Petroliam Nasional Berhad v. GoDaddy.com, Inc.

Filing 143

Declaration of Perry Clark in Support of 134 MOTION for Partial Summary Judgment re Liability for Contributory Cybersquatting as to PETRONASTOWERS.NET filed byPetroliam Nasional Berhad. (Attachments: # 1 Exhibit A, # 2 Exhibit 1, # 3 Exhibit 2, # 4 Exhibit 3, # 5 Exhibit 4, # 6 Exhibit 5, # 7 Exhibit 6, # 8 Exhibit 7, # 9 Exhibit 8, # 10 Exhibit 9, # 11 Exhibit 10, # 12 Exhibit 11, # 13 Exhibit 12, # 14 Exhibit 13, # 15 Exhibit 14, # 16 Exhibit 15, # 17 Exhibit 16, # 18 Exhibit 17, # 19 Exhibit 18, # 20 Exhibit 19, # 21 Exhibit 20, # 22 Exhibit 21, # 23 Exhibit 22, # 24 Exhibit 23, # 25 Exhibit 24, # 26 Exhibit 25, *** # 27 Exhibit 26 FILED IN ERROR. DOCUMENT LOCKED. DOCUMENT TO BE REFILED LATER. *** , # 28 Exhibit 27, # 29 Exhibit 28)(Related document(s) 134 ) (Clark, Perry) (Filed on 11/25/2011) Modified on 11/28/2011 (ewn, COURT STAFF).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Ex. 18

19
20
21
22
23
24
25
26
27
28
CLARK DECL. ISO REPLY ISO MTN. PART. SUMMARY JUDGMENT
Case No: 09-CV-5939 PJH

From:
Sent:
To:
Cc:
Subject:

Emergency
Response
Team<mycert@mycert. my>
Malaysi Computer
org.
a
Wednesday,
December
2,20098:16PM
[e-mail]
[e-mail]
9
Re: [MyCERT-200 l20l 1065922]: ReportingIncident : Domain Infringement

--..-BEGIN
PGPSIGNED
MESSAGE--.-Hash:
SHA1
DearAbuse
Team,
MyCERT
a
received report
a
from an organization
regarding domainregistered
underyouradministration hosta fakewebsite the original
website
which
that
of
is can be foundat v\ n A/.petronas.com.
Domainpetronastower.net
:
petronastower.
net
URL : http://vrrunr.
lP : 64.202.189.170
Domain
Name:
PETRONASTOWER.NET
Registrar:
GODADDY.COM,
lNC.
godaddy.
\MtoisServer:
whois.
com
Referral
URL:http://registrar.godaddy.com
NameServer:
NS39.
DOMAI
NCONTROL.COM
NameServer:
NS40.DOMAINCONTROL.COM
Status clientDeleteProh
:
ibited
clientRenewProh
Status:
ibited
Status clientTransferProh
:
ibited
pdateProh
:
ibited
Status clientU
Updated
Date:02-may-2009
Creation
Date:08-may-2003
Expiration
Date:08-may-2910
pornographic contents
The domain hosting
is
web
fromhttp://unnnr.camfunchat.com
purposes this can createa likelihood
of
whichcan be usedforfraudulent
and
confusion theirclients.
to
As of at thistime,MyCERT
site
has confirmed the abovedisputed is still
that
yourassistance investigate the above
activeonline. wouldappreciate
to
on
We
siteandto closethe domain soonas possible.
as
your prompt
We appreaciate
response.
Kindly
to
retain abovesubject
the
header
containing:[MyCERT-200912411065922]
ensureeffective
response.
Regards,
- -Juanita
---lnrliala---U UI IL'ID-

Inc.
OrgName:
GoDaddy.com,
OrglD:
GODAD
Address:
14455N Hayden
Road
Address:
Suite226
City:Scottsdale
StateProv:
AZ
APP114

CONFIDENTIAL

GD-001804

PostalCode:
85260
Country:
US
ge:
NetRan 64.202.160.0 64.202.91.255
1
CIDR:
64.202.160.0/19
NetName:
E-l
GO-DAD
DY-SOFTWAR NC
NetHandle:
NET-64-202-1
60-0-1
Parent:
NET-64-0-0-0-0
NetType.
Direct
Allocation
NameServer: 1.SECURESERVER.
NET
CNS
NameServer:
CNS2.SECURESERVER.
NET
NameServer:
NET
CNS3.SECURESERVER.
Comment:
RegDate:
2OO2-10-22
Updated:
2007-06-14
OrgAbuseHandABUSE5-ARl
le:
1
N
OrgAbuseName:
AbuseDepartment
+
OrgAbusePhone:1-480-624-2505
OrgAbuseEmail
: [e-mail]
OrgNOCHandle: 124-ARl
NOC
N
OrgNOCName:
Network
Operations
Center
+1
OrgNOCPhone: -480-505-8809
Org [e-mail]
N
:
OrgTechHandle: 124-ARIN
NOC
OrgTechName:
Network
Center
Operations
+1
OrgTechPhone: -480-505-8809
OrgTech
Email [e-mail]
:
Malaysia
Emergency I E-mail:
[e-mail]
Computer
Response
Team
Hotline: [phone]
1
Cyber999
I
(MyCERT)
| Fax:[phone]
(603)89926969
CyberSecurity
Malaysia
I Phone:
Level7, Sapura@Mines
hour:0830-1730
MYT(Mon-Fri)
I Office
7, Jln Tasik,
5850
The Mines
24x7Phone:
019-266
|
Resort
43300SeriKembanganSMS:019-281
3801
City,
I
Selangor.
MALAYSIA
I URL:http://mycert.org.my/
Disclaimer:
The information
sentfrommycert.org.my
transmitted electronic
in
mailmessages
person(s) entity(ies)
domainis intended
onlyfor the
or
to
whichit is addressed,
the
and may contain
represents views/points MyCERT
of
information
issues.
extracted
fromvarious
otherreliable
sources security
on
MyCERT
therefore
doesnot acceptliability any errors, omissions the
or
in
for
contents thismessage,
of
transmission
and
whichariseas a result e-mail
of
provided.
consequences to mis-applying the technical
lf
due
of
solutions/steps
you havereceived emailby mistake,
please
at
this
notifyMyCERT [phone]
or emailus at [e-mail]
.-.--BEGIN
PGPSIGNATURE-.-.Version:
GnuPG
vZ.A.1 (FreeBSD)
1
APP115

CONFIDENTIAL

GD-001805

po
g
iEYEARECAAYFAkSXO3SAGkQO FclK27XH9RwCghzO2hhS1VOG
NYAQ9Xvku M/
BA
+dSeHh
KkcAn UqPZc+l UExUMX1
R2q
N
s/D
=lbOn
-.---END
PGPSIGNATURE--...

APP116

CONFIDENTIAL

GD-001806

From:
Sent:
To:
Cc:
Subject:

[e-mail]
December
2,20098:39PM
Wednesday,
[e-mail]
[e-mail]
Follow-Upfor US-CERTIncident
number
INC000000066795

US-CERT requesting
is
in
which
assistance removing activemalware beinghosted
an
site
within yow netblock
greatlyappreciate assistance terminating shutting site
your
affectour constituency.
would
in
or
this
US-CERT
down. destination
The
website hosting malicious andtheURL is active,
is
a
code
accessible hosting
and
'hxxp'with
malware. is thefirst attempt remove malicious
This
to
tlis
code
from thenetwork(please
replace
'http').Please
assist in a timely rernoval this IIRL from anyrelated
us
of
domains:
URL: hxxp//www[dot]petronastower.net
IP Address:
64.202.1,89.17
0
godaddy.com
Domains
hosted thisIP address:
on
Theowner/operator this website
of
mayor maynotbeaware website
maycontain
malicious
code.TheUSthis
CERTis requesting this website removed
from publicaccess theowner/operator deleted
has
that
be
until
the
malicious
content.
Please
investigate traffrcandreference
this
INC000000066795
regarding host.USthis
CERTis interested leamingof theoutcome
in
ofyour investigation
VIR
TheUnitedStates
Computer
Emergency
Readiness
Team
Department Homeland
of
Security
National
Cyber
Division/Operations
Security
Phone:
1-888-282-0870
Arlington,Virginia
E-mail [e-mail]
:
qov
Website:
www.us-cert.
EmailAttaohment
:

APP117

CONFIDENTIAL

GD-001807

From:
Sent:
To:
Subject:

<[e-mail]>
AbuseDepartment
GoDaddy
Thursday,
1:16PM
December 20Q9
3,
DaddySOC<[e-mail]>
Go
INC000000066795]
[FWD: Follow-Upfor US-CERTlncidentnumber

Attention SOC,
We have been notifiedof a possiblebreachof security.pleasereviewthe messagewe have forwardedto
you from the complainant.
you determine
If, after investigating situation,
this customer
or
this
that no actionshouldbe taken against
pleasereplyto this message the AbuseDepartment respond the
you needmore information
will
to
and
(if
complainant necessary) closeout the issue.
or
If you determine
from Go Daddyplease
take the appropriate
course
that this situationmeritsa response
of actionbased your SOP,
on
Thankyou for investigating complaint.
this
Sincerely,
Spamand AbuseDepartment
GoDaddy.com
24/7 Abuse
Department
Hotline:[phone]
ARID1019

Message
Original
Subject:
Follow-Up US-CERT
for
Incident
numberINC000000066795
From:[e-mail]
Date:Wed,December
42,20099:38 pm
To: [e-mail]
Cc: [e-mail]
t----I

tr_l is requesting
withinyour
in
site beinghosted
US-CERT
assistance removing activemalware
an

your assistance
in
netblock
wouldgreatlyappreciate
whichaffectour constituency.
US-CERT
is
website hosting malicious
a
codeand
terminating shutting
or
this site down,The destination
This is the first attemptto removethis
the URLis active,accessible hostingmalware.
and
'hxxp'with 'http').Please
malicious
replace
assistus in a timely
codefrom the network(please
removal this URL
from any related
of
domains:
net
URL: h>o<p//www[dot]petronastower.
IP Address64.242.189.
:
170
godaddy.com
Domains
hosted this IP address:
on
Theowner/operator this website
may contain
malicious
may or may not be awarethis website
of
from publicaccess
code.The US-CERT requesting
is
until the
that this websitebe removed
has
investigate trafficand reference
owner/operator deleted
this
the malicious
content.Please
INC000000066795
in
regarding host.US-CERT interested learning the outcome your
is
of
of
this

APP118

CONFIDENTIAL

GD-001808

investigation
V/R
The UnitedStatesComputer
Emergency
Readiness
Team
Depaftment Homeland
of
Security
National
Division/Operations
CyberSecurity
Phone:
1-888-282-0870
Arlington,
Virginia
E-mail SOC@us-ceft
:
.gov
Website www.
:
us-cert.qov
EmailAttachment
:

APP119

CONFIDENTIAL

GD-001809

From:
Sent:
To:
Cc:
Subject:

VincentKoski <[e-mail])
Thursday,
December 20098:46PM
3,
<[e-mail]>
GoDaddyAbuseDepartment
Go DaddySOC<[e-mail]>
RE: [FWD: Follow-Upfor US-CERTIncident
number
INC000000066795]

Abuse,
Reviewing domain
this
whichis served
contains
a
complaint| found it is hosted parkwobAndlhe index.html
that
on
of
fame srcreference carnfunchat.com, appears be an adult
to
which
to
site. I seeno indicalion thedomain
that
petronastower.net
contains malicious
any
code.
Name: oetronastower.net
Address:
64.202.189.170
Name: p,fwd-!O1
.prod.mesa1
.secureseryer.net
Address:
64.202.1
89.170
$ wgetpetronastower.net
-2005-12-03
21:40:31- htto://oetron
astowe nev
r.
petronastower.net...
Resolving
64.202.1
89.170
Connecting petronastower.netl64.202.1
to
89.1
701:80...
connected.
HTTP
request
sent,
awaiting
rcsponse... OK
200
Length: 5 [te]d/htmll
81
Saving
to:'index.html'
'LIAA/3C//DTD 4.01//EN'
<!DOCTYPE
HTML
HTML
PUBLIC
'>
wlvw.w3.oro/TRYhtm
"http:/
<html>
<head>
<title>Live Video Chat - hot Webcams - Sexy Camgids <nifle>

<META
lesbians,
name="description"
content="Free adult
live
WebCams chat.
and
Nude
sery camgirls,
teens,
content="legendary, visit,
lars,
webcam,
\oyeur,
couples,
amateur
videoandchat,5<META
name="keywords"
private,
porno,
guys,nude,
porn,
teen,models,
men,
webcarns, cams, girls,frce,video,
cam,
Iive,
women,
lesbians,
pussy,
teen,sex,)oo(,
adult,
naked"
sely,webcam,
camgirls,
home
cam9,
videochat, video,
free
</head>

<frameset
rows="1
00%,*"
border="o">
<frame
src=,'X!tpl[A4
/>
A4Sq!!fu!gIgL@8,tamebordeF,'o,'
<frame
f|ameborder="0"
noresize
/>
<fiameset>
->
<!- pageok
<!- 01 ->
<t- -->

<html>
Vincent Koski
J.
MCSA:
Security
A+,Netwoft+,
Security+,
56ry6r*
lT-Security
Secu Analyst
rity
GoDaddy
Software
'14455
North
Hayden
Road
Scottsdale. 85260
AZ
480-505-8800 4868
ext.

APP120

CONFIDENTIAL

GD-001810

Please
contact diredsupervisor [e-mail].
my
at
with
Thismessage fromGo Daddy
is
Soft\,vare. message anyattachments contain
This
and
may
contidential
information,
andareintended fortheindividual entity
only
or
or
identified
above
astheaddressee.
lfyou arenottheaddressee, if
thismessage beenaddressed youin eror, youarenotauthorized read,
to
copy, distribute message
or
this
and
has
to
(including copies) notify
anysttachments, we askihatyouplease
and
the
and
delete message attachments
this
and
all
sender retum
by
e-mail by phone [phone].
or
at
Original
Message
Subject:
for
Incident
INC000000066795]
number
[FWD:Follow-Up US-CERT
<[e-mail]>
From:"GoDaddy
AbuseDepartment"
Date:Thu,December 20092:16 pm
03.
To: "Go Daddy
SOC" <[e-mail]>
Attention
SOC,
please
We havebeennotified a possible
reviewthe message have
we
of
breach security,
of
forwarded you from the complainant.
to
you
If, afterinvestigating situation, determine
this
this
that no actionshouldbe takenagainst
please
customer you needmoreinformation
or
replyto this message the AbuseDepartment
and
(if
will respond the complainant necessary) close the issue.
to
or
out
If you determine
from Go Daddyplease
take the
that this situationmeritsa response
appropriate
course actionbased your SOP.
of
on
Thankyou for investigating complaint.
this
Sincerely,
Spamand Abuse
Department
GoDaddy.com
24/7 AbuseDepartment
Hotline:[phone]A5
ARID1019

Message
Original
Subject:
Incident
Follow-Up US-CERT
for
numberINC000000055795
From:[e-mail]
Date:Wed,December
42,20099:38 pm
To: [e-mail]
Cc: [e-mail]

US-CERT requesting
is
in
assistance removing activemalware
site beinghosted
an
withinyour netblock
whichaffectour constituency.
wouldgreatlyappreciate
US-CERT
your assistance terminating shutting
in
website
is
or
this sitedown.The destination
hosting malicious
malware.
Thisis
a
codeand the URLis active,
and
accessible hosting
'hxxp'
the first attemptto removethis malicious
replace
codefrom the network(please
'http').Please
with
assistus in a timelyremoval this URL
from any related
domains:
of
petronastower.
net
URL:hxxp//www[dot]
IP Address:
189.
64.202. 170
godaddy.com
Domains
hosted this IP address:
on

APP121

CONFIDENTIAL

GD-001811

Theowner/operator this website
may contain
may or may not be awarethis website
of
malicious
from public
is
be
code.The US-CERT requesting this website removed
that
access
Please
investigate
untilthe owner/operator deleted malicious
has
the
content.
is
this trafficand reference
INC000000066795
regarding
this host.US-CERT interested
in learning the outcome your investigation
of
of
V/R
Emergency
The UnitedStatesComputer
Readiness
Team
Department Homeland
Security
of
National
Division/Operations
CyberSecurity
Phone:
1-888-282-0870
Arlington,
Virginia
E-mail SOC@us-cert,gov
:
Website www,
:
us-cert.oov
Email
Attachment
:

#
li:i,"li,iili,;:t,';*,,-:ir: ;'j:ijli:;,i:;jil:1:ii:rj'
ij:iii

APP122

CONFIDENTIAL

GD-001812

APP123

CONFIDENTIAL

GD-001813

From:
Sent:
To:
Cc:
Subject:

MalaysiaComputer
Emergency
Response
Team<[e-mail]>
Friday,December
4,2009 72:52ANI
[e-mail]
[e-mail]
Re: [MyCERT-2009120I10659221
Incident: DomainInfringement
: Reporting

--..-BEGIN
PGPSIGNED
MESSAGE.---Hash:
SHA1
[e-mail],
Regarding abovematter, problem stillnot yet rectified.
the
the
has
yourprompt
Appreciate
actionto rectify problem
the
immediately.
Kindly
retain abovesubject
the
header
containing:[MyCERT-200912011065922]
to
ensure
effective
response.
Regards,
- -Juanita
Malaysia
Emergency
Response
Computer
Team<[e-mail]. wrote:
my>
> DearAbuseTeam,
> MyCERT
received reportfroman organization
a
a
registered
regarding domain
> underyouradministration hosta fakewebsite the original
that
of
website
which
> is can be foundat M/vw.petronas.com.
> Domain:
petronastower.net
> URL : http:l/rlunu.
petronastower.net
> lP : 64.202.189.170
> Domain
Name:
PETRONASTOWER.NET
t Registrar:
lNC.
GODADDY.COM,
> Wrois Server:
whois.godaddy.com
> Referral
URL:http://registrar.godaddy.com
> NameServer:
NS39.DOMAINCONTROL.COM
> NameServer:
NS40.DOMAINCONTROL.COM
> Status:
clientDeleteProhibited
> Status:
clientRenewProhibited
> Status:
ibited
clientTransferProh
> Status:
clientUpdateProhibited
> Updated
Date:02-may-2009
> Creation
Date:08-may-2003
> Expiration
Date:08-may-2O1O
> The domain hosting
pornographic contents
is
web
fromhttp://unnnru.camfunchat.com
> whichcan be usedfor fraudulent
purposes thiscan createa likelihood
and
of
> confusion theirclients.
to
> As of at thistime,MyCERT
site
has confirmed the abovedisputed is still
that
APP124

CONFIDENTIAL

GD-001814

> active
yourassistanceinvestigate theabove
online. would
We
appreciate
on
to
> siteandto close domain soon possible.
the
as
as
> Weappreaciate prompt
your
response.
> Kindly
retain abovesubject
the
header
containing:[MyCERT-200912011065922]
to
> ensure
effective
response.
> Regards,
> -Juanita
\
-

--------

----l

,t rl^^:^-u ut lrrtD-

> OrgName:
lnc.
GoDaddy.com,
' O r g I D :G O D A D
> Address: 4455N HaydenRoad
1
> Address:
Suite226
> City:Scottsdale
> StateProv:
AZ
> PostalCode:
85260
> Country:
US
- 64.2A2.191
> NetRange:
64.202.160.0
.255
> CIDR:64.202.1
60.0/1
I
> NEtName:
NC
GO-DADDY-SOFTWARE-I
-2A2-160-0> NetHand NET-64
le:
1
> Parent:
NET-64-0-0-0-0
> NetType:
Direct
Allocation
> NameServer:
CNSl.SECURESERVER.NET
> NameServer:
CNS2.SECURESERVER.NET
> NameServer:
CNSS.SEGURESERVER.NET
> Comment:
> RegDate:
2002-10-22
> Updated:
2007-4644
-ARIN
> OrgAbuseHandle:
ABUSESl
> OrgAbuseName:
AbuseDepartment
> OrgAbusePhone:1-480+
624-2505
> OrgAbuseEmail:
[e-mail]
> OrgNOCHandle: C124-AR|
NO
N
> OrgNOCName:
Network
Operations
Center
> OrgNOCPhone: -480-505-8809
+1
> OrgNOCEmail:
[e-mail]
> OrgTechHandle:
NOCl24-ARIN
> OrgTechName:
Network
Operations
Center
> OrgTechPhone: -480-505-8809
+1
APP125

CONFIDENTIAL

GD-001815

> OrgTechEmail:
[e-mail]

\ ---- -----

> Malaysia
Emergency I E-mail:
[e-mail]
Computer
> Response
Team
Hotline: [phone]
1
I Cyber999
t (MyCERT)
Fax:[phone]
|
> CyberSecurity
(603)89926969
Malaysia
I Phone:
> Level7, Sapura@Mines
Office
hour:0830-1730
MYT(Mon-Fri)
I
> 7, JlnTasik,
The Mines
019-266
5850
| 24xTPhone:
> Resort
City,43300SeriKembanganSMS:019-281
3801
I
> Selangor.
MALAYSIA
I URL:http://mycert.org.my/
> Disclaimer.
> The information
transmitted electronic
in
sentfrom mycert.org.my
mailmessages
> domain intended for the person(s) entity(ies)
is
only
or
to
> whichit is addressed,
represents views/points MyCERT
the
of
and may contain
> information
extracted
fromvarious
otherreliable
sources security
on
issues.
> MyCERT
therefore
doesnot acceptliability any errors, omissions the
for
or
in
> contents this message,
of
whichariseas a resultof e-mail
and
transmission
> consequences to mis-applying thetechnical
provided.
due
of
solutions/steps
lf
> you havereceived emailby mistake,
please
at
this
notifyMyCERT [phone]
> or emailus at [e-mail]
------+-Malaysia
Computer
Emergency I E-mail:
[e-mail]
Response
Team
Hotline: [phone]
Cyber999
1
I
(MyCERT)
(603)8e453442
I Fax:
(603)89926969
CyberSecurity
Malaysia
I Phone:
Level7, Sapura@Mines
MYT(Mon-Fri)
Office
hour:0830-1730
I
7, JlnTasik,
The Mines
5850
019-266
| 24xTPhone:
Resoft
3801
City,43300SeriKembanganSMS:019-281
I
Selangor.
MALAYSIA
I URL:http://myceft.org.myl
Disclaimer:
The information
transmitted electronic
in
mailmessages
sentfrommycert.org.my
domain intended for the person(s) entity(ies)
is
only
or
to
whichit is addressed,
represents views/points MyCERT
the
of
and may contain
information
extracted
otherreliable
fromvarious
sources security
on
issues.
MyCERT
therefore
doesnot acceptliability any errors, omissions the
for
or
in
contents thismessage,
of
whichariseas a result e-mail
transmission
and
of
provided.
consequences to mis-applying the technical
due
of
lf
solutions/steps
you havereceived emailby mistake,
please
this
notifyMyCERT [phone]
at
or emailus at [e-mail]
---.-BEG PGPSIGNATURE----.
IN
Version:
(FreeBSD)
v2.0.11
GnUPG
iEUEARECAAYFAkSYzcEACg BAFcIK27XHaLQCXZM3le+6Me Pui3gRk2KAGj
kQO
bn9
rACfcR Dd6YLCq
RC
4FWlQZu OGSGSW=
sJ
=VqCM

APP126

CONFIDENTIAL

GD-001816

-----END
PGPSIGNATURE-.--.

APP127

CONFIDENTIAL

GD-001817

From:
Sent:
To:
Cc:
Subject:

Malaysia
Emergency
Computer
Response
Team<[e-mail]>
December
6,20096:03PM
Sunday,
[e-mail]
[e-mail]
Re: [MyCERT-200912011065922]
Incident: DomainInfringement
: Reporting

.-.-.BEGIN
PGPSIGNED
MESSAGE.....
Hash:
SHA1
[e-mail],
Regarding abovematter, seethatthe problem the reported
the
we
of
website
underyouradministrationstillnot beenrectified.
is
you.
Foryourinformation, is the second
this
timewe are notifying
your prompt
We appreciate
actionto rectify problem
the
immediately we need
as
to update complainant
our
accordingly.
Kindly
retain abovesubject
the
header
containlng:[MyCERT-2009120110659221to
ensure
effective
response.
Regards,
- -Juanita
Malaysia
Computer
Emergency
Response
Team<[e-mail]. wrote:
my>
> [e-mail],
> Regarding abovematter, problem stillnot yet rectified.
the
the
has
> Appreciate
yourprompt
action rectify problem
to
the
immediately.
> Kindly
retain abovesubject
the
header
containing:[MyCERT-20091201
10659221ta
> ensure
effective
response.
> Regards,
> -Juanita
> Malaysia
Emergency
Response
Team<[e-mail]>
wrote:
Computer
> > DearAbuse
Team,
t t MyCERT
received reportfroman organization
a
regarding domainregistered
a
> > under
youradministration hosta fakewebsite the original
that
of
website
which
> > is can be foundat vyvrruy.petronas.com.
> > Domain:
petronastower.net
> > URL : http://www.petronastower.net
> > lP :64.2A2189.170
> > Domain
Name:PETRONASTOWER.NET
APP128

CONFIDENTIAL

GD-001818

t t Registrar:
lNC.
GODADDY.COM,
> > Wtois Server:
whois.godaddy.com
> > Referral
URL:http://registrar.godaddy.com
> > NameServer:
NS39.DOMAINCONTROL.COM
> > NameServer:
NS40.DOMAINCONTROL.COM
> > Status:
clientDeleteProhibited
> > Status:
clientRenewProhibited
> > Status:
clientTransferProhibited
> > Status:
clientUpdateProhibited
t t Updated
Date:02-may-2009
> > Creation
Date:08-may-2003
t t Expiration
Date:08-may-2010
> > The domain hosting
pornographic contents
is
fromhttp://urunru,camfunchat.com
web
> > whichcan be usedforfraudulent
purposes thiscancreate likelihood
and
a
of
> > confusion theirclients.
to
> > As of at thistime,MyCERT confirmed the abovedisputed is still
has
that
site
> > activeonline. wouldappreciate
yourassistance investigate the above
We
to
on
> > siteandto closethe domain soonas possible.
as
> > We appreaciate
your promptresponse.
> > Kindly
retain abovesubject
the
header
containing:[MyCERT-20091
2A11065922]
to
> > ensure
effective
response.
t t Regards,
> > -Juanita
) ) ===============WttOiS===============
t t OrgName:
Inc.
GoDaddy.com,
t t OrglD:
GODAD
> > Address:
14455N HaydenRoad
> > Address:
Suite226
> > City:Scottsdale
> > StateProv:
AZ
> > PostalCode:
85260
> > Country:
US
- 64.202.191
> > NetRange:
64.202.160.0
.255
> > CIDR:
64.202.
160.0/1
I
> > NetName:
GO-DADDY-SOFTWARE-INC
> > NetHandle:
NET-64-202-160-0-1
> > Parent:
NET-64-0-0-0-0
> > NetType:
Direct
Allocation
> > NameServer:
CNSl.SECURESERVER.NET
APP129

CONFIDENTIAL

GD-001819

> > NameServer:
CNS2.SECURESERVER.NET
> > NameServer:
CNS3.SECURESERVER.NET
> > Comment:
t t RegDate:
20A2-10-22
t t Updated:
2007-06-14
t t OrgAbuseHandle:
ABUSES1-ARIN
t t OrgAbuseName:
AbuseDepartment
> > OrgAbusePhone: -480-624-2505
+1
t t OrgAbuseEmail:
[e-mail]
> > OrgNOCHandle:
NOC124-ARIN
t t OrgNOCName:
Network
Operations
Center
t t OrgNOCPhone:
[phone]
t t OrgNOCEmail:
[e-mail]
t
t
t
t

t OrgTechHandle:
NOC124-ARIN
OrgTechName:
Network
Operations
Center
"
t OrgTechPhone:
[phone]
t OrgTechEmail:
[e-mail]

\ \ - - --- - -

> > Malaysia
Emergency I E-mail:
Computer
[e-mail]
> > Response
Team
Cyber999
Hotline: [phone]
1
I
(MyCERT)
Fax:[phone]
|
"
t t CyberSecurity
(603)89926969
Malaysia
I Phone:
> > LevelT,
Sapura@Mines
hour:0830-1730
Office
MYT(Mon-Fri)
I
, > 7, JlnTasik,
The Mines
019-266
5850
| 24xTPhone:
> > Resort
City,43300 Kembangan
3801
Seri
SMS:019-281
I
> > Selangor.
MALAYSIA
I URL:http://mycert.org.my/
> > Disclaimer:
> > The information
transmitted electronic
in
mailmessages
sentfrommycert.org.my
> > domain intended forthe person(s) entity(ies)
is
only
or
to
> > whichit is addressed,
represents views/points MyCERT
the
of
and maycontain
> > information
extracted
from various
otherreliable
sources security
on
issues.
t t MyCERT
therefore
doesnot acceptliability any errors, omissions the
for
or
in
> > contents thismessage,
of
whichariseas a result e-mail
of
transmission
and
> > consequences to mis-applying thetechnical
provided.
due
of
solutions/steps
lf
> > you havereceived emailby mistake,
please
this
notifyMyCERT [phone]
at
> > or emailus at [e-mail]

> Malaysia
Emergency I E-mail:
Computer
[e-mail]
> Response
Team
Hotline: [phone]
1
I Cyber999
' (MyCERT)
Fax:[phone]
|
> CyberSecurity
(603)
Malaysia
89926969
I Phone:
APP130

CONFIDENTIAL

GD-001820

> Level Sapura@Mines
7,
hour:0830-1730
MYT(Mon-Fri)
I Office
> 7, JlnTasik,
The Mines
019-266
5850
| 24x7Phone:
> Resort
43300SeriKembanganSMS:019-281
City,
3801
I
> Selangor.
MALAYSIA
I URL.http://mycert.org.my/
> Disclaimer:
> The information
transmitted electronic
in
mailmessages
sentfrom mycert.org.my
> domain intended
person(s) entity(ies)
is
onlyfor the
or
to
> whichit is addressed,
represents views/points MyCERT
the
of
and may contain
> information
extracted
fromvarious
otherreliable
sources security
on
issues.
> MyCERT
therefore
doesnot acceptliability any errors, omissions the
for
or
in
> contents this message,
of
whichariseas a resultof e-mail
transmission
and
> consequences to mis-applying thetechnical
provided.
due
of
solutions/steps
lf
> you havereceived emailby mistake,
[phone]
please
this
notifyMyCERT
at
> or emailus at [e-mail]
------+-Malaysia
Computer
Emergency I E-mail:
[e-mail]
Response
Team
Cyber999
Hotline: 300 88 2ggg
1
I
(MyCERT)
Fax:(603)8e453442
|
CyberSecurity
Malaysia
(603)89926969
I Phone:
Level7, Sapura@Mines
hour:0830-1730
MYT(Mon-Fri)
I Office
7, Jln Tasik,
The Mines
24x7Phone:
019-266
5850
|
Resort
43300SeriKembanganSMS:019-281
City,
3801
I
Selangor.
MALAYSIA
URL:http://mycert.org.my/
I
Disclaimer:
The information
transmitted electronic
in
mailmessages
sentfrommycert.org.my
domainis intended
onlyfor the person(s) entity(ies)
or
to
whichit is addressed,
represents views/points MyCERT
the
of
and may contain
information
extracted
fromvarious
otherreliable
sources security
on
issues.
MyCERT
therefore
doesnot acceptliability any errors, omissions the
for
or
in
contents thismessage,
of
whichariseas a result e-mail
of
transmission
and
consequences to mis-applying the technical
due
provided.
of
solutions/steps
lf
you havereceived emailby mistake,
please
this
notifyMyCERT [phone]
at
or emailus at [e-mail]
.---.BEGIN
PGPSIGNATURE---..
Version:
v2.A.1 (FreeBSD)
GnUPG
1
iEYEARECAAYFAkscYmwAC kQ0BAFclK27XFWwCe OdTvOtE
g
mxzs6LJiPNHNaSYiv
OPs
OxUAn 1TTqvPq 1+DcCergZWRybl
B
BA
=li1l
--...END
PGPSIGNATU
RE---..

APP131

CONFIDENTIAL

GD-001821