Blackhat SEO: edisonresearch.co.uk + domain-parking.net (aka freeparking.co.uk)

Many criminals attempt blackhat SEO, most in attempts to push up the value of their domains prior to selling them. Others, in an attempt to boost their value to prospective advertisers.

Unfortunately in this case, it appears the owner of edisonresearch.co.uk, has chosen to try and use the vURL server, to boost their domains value. They've done this by pointing the A record for the domain, to the vURL servers IP address;

82.165.40.133

Unfortunately for them, identifying and preventing such abuse, is very simple - simply require host headers for sites on your web servers (e.g. so your server can't be accessed via http://{IP}).

What is curious in this case, is their registrar, freeparking.co.uk. This particular site, which claims to be ICANN accredited (and if that's true, I'm disgusted). This particular registrar is owned by US based, domain-parking.net, which have seen fit not only to exclude phone numbers for their website, but to provide a completely invalid number in their WhoIs records - itself a violation of ICANN rules.

Domain Name.......... domain-parking.net
Creation Date........ 1999-05-27
Registration Date.... 2001-05-13
Expiry Date.......... 2013-05-27
Organisation Name.... ActiveBytes Software LLC
Organisation Address. 2530 Channin Drive
Organisation Address.
Organisation Address. Wilmington
Organisation Address. 19810
Organisation Address. DE
Organisation Address. UNITED STATES

Admin Name........... na Domain Admin
Admin Address........ 2530 Channin Drive
Admin Address........
Admin Address........ Wilmington
Admin Address........ 19810
Admin Address........ DE
Admin Address........ UNITED STATES
Admin Email.......... domadmin@domain-parking.net
Admin Phone.......... +44.18001231234
Admin Fax............ +44.18001231234

Tech Name............ Admin Domain
Tech Address......... ActiveBytes Software LLC
Tech Address......... UK Telephone Support Line
Tech Address......... 0905 2340911
Tech Address......... DE19810
Tech Address......... DE
Tech Address......... UNITED STATES
Tech Email........... domadmin@domain-parking.net
Tech Phone........... 44 905 2340911
Tech Fax............. 44 905 2340911
Name Server.......... ns3.ukdnsservers.co.uk
Name Server.......... ns4.ukdnsservers.co.uk

To make matters worse, these chaps have also seen fit to rip off those that do try calling the only VALID number in the WhoIs, by using the premium rate 0905 number (note the Tech Phone).

Domain name:
freeparking.co.uk

Registrant:
Fibranet Services Ltd

Registrant type:
Unknown

Registrant's address:
PO Box 95
2A Lord Street
Douglas
Isle of Man
IM99 1HP
Isle Of Man

Registrar:
Fibranet Services Ltd [Tag = FIBRANET]
URL: http://www.freeparking.co.uk

Relevant dates:
Registered on: 08-Jan-1999
Expiry date: 08-Jan-2013
Last updated: 11-Jan-2012

Registration status:
Registered until expiry date.

Name servers:
ns3.ukdnsservers.co.uk 72.1.201.151
ns4.ukdnsservers.co.uk 72.1.216.99

WHOIS lookup made at 02:21:24 12-Jun-2012

So to recap, it's a US company claiming to be a German company (ref the presence of "DE" in the address), claiming to be a UK company, using a fake US phone number (+44.1800), and trying to rip people off by using a premium rate number for the only valid number in the WhoIs records. And these guys are ICANN accredited???

The edisonresearch.co.uk WhoIs records isn't much help either.

Domain name:
edisonresearch.co.uk

Registrant:
Edison Investment Research

Registrant type:
Unknown

Registrant's address:
5 Newby Street
London
A1 1AA
United Kingdom

Registrar:
Fibranet Services Ltd [Tag = FIBRANET]
URL: http://www.freeparking.co.uk

Relevant dates:
Registered on: 20-Jun-2003
Expiry date: 20-Jun-2013
Last updated: 07-Jul-2011

Registration status:
Registered until expiry date.

Name servers:
ns3.ukdnsservers.co.uk 72.1.201.151
ns4.ukdnsservers.co.uk 72.1.216.99

WHOIS lookup made at 02:19:56 12-Jun-2012

Oh and no, the address in this one isn't valid either - A1 is a motorway, not a valid postcode in the UK. The correct postcode for 5 Newby Street, London, is SW8 3BQ.

/Edit

Keep forgetting Google have completely messed up the editor on Blogspot. I've now added the line breaks, sorry folks.