Moniker

**Moniker Online Services LLC** is a registrar in the United States.

# Anti-Spam Position

## Official Position

From the former Moniker Registration Agreement

```
13. PROHIBITED CONDUCT

You agree that the following is a non-exclusive list of actions that are not permitted:

...

Uploading, posting or otherwise transmitting any content that infringes any patent,
trademark, trade secret, copyright or other proprietary rights of any party;

Uploading, posting or otherwise transmitting any content that contains software
viruses or any other computer code, files or programs designed to interrupt,
destroy or limit the functionality of any computer software or hardware or
telecommunications equipment such as “trojan horses,” or engaging in
activities that result in illegal access to other computers or networks,
including those of Moniker;

...

Promoting or providing instructional information about illegal activities,
promoting physical harm against any group or individual, or promoting any act
of cruelty to animals.

```

Moniker reserves the right to take remedial action:

```
We reserve the right to cancel or terminate your use of the Services if you
engage in any of the activities described in this Section 14 or if your use
of the Services results in, or is the subject of, legal action or threatened
legal action against Moniker or any of its affiliates or partners, regardless
of whether such legal action or threatened legal action is determined to be
with or without merit.

```

## Actual Behavior

In 2006 Moniker was number 2 on the list of registrars with the most blacklisted domains, with 1426 listed domains, and 1521 active (93.75%) at that time. This demonstrated slow reactions in removing known spam or fraud domains. In October 2013, the figures were 139 listed domains out of 248 active (56.05% blacklisted)

Until December 2006, Moniker responded to complaints by removing the entry given sufficient comprehensive evidence but only after many repeated requests.

Actions in 2007 were minimal. One could conclude that either Moniker is not competent at making suspensions, or there is no desire to dissociate the company from criminals.

The abuse department fails to understand the basic concepts of how criminals operate. When asked to terminate his company's contracts with criminals by suspending the name servers registered with the company, the usual reply is

```
Moniker has nothing to do with these . . . You need to contact the host.

```

```
Not valid.  Moniker is not the owner, registrant, or host of these domains.

```

```
Please be aware that this domain name is registered by a customer of Moniker Online
Services.  Moniker.com is not the owner or the host of this domain.
If you believe the registrant has violated your rights with this registration,
you need to obtain an appropriate finding by a court of competent jurisdiction
or file a UDRP complaint against the registrant.

```

There is no suggestion that Moniker **is** the owner, registrant, or host. What is obvious, is that Moniker is the registrar providing a safe haven for criminalsif they refuse to terminate contracts which violate their own terms of service.

# Description of the Registrar

KeyDrive S.A. is an internet solutions holding company located in Luxembourg. Its subsidiaries offer different internet related services. Among the core business areas are domain registration, monetization and aftermarket services. The holding company includes the Key-Systems group (St. Ingbert, Germany), the NameDrive group (Wasserbillig, Luxembourg) as well as **Moniker** and SnapNames (Florida and Oregon/USA) with more than 160 employees. With the takeover of Moniker in January 2012 KeyDrive has more than 6 million domains under management. Chairman of the KeyDrive S.A. is Alexander Siffrin, CEO and founder of Key-Systems™.

Moniker.com® and SnapNames.com® work together to streamline domain name management:

Moniker is a full-service, ICANN-accredited domain registrar, premium brokerage, escrow and live auction house.

SnapNames is a dynamic, open domain names marketplace.

Both are part of the KeyDrive family of companies.

Reference: http://domainnamewire.com/2012/02/01/keydrive-acquires-moniker-and-snapnames/

*Feb 2012*

"Oversee.net sells off domain marketplace, expiring domain, and registrar companies."

"KeyDrive, which owns domain name registrar Key-Systems as well as NameDrive, has acquired SnapNames and Moniker from Oversee.net."

# Active blacklisted mail domains in last 5 days with Moniker nameservers

Source: URIBL

Moniker Online Services list

# Sample illegal domains

These domains listed below are all part of the pharmacy fraud network centered in Russia, known as EvaPharmacy. Some were live at
December 14, 2014.

**Click on any heading to see the evidence relating to each fraud.**

## Canadian Health&Care Mall

```
bestcanadianrxworldwide.com (transferred to WEB4AFRICA)
canadianhealthmallrx.com (suspended)

```

## Canadian Health&Care Mall

```
canadian-rx-worldwide.com (suspended)

```

## My Canadian Pharmacy

```
snekrosjy.com (suspended)
stukzixrug.com (suspended)
vnuydoymyv.com (suspended)

```

# Common IP addresses

A quick way to verify these sites is to examine the hosting addresses. Note that \* items have been removed.
Many compromised hosts used for this operation during September 2020 - May 2021 were located at these IPs.

Where to contact the compromised hosting ISP:

```
Abuse contact for '5.2.88.0 - 5.2.89.255' is 'alvaro.montero@ipcore.com'
Abuse contact for '5.45.80.0 - 5.45.83.255' is 'abuse@ispiria.net'
Abuse contact for '5.101.140.64 - 5.101.140.95' is 'abuse@ukservers.com'
Abuse contact for '5.181.158.0 - 5.181.158.255' is 'abuse@mivocloud.com'
Abuse contact for '5.133.8.0 - 5.133.15.255' is 'abuse@artnet.pl'
Abuse contact for '5.187.48.0 - 5.187.55.255' is 'abuse@artnet.pl'
Abuse contact for '5.188.211.0 - 5.188.211.255' is 'abuse@pindc.ru'
Abuse contact for '5.253.60.0 - 5.253.63.255' is 'abuseto@adminvps.ru' (Removed)
Abuse contact for '27.124.80.0 - 27.124.95.255' is 'abuse@medialink.net.id'
Abuse contact for '31.200.247.0 - 31.200.247.255' is 'ripe@unelink.com'
Abuse contact for '37.46.132.0 - 37.46.135.255' is 'abuse@abusehost.ru'
Abuse contact for '45.67.116.0 - 45.67.116.255' is 'abuse@itns.md'
Abuse contact for '45.86.163.0 - 45.86.163.255' is 'support@crowncloud.net'
Abuse contact for '45.125.65.0 - 45.125.65.255' is 'abuse@tele-asia.net'
Abuse contact for '45.131.83.0 - 45.131.83.255' is 'abuse@sered.net'
Abuse contact for '51.89.148.0 - 51.89.151.255' is 'abuse@ovh.net'
Abuse contact for '79.172.193.0 - 79.172.193.255' is 'abuse@deninet.hu' (Removed)
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '82.199.104.0 - 82.199.107.254' is 'abuse@seven-sky.net'
Abuse contact for '84.15.136.0 - 84.15.143.255' is 'abuse@bi.lt'
Abuse contact for '84.200.77.0 - 84.200.77.255' is 'abuse@accelerated.de' (Removed)
Abuse contact for '85.254.72.0 - 85.254.72.255' is 'support@serveria.com'
Abuse contact for '87.120.253.0 - 87.120.253.255' is 'abuse@neterra.net'
Abuse contact for '89.105.192.0 - 89.105.223.255' is 'abusedesk@novoserve.com'
Abuse contact for '89.222.128.0 - 89.222.131.255' is 'abuse@netorn.net' 'abuse@netorn.ru'
Abuse contact for '80.233.134.0 - 80.233.134.255' is 'abuse@telia.lv'
Abuse contact for '93.119.104.0 - 93.119.105.255' is 'abuse@virtono.com'
Abuse contact for '94.152.0.0 - 94.152.255.255' is 'abuse@kei.pl'
Abuse contact for '94.156.175.0 - 94.156.175.255' is 'abuse@iws.co'
Abuse contact for '95.24.0.0 - 95.31.255.255' is 'abuse-b2b@beeline.ru'
Abuse contact for '95.84.128.0 - 95.84.159.255' is 'abuse@rt.ru'
Abuse contact for '95.165.128.0 - 95.165.255.255' is 'abuse@spd-mgts.ru'
Abuse contact for '103.6.204.0 - 103.6.207.255' is 'yogie@redwhite.co.id'
Abuse contact for '103.9.156.0 - 103.9.159.255' is 'cuong.trinh@vnso.vn'
Abuse contact for '103.28.148.0 - 103.28.149.255' is 'support@easyway.co.id'
Abuse contact for '103.56.148.0 - 103.56.149.255' is 'abuse@jagoanhosting.com'
Abuse contact for '103.86.48.0 - 103.86.48.255' is 'abuse@bangmodhosting.com'
Abuse contact for '103.92.24.0 - 103.92.27.255' is 'hm-changed@vnnic.vn' 'system@tlsoft.vn'
Abuse contact for '103.117.141.0 - 103.117.141.255' is 'abuse@casbay.com'
Abuse contact for '103.121.88.0 - 103.121.91.255' is 'tampd@bkns.vn'
Abuse contact for '103.126.6.0 - 103.126.7.255' is 'shazim@serverstack.in'
Abuse contact for '103.138.96.0 - 103.138.96.255' is 'hello@hostitsmart.in'
Abuse contact for '103.146.22.0 - 103.146.23.255' is 'duc@lanit.com.vn'
Abuse contact for '103.147.152.0 - 103.147.153.255' is 'abuse@shineservers.com'
Abuse contact for '103.221.220.0 - 103.221.223.255' is 'hoanglong@azdigi.com'
Abuse contact for '103.236.201.0 - 103.236.201.255' is 'admin@idcloudhost.com'
Abuse contact for '111.90.128.0 - 111.90.159.255' is 'abuse@shinjiru.com.my'
Abuse contact for '112.78.0.0 - 112.78.15.255' is 'vanht@ods.vn'
Abuse contact for '130.185.72.0 - 130.185.72.255' is 'report@parspack.com'
Abuse contact for '119.59.96.0 - 119.59.127.255' is 'abuse@metrabyte.cloud'
Abuse contact for '141.98.10.0 - 141.98.10.255' is 'admin@serveroffer.lt'
Abuse contact for '146.247.49.0 - 146.247.49.255' is 'abuse@netcetera.co.uk'
Abuse contact for '159.148.186.0 - 159.148.186.255' is 'support@serveria.com'
Abuse contact for '159.148.0.0 - 159.148.255.255' is 'abuse@latnet.eu'
Abuse contact for '171.224.0.0 - 171.255.255.255' is 'hm-changed@vnnic.vn' 'soc@viettel.com.vn'
Abuse contact for '176.123.0.0 - 176.123.11.255' is 'abuse@alexhost.com'
Abuse contact for '178.239.176.0 - 178.239.177.255' is 'abuse@irideos.it'
Abuse contact for '178.255.40.232 - 178.255.40.235' is 'abuse@artnet.pl'
Abuse contact for '179.43.149.0/26' is 'support@privatelayer.com'
Abuse contact for '180.131.144.0 - 180.131.147.255' is 'abuse@nawala.org'
Abuse contact for '185.24.232.0 - 185.24.232.255' is 'abuse@servebyte.com'
Abuse contact for '185.128.40.0 - 185.128.43.255' is 'abuse@rackend.net'
Abuse contact for '185.130.206.0 - 185.130.207.255' is 'abuse@as61317.net'
Abuse contact for '185.140.248.0 - 185.140.249.255' is 'contact@buzinessware.com'
Abuse contact for '185.183.104.0 - 185.183.104.255' is 'abuse@m247.ro'
Abuse contact for '194.5.176.0 - 194.5.179.255' is 'berbid238@gmail.com'
Abuse contact for '200.55.243.166'  is 'radhios*@*gmail.com' syt.com web page
Abuse contact for '202.145.0.0 - 202.145.3.255' is 'abuse@uninet.net.id'
Abuse contact for '209.127.0.0 - 209.127.138.255' is 'abuse@servermania.com'

```

Example of the highest used IP addresses from November 2020

# Where to send abuse complaints

```
http://www.moniker.com

   Michele Van Tilborg Tel: 310-467-2549
   Email: registry-operations*@*moniker.com

```

# Additional Contact Information

```
support*@*moniker.com
legal*@*moniker.com

```

## Postal address

```
Moniker Online Services, LLC
1800 SW 1st Avenue
Suite 440
Portland, OR 97201

```

## Telephone and FAX

```
Toll-free in the U.S. and Canada: 1-800-688-6311
Outside the U.S. and Canada: 1-954-607-1294

```

# Sources for this article

## Independent

http://rss.uribl.com/nic

http://rss.uribl.com/nic/MONIKER\_ONLINE\_SERVICES\_INC\_.html

http://www.spamhaus.org/rokso/evidence.lasso?rokso\_id=ROK7168

http://www.icann.org/registrars/accreditation-qualified-list.html

## Corporate

http://moniker.com

http://seevast.com

http://www.moniker.com/help/dtc.jsp