On submitting reports:
Here is what I've sorted about the site.
Status as of late on 9/3:
A lot of what is getting reported seems to be vague or wrong. For instance the New York Times has used both prolifewhistleblower dot com and profilewhistleblower dot com. On 9/2 profilewhistleblower was basically a dead site with just a copyright notice.
The domain prolifewhistleblower dot com was registered at GoDaddy on June 7th. They moved the registration to Epik Holdings Inc on Sept 3rd. The prolifewhistleblower "site" was and is hosted at Sucuri which is a web security company. The prolifewhistleblower "site" seems to have a bad cert so maybe they are not good at it. But that might be by design too. eSet is blocking prolifewhistleblower as a possible "unwanted content" site. Probably because they appear to be a prefilter for websites. If you get past all that is redirects to texasrighttolife dot com. They claim there GoDaddy booted them so there was probably a hidden site hosted at GoDaddy that prolifewhistleblower originally redirected to so Sucuri could filter suspicious traffic. So they are probably gathering IPs submitting while the form is offline to filter with later.
texasrighttolife dot com is hosted at IP 126.96.36.199 which is at RightForge in Washington DC.
Ars Technica got it more right than most that referenced them. From their updates it sounds like the site moved hosting to Digital Ocean for a bit before I started digging.
Epik told the Daily Beast they do not want to host it either though they are still acting as register which many seem to mistakenly think is the same thing. So they may want to boot that as well.
Update 9/7/2021 about noon
The Washington Post was reporting the site was down for a second time.
I'm guessing they got the 404 because they tried a full URL instead of going the the site's top level.
The domain is still registered at Epik Holdings Inc but as of 2021-09-04T04:24:02Z the domain points to a new IP 188.8.131.52 which is "hosted" at Overoptic Systems LTD DBM in the UK. Though DNS appears set up for a site redirect to texasrighttolife.com so technically it is not hosted anywhere.
curl -v http://prolifewhistleblower.com
* STATE: INIT => CONNECT handle 0x800096238; line 1491 (connection #-5000)
* Added connection 0. The cache now contains 1 members
* STATE: CONNECT => WAITRESOLVE handle 0x800096238; line 1532 (connection #0)
* Trying 184.108.40.206:80...
* TCP_NODELAY set
* STATE: WAITRESOLVE => WAITCONNECT handle 0x800096238; line 1611 (connection #0)
* Connected to prolifewhistleblower.com (220.127.116.11) port 80 (#0)
* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x800096238; line 1667 (connection #0)
* Marked for [keep alive]: HTTP default
* STATE: SENDPROTOCONNECT => DO handle 0x800096238; line 1685 (connection #0)
> GET / HTTP/1.1
> Host: prolifewhistleblower.com
> User-Agent: curl/7.66.0
> Accept: */*
* STATE: DO => DO_DONE handle 0x800096238; line 1756 (connection #0)
* STATE: DO_DONE => PERFORM handle 0x800096238; line 1877 (connection #0)
* Mark bundle as not supporting multiuse
* HTTP 1.1 or later with persistent connection
< HTTP/1.1 301 Moved Permanently
< Server: nginx/1.19.4
< Date: Tue, 07 Sep 2021 16:05:19 GMT
< Transfer-Encoding: chunked
< Connection: keep-alive
< Location: https://www.texasrighttolife.com/
< Content-Type: text/html
< Access-Control-Allow-Origin: *
* STATE: PERFORM => DONE handle 0x800096238; line 2067 (connection #0)
* Connection #0 to host prolifewhistleblower.com left intact
* Expire cleared (transfer 0x800096238)
Post a Comment