Goodbyedpi.com who?

Community software GoodbyeDPI
1 
# whois.verisign-grs.com

   Domain Name: GOODBYEDPI.COM
   Registry Domain ID: 2862082443_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.ccdomain.co.kr
   Registrar URL: http://www.cosmotown.com
   Updated Date: 2024-05-05T08:27:28Z
   Creation Date: 2024-03-08T20:06:19Z
   Registry Expiry Date: 2025-03-08T20:06:19Z
   Registrar: Cosmotown, Inc.
   Registrar IANA ID: 1509
   Registrar Abuse Contact Email:
   Registrar Abuse Contact Phone:
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Name Server: MERLIN.NS.CLOUDFLARE.COM
   Name Server: VAL.NS.CLOUDFLARE.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2024-06-14T17:45:32Z <<<

Apparently a fake and phishing site, am I wrong?

2

That was a strange auto-generated website, which served source code instead of binaries.
It has been disabled by the hosting company upon our request.

3

It’s active again.

4

Yeah it got back. Email does not work. If anyone have any idea who and why, let me know.

5

пожаловался сюда Abuse form | Cloudflare | The web performance & security company

6

I will fill a compliant to the registrar.

# whois.cosmotown.com

Domain Name: goodbyedpi.com
Registry Domain ID: 2862082443_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.cosmotown.com
Registrar URL: http://www.cosmotown.com
Updated Date: 2024-05-05T08:27:28Z
Creation Date: 2024-03-08T20:06:19Z
Registrar Registration Expiration Date: 2025-03-08T20:06:19Z
Registrar: COSMOTOWN, INC.
Registrar IANA ID: 1509
Registrar Abuse Contact Email: abuse@cosmotown.com
Registrar Abuse Contact Phone: +1.6504739500
Domain Status: clientTransferProhibited http://icann.org/epp#clientTransferProhibited
Domain Status: clientDeleteProhibited http://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited http://icann.org/epp#clientRenewProhibited
Domain Status: clientUpdateProhibited http://icann.org/epp#clientUpdateProhibited
Registrant Organization: 
Registrant State/Province: ca
Registrant Country: US
Registrant Email: privacy@cosmotown.com
Admin Email: privacy@cosmotown.com
Tech Email: privacy@cosmotown.com
Name Server: merlin.ns.cloudflare.com
Name Server: val.ns.cloudflare.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2024-05-05T08:27:28Z <<<
7

+online
DMCA protected, lol

https://goodbyedpi.online/

8

Just reported it as fraud to domain registry.

Btw, JS payload which is being executed during “DDOS protection” step looks quite suspicious.

9

Hostinger (the registrar of goodbyedpi.online) domain answered with the following:

Hello,
Thank you for your report.
Listed abusive account(s) has been suspended.

With that said, domain is still delegated and active, so I assume that they’ve just blocked the guy’s account. I’ve asked them point blank whether they will terminate the delegation.

The TLD owners’ abuse dept is dead silent.

10

@ValdikSS goodbyedpi.online has been suspended:

Hello,

Thank you for your report.
The reported domain name(s) has been suspended.
Regards, Hostinger Abuse Department
abuse@hostinger.com
https://www.hostinger.com

It checks out: currently it resolves to nothing and has blocking statuses listed in its whois record.

11

Cool, thx