The Nick Fedorov, and Vasiliy Pupkin Gang
“Part 1, Connecting the dots.
“How their aliases and email addresses in their whois records, help to link them all together”
Webhelper
April 25, 2006
The emails and sites of the Nick Fedorov aka Vasily Pupkin
5 December 2003 Two sites
school-fuck.com Mikka Telio darkgt @ mail.ru
virgins-fuck.com Sara Bralen darkgt @ mail.ru
This is the first known sites to use the web based email of darkgt.
25-Mar-2004 greatsearch.biz Nick Fedorov bugaboo @ rambler.ru
16-Apr-2004 Thumbstower.com
Vasiliy Pupklindtovich Pizdataya Compania justgoldfinger @ yahoo.co.uk
Pupklindtovich is also the same as the alias of Vasiliy Pupkin.
14-Nov-2004 iframedollars.biz Nick Fedorov bugaboo @ rambler.ru
31-Jan-2005 bestcounter.biz Fedorov Nick bugaboo @ rambler.ru
25-May-2005 iframedollars.biz Pupkin Vasiliy bugaboo @ rambler.ru
4-Jun-2005 bestcounter.biz Pupkin Vasiliy bugaboo @ rambler.ru
In May 2005, the whois records change from Nick Fedorov to Vasiliy Pupkin for both iframedollars.biz and bestcounter.biz, however the web based email of bugaboo @ rambler.ru remains the same for both records. This is one of the first links between Nick Fedorov being also Vasiliy Pupkin.
20-Oct-2005 buytraff.biz Ezhi Brozkevitsh darkgt @ mail.ru
Now in 2005, Ezhi Brozkevitsh is the third alias since 2003 now using the darkgt @ mail.ru email address that in the whois record for buytraff.biz.
19-Dec-2005 newtoolbar.biz Ezhi Brozkevitsh
admin @ buytraff.biz
30-Dec-2005 toolbarbest.biz
Alexander Pushkin admin @ newtoolbar.biz
Now on 19 December 2005 newtoolbar.biz appears with Ezhi Brozkevitsh listed as the owner and then on 30 December 2005 a new series of sites appeared under the name of Alexander Puskin admin @ newtoolbar.biz. That means that the new set of sites that replaced those under Ezhi Brozkevitsh by those listed under Alexander Puskin makes these two aliases belong to the same group and especially with Ezhi Brozkevitsh shown using the darkgt @ mail.ru address that was the first in 2003.
5-Feb-2006 toolbarweb.biz Alexander Pushkin
admin @ newtoolbar.biz
18 January 2006 iframedollars.biz Ezhi Brozkevitsh
webmaster @ iframedollars.biz
On January 18, iframdollars.biz is changed to Ezhi Brozkevitsh from that of Vasiliy Pupkin along with a new email address of webmaster @ iframdollars.bizand bestcounter.biz Pupkin Vasiliy still under Vasiliy Pupkin but with admin @ iframdollars.biz which replaces bugaboo @ rambler ru. Now we have the link to iframedollars.biz and bescounter.biz to vasiliy Pupkin and Ezhi Brozkovitsh along with Alexander Puskin linked to Ezhi Brozkevitsh with newtoolbar.biz.
1-Feb-2006 wwise.biz jason coffman
darkgt @ mail.ru
Feb 2006, shows that Jason Coffman also was using the darkgt @ mail.ru email in the whois records.
9-Feb-2006 traffweb.biz jason coffman admin @ toolbarbest.biz
In February 2006, another set of sites appear with a Jason Coffman with admin @ toolbarbest.biz which is listed under Alexander Puskin, which now links the Jason Coffman sites to those of all the rest above which means they all belong to the same group.
11-Mar-2006 extrememoney.biz Henry Nery
darkgt @ mail.ru
When the 1-extreme.biz through 8-extreme.biz came online from the same IP address was also extrememoney.biz and it shows yet another alias of Henry Nery and also using the darkgt @ mail.ru email in the whois records.
12-Mar-2006 8-extreme.biz Gaylen Goldston
admin @ toolbarweb.biz
On march 2006, yet another set of sites were made active, and the 8-extreme.biz was the only one with the email of admin @ toolbarweb.biz which toolbarweb.biz is listed under Alexander Puskin.
29-Mar-2006 vipiframe.biz Thomas Elliott darkgt @ mail.ru
On Mar 2006 another name, Thomas appears using the darkgt @ mail.ru which shows that this site and those under the name of Thomas Elliot are also a part of the same Group;
Finally, as of April 2006, the last known set of sites vip01.biz to vip15.biz along with vip-iframe.biz all using the admin @ vip-iframe.biz for their whois emails, is the only set that do not have an email address linked to one of the older sites, however, the files used are the same ones from both the traffweb.biz and 8-extremeb.biz sites and is called with the others during current infestations.