosting malicious
malware.
Thisis
a
codeand the URLis active,
and
accessible hosting
'hxxp'
the first attemptto removethis malicious
replace
codefrom the network(please
'http').Please
with
assistus in a timelyremoval this URL
from any related
domains:
of
petronastower.
net
URL:hxxp//www[dot]
IP Address:
189.
64.202. 170
godaddy.com
Domains
hosted this IP address:
on

APP121

CONFIDENTIAL

GD-001811

Theowner/operator this website
may contain
may or may not be awarethis website
of
malicious
from public
is
be
code.The US-CERT requesting this website removed
that
access
Please
investigate
untilthe owner/operator deleted malicious
has
the
content.
is
this trafficand reference
INC000000066795
regarding
this host.US-CERT interested
in learning the outcome your investigation
of
of
V/R
Emergency
The UnitedStatesComputer
Readiness
Team
Department Homeland
Security
of
National
Division/Operations
CyberSecurity
Phone:
1-888-282-0870
Arlington,
Virginia
E-mail SOC@us-cert,gov
:
Website www,
:
us-cert.oov
Email
Attachment
:

#
li:i,"li,iili,;:t,';*,,-:ir: ;'j:ijli:;,i:;jil:1:ii:rj'
ij:iii

APP122

CONFIDENTIAL

GD-001812