encyclopediadramatica.se is down

The domain has been suspended by the registrar.

/home/brian# whois encyclopediadramatica.se

state: active
domain: encyclopediadramatica.se
holder: bribri1816-00001
admin-c: -
tech-c: -
billing-c: -
created: 2012-03-21
modified: 2013-09-13
expires: 2014-03-21
transferred: 2013-01-04
nserver: rita.ns.cloudflare.com
nserver: jeff.ns.cloudflare.com
dnssec: unsigned delegation
status: clientHold
registrar: 101Domain, Inc.

If you query the whois web interface of The Internet Infrastructure Foundation in Sweden, you will be provided with the contact details of the domain's owner, Brian Zaiger.

Contact ID bribri1816-00001
Name Brian Zaiger
Organization Brian Zaiger
Organization number [US]S20268425
E-mail address brian.zaiger@gmail.com
Address row 1 6 Essex st, Apt 3
Address row 2 -
Address row 3 -
Zip code 01970
City Salem
Country US
Phone +1.8564921437
Fax -
Created 2013-01-04
Last updated -
Registrar 101Domain, Inc.

Ryan Cleary and Luzsec Members Sentenced

SOUTHWARK, LONDON — Four members of the LulzSec hacking group were on Thursday sentenced in court after pleading guilty to various computer hacking-related charges.


Lulzsec wannabe and founder of the current Encyclopedia Dramatica, Ryan Cleary, was sentenced to 32 months in prison by Presiding Judge Deborah Taylor and must serve at least half. Three others, Ryan Ackroyd, Jake Davis and Mustafa al-Bassam, were also sentenced.

Cleary has also plead guilty to downloading and possessing indecent images of children, some as young as six months. The sentencing for that crime has been delayed.

Andrew Auernheimer Given 41 Month Jail Term

Julio Cortez/AP
(apparently they don't make clothes to fit trolls)

AT&T hacker ‘Weev’ sentenced to over 3 years in jail for stealing more than 100,000 email addresses of iPad users

Andrew Auernheimer, formerly of Fayetteville, Ark., was tried in New Jersey. and calls himself an online ‘troll.’ He hacked into AT&T’s servers and stole the email addresses of Apple tablet users, in New York City Mayor Michael Bloomberg, then-White House chief of staff Rahm Emanuel, film mogul Harvey Weinstein and other celebrities. Auernheimer was defiant in court and called his sentencing shameful.

CloudFlare attracts "repeat infringers"

From our friends at cloudflare-watch, a large list of Cloudflare customers about whom Google has received more than 100 copyright removal requests for each.

Affordable and Effective Laser Tatoo Removal

Thanks Infinity Medspa of Santa Clarita!

Spamhaus is blocking CloudFlare's IP ranges

The majority of Cloudflare's 44,500 IP addresses are now in Spamhaus' block list because they are allowing abusers to hide behind their reverse proxy. This means if you have a domain that uses Cloudflare's services, email sent from that domain will be blocked by any upstream provider that subscribes to the block list.

For more on this, see cloudflare-watch.org.

The Romanian Connection

Encyclopedia Dramatica, along with remnants of LulzSec
and AnonOps, have moved to servers in Romania. 




Voxility provides wholesale bandwidth and rents servers to hosting providers and has datacenters in Frankfurt, Bucharest, Washington and Los Angeles. Many of ED's related domains are hosted by Voxility in Bucharest.

Address lookup for donate.encyclopediadramatica.se

canonical name


direct-connect.encyclopediadramatica.se.  Whoops,this no longer true. It changed after this post was first published.


addresses 37.221.160.140

Network Whois record

Queried whois.ripe.net with "-B 37.221.160.140"...
% Information related to '37.221.160.128 - 37.221.160.191'


inetnum: 37.221.160.128 - 37.221.160.191
netname: SrsVPS1
descr: SrsVPS
country: RO
admin-c: TE1649-RIPE
tech-c: TE1649-RIPE
status: ASSIGNED PA
mnt-by: VOXILITY-MNT
mnt-lower: VOXILITY-MNT
mnt-routes: VOXILITY-MNT
changed: noc@voxility.com 20120412
remarks: INFRA-AW
source: RIPE


person: Thomas Edge
address: 8971 Complex Drive
address: San Diego, CA 92123
phone: +978-587-1190
e-mail: thomas@srsvps.com
nic-hdl: TE1649-RIPE
mnt-by: VOXILITY-MNT
changed: noc@voxility.com 20120228
abuse-mailbox: abuse@srsvps.com
source: RIPE

The name and address in California aren't real. The phone number is Brian Zaiger's, though. Srsvps sells vps's and is advertised on ED.

37.221.160.140 and 37.221.160.138 deliver encyclopediadramatica.se wiki and forum pages.
37.221.160.139 is "the future home of Viral Security".
37.221.160.135 is a proxy, ro.myprivatevpn.be .


Another Romanian netblock controlled by ED's principals is:

Queried whois.ripe.net with "-B 109.163.233.1"...

% Information related to '109.163.233.0 - 109.163.233.63'

inetnum: 109.163.233.0 - 109.163.233.63
netname: SrsVPS1
descr: SrsVPS
country: RO
admin-c: TE1649-RIPE
tech-c: TE1649-RIPE
status: ASSIGNED PA
mnt-by: VOXILITY-MNT
mnt-routes: VOXILITY-MNT
mnt-lower: VOXILITY-MNT
changed: noc@voxility.com 20120217
remarks: INFRA-AW
source: RIPE


Some web sites on this netblock:
109.163.233.11 AnonNews, owned by Sven Slootweg
109.163.233.7 Anonleaks
109.163.233.26 Anonleaks
109.163.233.31 RogueSec
109.163.233.32 RogueSec
109.163.233.35 sexytiem.se
109.163.233.38 302 redirect to http://233.38/ (bogus IP address)
109.163.233.45 seductiondatabase.com
109.163.233.9 302 redirect to http://233.9/ (bogus IP address)


Non-Romanian netblocks here:

Queried whois.ripe.net with "-B 37.59.72.64"...

% Information related to '37.59.72.64 - 37.59.72.79'

inetnum: 37.59.72.64 - 37.59.72.79
netname: EDRAMA2
descr: EDrama Ltd
country: CH
org: ORG-OC30-RIPE
admin-c: OTC2-RIPE
tech-c: OTC2-RIPE
status: ASSIGNED PA
mnt-by: OVH-MNT
changed: noc@ovh.net 20120202
source: RIPE




37.59.72.67 www.anonnews.org tahoe-gateway.cryto.net direct-connect.anonnews.org
37.59.72.70 xvp.edrama.us
37.59.72.74 mail.edrama.us mail.encyclopediadramatica.se



Queried whois.ripe.net with "-B 37.59.72.96"...

% Information related to '37.59.72.96 - 37.59.72.111'

inetnum: 37.59.72.96 - 37.59.72.111
netname: EDRAMANET1
descr: EDrama Ltd
country: CH
org: ORG-OC30-RIPE
admin-c: OTC2-RIPE
tech-c: OTC2-RIPE
status: ASSIGNED PA
mnt-by: OVH-MNT
changed: noc@ovh.net 20120202
source: RIPE


37.59.72.101 srsvps.com ns1.srsvps.com
37.59.72.103 ns2.srsvps.com

Here is an incomplete history of of the reborn ED's hosting providers. 

April 15 2011
69.65.55.21

June 27 2011
web.encyclopediadramatica.ch: 216.14.104.1
sql.encyclopediadramatica.ch: 216.14.104.2

June 30 2011
direct.encyclopediadramatica.ch: 69.65.55.21

July 12 2011
184.164.147.135

July 22 2011
85.10.206.54

August 31 2011
94.23.168.77

September 14  2011
static.encyclopediadramatica.ch, images.encyclopediadramatica.ch: 85.10.206.54

September 19  2011
direct-connect.encyclopediadramatica.ch: 173.204.20.100


September 22  2011
direct-connect.encyclopediadramatica.ch, lb1.edrama.us: 31.22.165.46

September 23 2011
46.246.111.72

October 2 2011
213.155.18.13strike

Ryan Cleary indicted by U.S.

Cleary Indicted in U.S. for Hack Attacks

Ryan Cleary, a 20-year-old U.K. man and associate of the “LulzSec” hacking group, was indicted on charges of computer attacks on Sony Pictures Entertainment Inc., Fox Entertainment Group Inc. and other entities.

Cleary, incarcerated as he faces foreign prosecution in England, was indicted by a federal grand jury in Los Angeles on one count of conspiracy and two counts of impairing computers, Andre Birotte, U.S. Attorney in Los Angeles, said in an e-mail today.


The indictment is here, U.S. v. Cleary, 12-561.

From the indictment, this is interesting:

Overt Act No. 8: On or about June 9, 2011, defendant CLEARY provided
his co-conspirators, including members of LulzSec, access to computer
resources located at GigeNET, a data and server hosting company in Illinois, to facilitate communication between defendant CLEARY's
co-conspirators and to store and publish stolen data.

Who do we know that is a friend of Ryan's, and owns netblocks at GigeNET?

Four Accused LulzSec Hackers Appear In Court

Ryan Cleary, Ryan Ackroyd, Jake Davis and a 17-year-old male appeared in a British court May 11, and were told they have to return June 25 to enter pleas for indictments on various computer-related crimes.

Four of the eight counts listed in an updated British indictment Friday were levelled solely on Cleary, the founder of the current version of Encyclopedia Dramatica. He is accused of supplying a botnet — or a network of thousands of infected computers that can be used to paralyze websites — to others, and operating one himself to attack the website of DreamHost, a web hosting company. He is also accused of “installing and/or altering computer programs” on computers at the Pentagon controlled by the U.S. Air Force, between May 1 and June 22, 2011.

On May 2 2012, a US Federal indictment was made public outlining computer crime-related charges against alleged Lulzsec members Jeremy Hammond of the US, Donncha O'Cearrbhail and Darren Martyn of Ireland, and Jake Davis and Ryan Ackroyd of Britain. Of particular interest is the mention of an anonymous, unindicted co-conspirator on page 23. The indictment itself can be found at Cryptome.

In related news, MLT, an unnamed 17 year-old member of TeaMp0isoN from Newcastle was arrested by local police on May 9 on suspicion of offenses under the Computer Misuse Act.

The arrested teen was described by Scotland Yard as being the “spokesperson” of TeamPoison.

"He has been taken to a local police station for interview. Computer equipment has been seized and is undergoing a detailed forensic examination," the statement read.

If this paste is to be believed, MLT is a customer of srsvps, a business run by the principals behind encyclopediadramatica.se. The supposedly bullet proof, offshore srsvps is not much protection if one's computers, or the home computers of one's co-conspirators, are seized.

Gwapo, DDoS King and Satisfied Cloudflare Customer


From a news story by SC magazine.

A hacker is selling a reportedly booming distributed denial of service (DDoS) attack service and has taken to YouTube to pull new clients.

The service was first launched in January on Hack Forums and has so far recruited several large enterprises who have paid to have rival organisations attacked, the operator Gwapo told SC Magazine.



His own site, ddoes.com, was protected by CloudFlare, an anti-DDoS provider which formerly protected LulzSec's website from a barrage of cyber attacks.

See also the previous blog post  Cloudflare Enables Miscreants.

The Reach of Encyclopedia Dramatica

Whether some people like it or not, ED is a very popular site. It serves between one and three million pages per day. - Zaiger, exaggerating his audience size. 
global reach of this blog with 28 posts, compared to
encyclopediadramtica.se, with 10,000 "articles"

If Zaiger's statement was true, Encyclopedia Dramatica should be earning 500 to 1500 US dollars per day, based on a very conservative estimate of an ad income of $.50 per 1,000 page views.

Ryan Cleary Is Back In Jail

Ryan Cleary, former owner of the resurrected Encyclopedia Dramatica, was jailed March 5 for violating his bail conditions.

UK LulzSec suspect jailed for contacting US hacker
Published March 31, 2012
Associated Press

LONDON -- The lawyer for a 19-year-old Briton suspected of links to the hacking group Lulz Security says her client's back behind bars for breaching his bail conditions.

Karen Todner says that teenager Ryan Cleary had sent a handful of electronic messages to LulzSec leader Hector Xavier Monsegur over the Christmas period, despite being banned from the Internet as part of his bail agreement.

London's Metropolitan Police say Cleary was rearrested on March 5, a day before the FBI disclosed that Monsegur, better known as Sabu, had been secretly working as an informant.

Todner said Saturday that Cleary is now being held in Chelmsford Prison, about 35 miles northeast of London.



He is due to reappear before a judge in May.


Here is Garrett Moore tweeting with Sabu (Hector Xavier Monsegur) last September, long after Sabu's arrest and his cooperation with the Feds started.



ED is down March 2012

Update: After SWITCH was contacted and asked for the reason why the nameservers for encyclopediadramatica.ch were deleted, a source responded, "encyclopediadramatica.ch had to be inactivated and blocked due to a court order from the criminal prosecutor of the Canton of St. Gallen.

Update #2: At roughly the same time ed.ch was inactivated, the domain registration was changed to list Ryan's mum, Rita as the technical contact.



Domain name:

encyclopediadramatica.ch



Holder of domain name:

EDrama Limited

Cleary Ryan

South Beech Avenue 10

GB-SS118AH Wickford

United Kingdom

Contractual Language: English



Technical contact:

EDrama Limited

Cleary Rita

South Beech Avenue 10

GB-SS118AH Wickford

United Kingdom


Yesterday, the nameservers for encyclopediadramatica.ch were deleted from the registrar for Swiss domain names, SWITCH.

Last October, Sven Slootweg changed the registrar records to indicate that the new owner was Ryan Cleary. Speculation leads to the possibility that representatives of Cleary are responsible for deleting the nameservers from the records, since he agreed to avoid using the internet on condition of his release from jail while he awaits trial on multiple charges.

Die Revolution sagt ich bin, ich war, ich werde sein.

anonymouSabu The federal government is run by a bunch of fucking cowards. Don't give in to these people. Fight back. Stay strong. 1 day ago 
The first mention that Hector Monsegur = Sabu seems to have happened around June 22 2011, roughly the same time both he and Ryan Cleary were arrested.  Monsegur has been working with the FBI since.

I wonder where Garrett's gone off to, and if Saad has ever had a friendly chat with the Feds.

Netblocks owned by "EDrama Ltd"

Queried whois.ripe.net with "-B 37.59.72.64"...

% Information related to '37.59.72.64 - 37.59.72.79'

inetnum: 37.59.72.64 - 37.59.72.79
netname: EDRAMA2
descr: EDrama Ltd
country: CH
org: ORG-OC30-RIPE
admin-c: OTC2-RIPE
tech-c: OTC2-RIPE
status: ASSIGNED PA
mnt-by: OVH-MNT
changed: noc@ovh.net 20120202
source: RIPE

anonnews.org  37.59.72.67
tahoe-gateway.cryto.net  37.59.72.67
lists.encyclopediadramatica.ch  37.59.72.68
mail.edrama.us a 37.59.72.74
mail.encyclopediadramatica.ch 37.59.72.74

cryto.net and anonnews.org are of course owned by Joepie91 AKA Sven Slootweg. He has changed the registration of anonnews to claim that the domain is owned by Pirate Bay co-founder Gottfrid Swartholm. Slootweg also changed the domain registration of encyclopediadramatica.ch to claim it is owned by Ryan Cleary, who is currently awaiting trial In England.


Queried whois.ripe.net with "-B 37.59.72.96"...

% Information related to '37.59.72.96 - 37.59.72.111'

inetnum: 37.59.72.96 - 37.59.72.111
netname: EDRAMANET1
descr: EDrama Ltd
country: CH
org: ORG-OC30-RIPE
admin-c: OTC2-RIPE
tech-c: OTC2-RIPE
status: ASSIGNED PA
mnt-by: OVH-MNT
changed: noc@ovh.net 20120202
source: RIPE

srsvps.com 37.59.72.101