Evidence of Chris Gotzmann -- Spammer

Notes on my research into a spamming operation and it's subsequent linking to Chris Gotzmann.

TLDR; Chris Gotzmann is a principal figure in a shady company called Quadranet, apparently involved in spam and other blackhat practices.  Some other people have also posted on this company, this person, and his associates.

• ripoffreport.com/r/wwwQuadranetcom/los-angeles-California-90014/wwwQuadranetcom-OC3Networks-PacificRack-4FiberTech-WebZooLoo-and-Quadranet-Quadranet-715701

As for me, I am a web developer. I have an email link on one of my sites, which allows my users to email questions directly to me. Recently, I was hit by a flurry of spam posts from my own site. Somebody was attempting to use the email form on my site, for spam.

The sites promoted in the spams included

• provacyli.com posted from ip: 96.47.224.42
• raspberryketonepledge.ca posted from ip: 96.47.225.66
• aproshaperx.com posted from ip: 96.47.224.58
• mirovervee.com posted from  ip: 96.47.224.58
• www.dapoxetinezine.com posted from ip: 96.47.224.58
• nexuspheromonesi.com posted from ip: 96.47.225.186
• eperformer5.com posted from ip: 96.47.225.186
• icapsiplex.com posted from ip: 96.47.225.186
• www.cfvegfest.org posted from ip: 173.44.37.234
• www.helenday.com posted from ip: 173.44.37.234
• www.cfvegfest.org posted from ip: 96.47.224.50
• www.cialisonlinedeals2013.com posted from ip: 96.47.224.50
• healthyconsumeralert.co.uk posted from ip: 173.44.37.226
• www.migrainezine.com posted from ip: 173.44.37.242
• www.bullruninn.com posted from ip: 96.47.225.82
• virilitypillsi.com posted from ip: 96.47.225.66
• www.bullruninn.com posted from ip: 96.47.225.74
• volumepillstreatment.com posted from ip: 96.47.225.170

etc etc. There were more.

So, what do we notice about all the IP addresses where the spam originated? They are all from IPTelligent LLC. Apparently, IPTelligent LLC is a spam company. Let's see something about them.


whois iptelligent.com

Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to internic.net
for detailed information.

Domain Name: IPTELLIGENT.COM
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: registrar.godaddy.com
Name Server: NS1.QUADRANET.COM
Name Server: NS2.QUADRANET.COM
Status: clientDeleteProhibited
Status: clientRenewProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 12-jun-2013
Creation Date: 06-jun-2008
Expiration Date: 06-jun-2014

>>> Last update of whois database: Mon, 24 Jun 2013 12:48:31 UTC <<<Registered through: GoDaddy.com, LLC (godaddy.com)
Domain Name: IPTELLIGENT.COM
Created on: 06-Jun-08
Expires on: 06-Jun-14
Last Updated on: 12-Jun-13

Registrant:
IPTelligent LLC
199 E Flagler St #351
Miami, Florida 33131
United States

Administrative Contact:
Admin, Domain management@miaminoc.com
The Miami NOC LLC
199 E Flagler St #351
Miami, Florida 33131
United States
+1.9492816050

Technical Contact:
Admin, Domain management@miaminoc.com
The Miami NOC LLC
199 E Flagler St #351
Miami, Florida 33131
United States
+1.9492816050

Domain servers in listed order:

NS1.QUADRANET.COM
NS2.QUADRANET.COM


Hmmm, that's interesting. Let's dig deeper.


whois miaminoc.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: MIAMINOC.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1.QUADRANET.COM
Name Server: NS2.QUADRANET.COM
Status: clientTransferProhibited
Updated Date: 29-sep-2012
Creation Date: 29-oct-2010
Expiration Date: 29-oct-2013


>>> Last update of whois database: Mon, 24 Jun 2013 12:52:18 UTC <<<Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: namecheap.com
Registered through: eNom, Inc.

Domain name: miaminoc.com

Registrant Contact:

Chris Gotzmann ()Fax:
411 Walnut St Ste 7516
Green Cove Springs, State 32043
US

Administrative Contact:Chris Gotzmann (salesfreak@gmail.com)
+1.8182634484
Fax: +1.5555555555
411 Walnut St Ste 7516
Green Cove Springs, State 32043
US

Technical Contact:Chris Gotzmann (salesfreak@gmail.com)
+1.8182634484
Fax: +1.5555555555
411 Walnut St Ste 7516
Green Cove Springs, State 32043
US

Status: Locked

Name Servers:
ns1.quadranet.com
ns2.quadranet.comCreation date: 30 Oct 2010 03:46:00
Expiration date: 30 Oct 2013 02:46:26

Ahh, a name and an email address and note the identical name server for both companies.

Who is this Chris Gotzmann with email salesfreak@gmail.com?
search?q=salesfreak%40gmail.com 

Looks like he likes BMW's and goes by DreddM3 on BMW forums and by his profile, he once lived in "The Woodlands, TX".

OK, let's do this. Let's look up "Chris Gotzmann" and "The Woodlands"

search?q="Chris+Gotzmann"+"The+Woodlands"

Here we go. An Ars Technica article about a scammer named James McCreary from "The Woodlands, TX", who happens to work with a guy named Chris Gotzmann

So, it seems this James McCreary guy got in trouble for a company called AlphaRed.



OK, so we're almost done here. We know that Quadranet.com is the name server for both iptelligent.com and Chris Gotzmann's miaminoc.com. What other link do we find between Chris Gotzmann and Quadranet?



How about this linked in profile?

OK, so we see that Chris Gotzmann is a principal figure atQuadranet, and by the way, also used to be at AlphaRed, as thescam company we learned about from the Ars Technica article 

So this was my morning. Going from wondering who the hell was spamming my servers, to learning about this little parasite piece of s**t named Chris Gotzmann. 

Chris Gotzmann and Quadranetgang...Get the F off my servers.