Does this make any sense?

So today the nytimes website went down.  The Syrian Electronic Army are being blamed.  Can we work out who they are and how they accomplished this?

If you ping www.nytimes.com the IP address comes up as 141.105.64.37.  A whois on this IP address shows that it’s in the IP range owned by Shorefront Media, Inc addressed in Moscow (reference – http://whois.domaintools.com/141.105.64.37). A reverse IP lookup on this IP shows that the syrianelectronicarmy.com domain is also linked to this IP (reference – http://reverseip.domaintools.com/search/?q=141.105.64.37).

So can we work out owns or is helping syrianelectronicarmy.com? – repeat and rinse the above.

http://whois.domaintools.com/syrianelectronicarmy.com shows the registrant information linked to a privacy service based in the US (reference – http://whois.domaintools.com/syrianelectronicarmy.com):

REGISTRANT CONTACT INFO
Whois Privacy Protection Service, Inc.
Whois Agent
PMB 368, 14150 NE 20th St – F1
Bellevue
WA
98007
US
Phone:         +1.4252740657
Fax:           +1.4259744730
Email Address: 

Should be no bother for US law enforcement to get info out of a domestic entity.  Further to that, the registered address is a UPS store in Washington (reference – http://www.theupsstorelocal.com/1181/);  really Syrian terrorists? The contact email address shows another domain – protecteddomainservices.com – rinse and repeat again (reference – http://whois.domaintools.com/protecteddomainservices.com).

Domain Name:     protecteddomainservices.com
Registrar:       Christian Investments LLC

REGISTRANT CONTACT INFO
Protected Domain Services
Protected Domain Services
191 University Blvd.
Unit 384
Denver
CO
80206-4613
US
Phone:         +1.7206339075
Email Address: 

This time its a Colorado address.  Are US nationals doing their best to protect the identity of the owners of syrianelectronicarmy.com?

Am I missing something?

Also of note is that the contact details for Shorefront Media Inc shows a Russian name and Address:

Andrey Shevchenko
Navitel Rusconnect
19/2 Lva Tolstogo st.
Moscow 119034
Russia

Have a look at www.shorefrontmedia.com. Does this really look like a website for a media marketing company.  They can’t even market themselves.  A quick Google search links this Moscow address to quite a number of reports of phishing, spamming and hacking (http://www.google.com/search?q=19/2+Lva+Tolstogo+st.+Moscow+119034+Russia).

Is this the real home of the “Syrian Electronic Army”?  Is the “Syrian” part of the name being used to demonize Syria in the same way that Russians were in 80’s and 90’s spy movies?

Leave a Reply