Publicdomainregistry.com – A safe haven for spammers and phishers like Ruby Palace

Do you know the US company “Public Domain Registry” from Beaverton/Oregon?

You should – it’s a company working together with the internet mob!

But perhaps you heard of “Ruby Palace”, the famous gambling spammer that is terrorizing your email account with its shit? Ruby is setting up domains all the time – interestingly and exclusively through the registrar “Public Domain Registry Ltd.”.

Image

Ruby Palace a criminal organization and a pain in your ass

You get Ruby’s spam all the time and when you complain about being spammed their registrar PDR Ltd. is naturally shutting down the advertised site – and at the same moment Ruby has set up a new site and informs you in its next spam email. Again through “publicdomainregistry.com”.

Image

“Public Domain Registry” Ltd. loves to to business with the internet mob.

“Public Domain Registry” is a registrar to ICANN and sells also Australian .au domains. Since there are no anti-spam laws in India (That country which avoids protecting women and lets rape them by groups of men.) this company leaves the work to an Indian firm named “Directiplex” so it is free to make business with criminals – for example with the gambling mob like “Ruby Palace”.

And Ruby tries to get you to their site(s) through their spam and offers you some free software and even $200 so that you can gamble with them. Of course, you never win (but lose a lot of money) but in return you got some nice gambling-software from unknown sources. On your own PC. And of course you don’t know what this software does to your operating system without your knowledge. Ever heard of “malware”, “trojan horses” and “phishing”?

PDR is closely connected with the gambling and phishing mob of the internet:

It is absolutely not accidental that the spam and phishing group “Ruby Palace” has registered ALL their spam domains thru publicdomainregistry.com.

Usually criminals use stolen credit cards to set up internet domains so that the registrar not only deletes those domains but also keeps an eye on those criminals – of course, otherwise they lose money.

But PDR obviously is still the preferred registrar for Ruby’s fucking spam and phishing Palace. How come?

Well, maybe because they don’t use stolen credit cards but real ones?

12 thoughts on “Publicdomainregistry.com – A safe haven for spammers and phishers like Ruby Palace

  1. I created a new email solely to play lotto ( http://www.nswlotteries.com.au/)
    and paid money to become a member. I never used that email for any other site. Only to log on to nswlotteries. After that this email started receiving many spam mail like Ruby Palace and more. 5 years ago and its still getting scam gambling emails. I am sicken by nswlotteries who now go by tatts.com.

  2. I have been reporting SPAM by domains “protected” by Public Domain Registry for several years. They simply do not take action and give me the run-around at every instance.
    Does anyone have any advice on how to effectively fight this company that is a haven for Spammers??

    • Sites like PayPal and NSWLotteries are not compromised. It is simply the SPAMmers sending to all possible email addresses from the well know domains (gmail, yahoo). Perhaps it is the gmail/yahoo/etc. that allow your email address to be leaked. In future, maybe try creating an email address with some obscure company, then retrieve the email from that site using POP3, etc., thus filtering spam in two places.

  3. I’ve stumbled upon PDR while whois-ing msigyn262.org, the newest origin of gambling scam in my inbox.

    I was on PDRs complaint form, where they said they need full email headers and body in order to be able to do anything. That is reasonable, but it’s also dangerous, because these contain a lot of information that identifies me. If they show that to the spammer when explaining why they shut down his site, my email account is doomed.

    So I whois-ed publicdomainregistry.com (on whois.net), which led to a whois query to PDR itself, which didn’t yield any results (request timeout, repeatedly). That’s why I googled them and landed here. Obviously, I won’t fill in their form anymore 😉

    To Peter:

    We’d have to get their status as registrars revoked.
    I went to the ICANN site, trying to find a form or email address to report PDR. They have many forms, none of which seemed to fit. Sadly, it looks like registrars of .org domains need not comply with ICANN’s code of conduct. ICANN doesn’t deal with Spam/Phishing/Malware complaints – they recommend to complain with the registrar 😦

    Maybe we should simply go to the police. For this to have any effect, we need to be able to prove that PDR lets the same people (whose domain they closed upon a complaint) register new ones. Unless the spammers are extremely stupid and actually reuse the same identities to register new domains, there’s no hope for that.
    If you still have that spam you complained about and still have all the communication with PDR and therefore can prove that they systematically ignore spam complaints, and if that spam clearly is spam (as opposed to semi-legit advertising), that may be enough to try the police route.

    To Andy and Dve Woods:

    It’s natural to suspect the places where you left your email address of passing it on. However, it’s probably NOT the case (certainly not paypal). The spammers probably just brute-forced your address, ie. tried a bunch of names @ the site hosting your email. Also possible is that they hacked into those sites and extacted your email addresses from there (all major sites get attacked all the time).

    This is a habit of spammers. They send to many, many names on your server. Using just a few lines of code and a word list, they can easily try millions of names every day.
    When the mail is not returned as undeliverable, they know that the address actually exists. They then send spam forever, hoping that one day you will click something in or reply to one of the messages, at which point they know that the address actually gets read, and things get even worse (they can now sell that active address to other spammers).

    I once set up my own mail server at home, on a domain I had registered. I hadn’t used my new email addresses anywhere, but spam started to come in (and worse, I misconfigured the server, so for a few days, they relayed spam through my server, and my domain landed on a blacklist). They just somehow noticed or got notified that there is a new site and tried if there’s an SMTP server listening.

    Did you guys know that the majority of email traffic worldwide is spam?

  4. I wonder how hard it would be just to block every domain registered with them?

    @Franziskus – just opening port 25 is enough to let people know you’re running a mailserver. You’ve clearly been port-scanned, and they’ve tried a test mail to see what info the banner contains.

    If you use a telnet client (I recommend puTTY) to connect to port 25 on your own IP address, you can see what information is given out. This often includes your domain.

  5. i had a domains and lost it, when hacker stolen my domain and send it to publicdomainregistry (gaining registrar), i contact them many times, but the response is so slow and wants namecheap to contacting them directly, also namecheap (losing registrar) doesn’t really help me becoz they are slow in replying also i don’t know its looks like for them to helping me, i’m really confuse and stressed out becoz ICANN, NAMECHEAP, AND PUBLICDOMAIN REGISTRY JUST LIKE …i am loyal to namecheap for several years and recomend them to many people! The only thing they did for me was keep telling me: Unfortunately, there is nothing we can do. I think this should be their slogan: “There is nothing we can do. Crazy huh?

    I kept feeling frustrated and began to accept the possibility that I might never get it back. I put so much of effort and money into this website. It’s like a part of me. It’s pain to think losing it.

  6. This motherfuckers “Pulicdoainregistry” should be hit right between the eyes. Just criminals. Just shit under your shoe.

  7. As I found this article while searching about this mysterious legalese-looking e-mail from a company I’ve never heard of before telling me that I was now bound by their “agreement” (when the f*** did I ever agree to that?) and looked up their whois as well, I realize that they have updated their whois records since the time this article was written. They are no longer listed to be in “Beaverton, Oregon”, but in Burlington, Massachussetts. Here’s the new info I pulled this morning, so that this information is also available to future readers and to the author (which I’d also like to thank for writing this article in the first place) :

    Domain Information
    Domain:
    publicdomainregistry.com
    Registrar:
    PDR Ltd. d/b/a PublicDomainRegistry.com
    Registered On:
    2003-12-28
    Expires On:
    2019-12-28
    Updated On:
    2018-08-28
    Status:
    clientTransferProhibited
    Name Servers:
    andy.ns.cloudflare.com
    dora.ns.cloudflare.com
    Registrant Contact
    Name:
    Domain Manager
    Organization:
    P.D.R. Solutions (U.S.) LLC
    Street:
    10 Corporate Drive
    City:
    Burlington
    State:
    Massachusetts
    Postal Code:
    01803
    Country:
    US
    Phone:
    +91.2267209000
    Email:
    email@endurance.com

    • Interestingly I just found this thread following an issue with fake domains hosted by PDR. I was able to get one fake domain disabled but can see the same registrant still has in excess of 100 fake domains, ie those that look like real ones but with typos in them. The fake domains, when combined with email hacks, enable fraud on a large scale. Now I’m thinking I wasted my time in reporting the abuse!

Leave a comment