# whois.verisign-grs.com

   Domain Name: GOODBYEDPI.COM
   Registry Domain ID: 2862082443_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.ccdomain.co.kr
   Registrar URL: http://www.cosmotown.com
   Updated Date: 2024-05-05T08:27:28Z
   Creation Date: 2024-03-08T20:06:19Z
   Registry Expiry Date: 2025-03-08T20:06:19Z
   Registrar: Cosmotown, Inc.
   Registrar IANA ID: 1509
   Registrar Abuse Contact Email:
   Registrar Abuse Contact Phone:
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Name Server: MERLIN.NS.CLOUDFLARE.COM
   Name Server: VAL.NS.CLOUDFLARE.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2024-06-14T17:45:32Z <<<

Apparently a fake and phishing site, am I wrong?

That was a strange auto-generated website, which served source code instead of binaries.
It has been disabled by the hosting company upon our request.

It’s active again.

Yeah it got back. Email does not work. If anyone have any idea who and why, let me know.

пожаловался сюда Abuse form | Cloudflare | The web performance & security company

I will fill a compliant to the registrar.

# whois.cosmotown.com

Domain Name: goodbyedpi.com
Registry Domain ID: 2862082443_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.cosmotown.com
Registrar URL: http://www.cosmotown.com
Updated Date: 2024-05-05T08:27:28Z
Creation Date: 2024-03-08T20:06:19Z
Registrar Registration Expiration Date: 2025-03-08T20:06:19Z
Registrar: COSMOTOWN, INC.
Registrar IANA ID: 1509
Registrar Abuse Contact Email: abuse@cosmotown.com
Registrar Abuse Contact Phone: +1.6504739500
Domain Status: clientTransferProhibited http://icann.org/epp#clientTransferProhibited
Domain Status: clientDeleteProhibited http://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited http://icann.org/epp#clientRenewProhibited
Domain Status: clientUpdateProhibited http://icann.org/epp#clientUpdateProhibited
Registrant Organization: 
Registrant State/Province: ca
Registrant Country: US
Registrant Email: privacy@cosmotown.com
Admin Email: privacy@cosmotown.com
Tech Email: privacy@cosmotown.com
Name Server: merlin.ns.cloudflare.com
Name Server: val.ns.cloudflare.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2024-05-05T08:27:28Z <<<

+online
DMCA protected, lol

https://goodbyedpi.online/

Just reported it as fraud to domain registry.

Btw, JS payload which is being executed during “DDOS protection” step looks quite suspicious.

Hostinger (the registrar of goodbyedpi.online) domain answered with the following:

Hello,
Thank you for your report.
Listed abusive account(s) has been suspended.

With that said, domain is still delegated and active, so I assume that they’ve just blocked the guy’s account. I’ve asked them point blank whether they will terminate the delegation.

The TLD owners’ abuse dept is dead silent.

@ValdikSS goodbyedpi.online has been suspended:

Hello,

Thank you for your report.
The reported domain name(s) has been suspended.
Regards, Hostinger Abuse Department
abuse@hostinger.com
https://www.hostinger.com

It checks out: currently it resolves to nothing and has blocking statuses listed in its whois record.

Cool, thx