Related Posts

• Vitt.com Expired Domain Auction, Joe Vitt Named Saints Head Coach
  12 Apr 2012

• Danica Patrick And Her Domain Names
  23 Feb 2012

• GoDaddy Goodies To Take A Break
  13 Jan 2012

12 Responses to ICE Seizes More Domains, Whois Changed On One

1. 
   TLD
   

   Feb 01, 2011

   .com version of rojadirecta is seized also as of right now.

   what did this site do?
2. 
   Jamie Zoch
   

   Feb 01, 2011

   @TLD,
   From my understanding, they linked to sites that offer sports streaming and P2P link site. I just added Atdhe.net and ChannelSurfing.net to the list as well. ChannelSurfing.net current is resolving to the IP address but they posted on Twitter “www.channelsurfing.net was siezed today.”
3. 
   TLD
   

   Feb 01, 2011

   I get if you’re hosting movies or hosting the broadcast, but taken down because of a link? What if they didn’t hyperlink but just put a URL address in text? Or what if in their link they put .c0m instead of .com (using a zero… so the link wouldn’t go anywhere unless the user manually edited it).
   This is a stretch, pretty soon they will ban sites that link to opinions that they don’t like.

   And what is worst, is that our tax dollars are being used for the government to try to protect the billions of profits of a few large corporations. Gee, exactly how I want my hard earned tax dollars spent. I don’t want more police on the street to catch killers or anything.
4. 
   carlos
   

   Feb 01, 2011

   Reminds me of egypt shutting down the internet. Perhaps this is a step in the goverment resolving how to censor indirectly.
5. 
   Tired Of The BS
   

   Feb 01, 2011

   Welcome to Barack Obama and Janet Napolitano’s New America. When these scumbags aren’t coming up with creative excuses that allow them to fondle you in an airport, they’re confiscating domain names due to outbound links.
6. 
   Joey Starkey
   

   Feb 02, 2011

   Major Corporations might as well run the U.S. at this point.

   They have the money in which they pay off the politicos wihch in turn make the laws.

   It will only get worse IMO. Look at the new item that the US is pushing on ICANN.

   Any domain anywhere near a TM (generic)is going to be given to any corporation that wants it. And it won’t matter if how the domain is being used.
7. 
   Michael Ronayne
   

   Feb 05, 2011

   For the 10 Domains seized by the DHS on 2011-02-01, it appears that DHS hacked the Root Name Servers to take control of the 10 Domains. The WhoIs records show the old Name Servers while the Start-Of-Authority (SOA) records show the ICE Name Servers which they user previously for the 2010-11-24 seizers:
   NS1[dot]SEIZEDSERVERS[dot]COM
   NS2[dot]SEIZEDSERVERS[dot]COM

   Domain Tools is showing incorrect information and not accurately tracking these changes. The Domain Tools, service “Name Server Spy” is rendered ineffective. I don’t know if the new DHS methodology is predicated on the desire to hide their activity or pure stupidity or both.

   The bottom line is that we can no longer trust that WhoIs, SOA, Root Name Server records will be in agreement. This makes it increasingly difficult to track what DHS is doing. The DHS is operating with the mentality of computer hackers. Why, because they can!

   You can verify what I am reporting at this website where you can do bulk lookups on all 10 Domains at the same time:
   Digwebinterface[dot]com

   Using this tool, run bulk lookups on all 10 Domains for the “A Record” and “SOA” information, using the Default and Authoritative Name Servers. You will find that the lookups for Authoritative Name Servers will fail. I suspect that this is part of the problem which Domain Tools is experiencing.

   There is a mistaken believe amongst the holders of the seized Domains that the DHS will not seize International TLD’s. This belief is in error, because on 2010-06-30 DHS seized the International Domain MOVIES-LINKS[dot]TV. Seizing the TLD of a small Pacific Island nation which is perched atop an unstable volcanic atoll is one thing, but it would be entertaining to see what would happen if the DHS seized a Chinese “.cn” TLD where most of the trademark infringement is occurring, with full Chinese State sponsorship. But DHS would not want to get the Chinese angry; the US Government might have to stop stealing money from our Great-grandchildren.

   What can we do?
   1. Have automated systems log DHS activities.
   2. Stop trusting what the high level GUI tools are reporting.
   3. Encourage tool developers to run consistency checks for tampering.
   4. Re-learn how to use low level tools such as DIG.
   5. Get the word out as to what is really going on.
   6. Support the Dot-P2P project.
   7. Be vigilant, trust nothing and verify everything.

   Mike
8. 
   Jamie Zoch
   

   Feb 05, 2011

   @Mike,
   Thanks for the great info! I can see ICE seizing a .tv domain, because .tv is run (registry) by Verisign. A U.S. Company.
9. 
   Michael Ronayne
   

   Feb 05, 2011

   @Jamie,

   You raise one very interesting question for which I don’t know the answer. How many International Domains are managed by US based companies and who are they? With the growing use of International Domains for vanity Domains and URL compression services, that could be a problem in the future. Could someone take that as a “To Do”?

   Look at the way in which the Root Name Servers are organized according to Wikipedia: en[dot]Wikipedia[dot]org/wiki/Root_nameserver, with special attention to who has control of the servers as showed in the table contained in section “Root server addresses”. For the 2011-02-01 seizure, the DHS did not require access to the Registrars, although they were apparently able to compel GoDaddy to transfer ownership in the case of the rojadirecta.org Domain. Anyone who is using GoDaddy as their Registrar, should think long and hard on that decision.

   The DHS was well aware that the 10 Domains, which they seized, had backups or would replaced and back in operation within a few hours but that was not the purpose of this exercise. The DHS want to test three things which they did successfully:

   1. Establish case law by having a Federal Judge sign a seizure order.
   2. Compel a Registrar turn over ownership of a Domain to DHS bypassing WIPO.
   3. Bypass the Registrars and directly hack the Root Name Servers.

   With the three successful dry-runs, which DHS now has under their belt, DHS is ready to do some serious seizures. What are we going to do when they come after a Domain which expresses a point of view which the Government of the United States doesn’t like? Look at WikiLeaks[dot]org, this website was only minor problem as long as the leaks were damaging to our last Chief Executive, once WikiLeaks became a problem for our current Chief Executive the story-line quickly changed.

   To @Joey who said that the “Major Corporations might as well run the U.S. at this point”, the corporations who will benefit the most from the last three sets of DHS Domain seizures, comprise the major contributors the successful election of our current Chief Executive, who is by all accounts is an honest politician because once you buy him he stays bought. If DHS had done exactly the same thing while reporting to our last Chief Executive our Free Press would be all over this story screaming about freedom speech, etc.

   In the context of the last 7,000 years of recorded Human history we must not lose sight of exactly how unique an opportunity the Internet is to the advance of Human freedom. To paraphrase an old car commercial, when America still had free car companies:

   It is not just your Domain, it is your Freedom!

   Mike
10. 
    Michael Ronayne
    

    Feb 06, 2011

    Two of the seized Domains, rojadirecta[dot]org and rojadirecta[dot]com are of high interest, because DHS appeared to take WhoIs ownership of rojadirecta[dot]org. These two Domains were replaced by rojadirecta[dot]es, rojadirecta[dot]me and rojadirecta[dot]in. The Registrar for Spanish TLD “es” doesn’t disclose any information about registrations, including the date of registration; however Domain Tools has been caching International TLD’s WhoIs records for several years now and the earliest cached date in their records for rojadirecta[dot]es is 2010-01-09 which means that the Domain existed on or before that date. The cached WhoIs records are empty except for the Name Server information which was recorded by Domain Tools.

    Now here is where things get really interesting! The two new backup Domains, rojadirecta[dot]me and rojadirecta[dot]in, were both registered on Monday 2011-01-24, a full week before the DHS seizures on Tuesday 2011-02-01. Here are the earliest cached WhoIs records (registrant only section) in Domain Tools for both Domains.

    Domain: rojadirecta[dot]in – Domain History
    Cache Date: 2011-02-01
    Server: whois[dot]inregistry[dot]net
    Domain ID: D4737402-AFIN
    Domain Name: ROJADIRECTA.IN
    Created On: 24-Jan-2011 06:12:46 UTC
    Last Updated On: 01-Feb-2011 06:09:08 UTC
    Expiration Date: 24-Jan-2012 06:12:46 UTC
    Sponsoring Registrar: Internet.bs Corp. (R111-AFIN)
    Status: CLIENT TRANSFER PROHIBITED
    Status: TRANSFER PROHIBITED
    Registrant ID: INTEqxxft095kuac
    Registrant Name: Igor Seoane
    Registrant Organization:
    Registrant Street1: Street
    Registrant Street2:
    Registrant Street3:
    Registrant City: City
    Registrant State/Province:
    Registrant Postal Code: Postalcode
    Registrant Country: ES
    Registrant Phone: +34.012345678
    Registrant Phone Ext.:
    Registrant FAX:
    Registrant FAX Ext.:
    Registrant Email: igorseoane[at]gmail[dot]com

    Domain: rojadirecta[dot]me – Domain History
    Cache Date: 2011-02-01
    Server: whois.nic[dot]me
    Domain ID: D1824953-ME
    Domain Name: ROJADIRECTA.ME
    Domain Create Date: 24-Jan-2011 18:08:49 UTC
    Domain Last Updated Date: 24-Jan-2011 18:08:56 UTC
    Domain Expiration Date:24-Jan-2012 18:08:49 UTC
    Last Transferred Date:
    Trademark Name:
    Trademark Country:
    Trademark Number:
    Date Trademark Applied For:
    Date Trademark Registered:
    Sponsoring Registrar:Dynadot LLC R30-ME
    Created by:Dynadot LLC R30-ME
    Last Updated by Registrar:Dynadot LLC R30-ME
    Domain Status:CLIENT TRANSFER PROHIBITED
    Domain Status:TRANSFER PROHIBITED
    Registrant ID:CP-106310
    Registrant Name:Igor Seoane c/o Dynadot Privacy
    Registrant Organization:
    Registrant Address: PO Box 701
    Registrant Address2:
    Registrant Address3:
    Registrant City: San Mateo
    Registrant State/Province: CA
    Registrant Country/Economy: US
    Registrant Postal Code:94401
    Registrant Phone: +1.6505854708
    Registrant Phone Ext.:
    Registrant FAX:
    Registrant FAX Ext.:
    Registrant E-mail: privacy[at]dynadot[dot]com

    I can think of only two explanations for the Domains being registered exactly one week before the DHS seizures:

    1. The timing of the registrations for the two domains was just an unusual coincidence.
    2. The security for the DHS operation was compromised and the holders of “Roja Directa” Domains knew that the DHS was coming for them.

    If the second explanation is correct, that raises a very interesting scenario and could explain a troubling bit of information which I didn’t understand. Knowing that the DHS was coming for them, and having registered the two additional backup Domains in advance, the holders of “Roja Directa” (“Red Direct”) researched the WhoIs information which the DHS could have used and once they lost SOA for the rojadirecta[dot]org Domain on 2011-02-01 they changed the WhoIs records themselves and could actually still have control of the Doman at GoDaddy. This would explain why rojadirecta[dot]com was not transferred to DHS, it being the more valuable Domain which “Roja Directa” could use in future litigation.

    The holder of “Roja Directa” Domains were the first one to report the DHS seizures on Tuesday 2011-02-01. A coincidence, I think not!

    Basically “Roja Directa” could be sending a message to DHS. In the vernacular this is know as sticking it to the Man! A comforting theory if it is true.

    Mike
11. 
    haidjj
    

    May 19, 2011

    hai nice sharing…….
12. 
    Rudy
    

    Jan 15, 2012

    What jurisdiction would ICE have over websites with .ch?
    I know of a few streaming sites. Could these be affected?
    Seems plain wrong for ICE to intercede in a sovereign country.