Convicted Fraudster Uses DDoS Attack To Clean Up Search Results, Fails Spectacularly

[Mike]

A Seattle man has found a surefire way to clean up negative search engine results: get arrested for threatening (and apparently executing) a denial-of-service attack against a legal web site for refusing to take down an unflattering link.

Federal prosecutors announced the arrest of Kamyar Jahanrakhshan, 32, on a criminal charge of extortion by threats to cause damage to Leagle.com. If convicted, he faces up to 5 years in federal prison and a $250,000 fine.

A man named Andrew Rakhshan allegedly contacted the website in December 2014 and asked that a link to the offending court decision be taking down.

Then Rakhshan was done asking.

“On January 24, 2015 Rakhshan again sent an e-mail claiming that he met a group of hackers online who were willing to launch a massive cyber-attack on Leagle.com,” prosecutors said in a statement. “Rakhshan claimed that he had no other options to resolve the matter. He threatened to use these hackers to conduct a Distributed Denial of Service (DDoS) attack to force Leagle.com to comply with his demands. On January 25, 2015, a large amount of traffic targeted the IP address for Leagle.com.”

The website was unable to mitigate the attack traffic, which subsided when it removed the link.

Nice work, Andrew. Generating a federal indictment is a surefire way to ensure your vanity search results remain unmarred by "offending court decisions." But this DDoS wasn't Rakhshan's only attempt to scrub the web of negative info. Searching through the Lumen (formerly Chilling Effects) database reveals post-alleged attack efforts Rakhshan made to clean up unflattering search results.


Several takedown notices sent to Google reference a court order obtained by Rakhshan targeting three URLs set up by someone who wanted the world to know about Rakhshan's fraudulent Canadian escapades.



Rakhshan's requests demand the removal of the following URLs by Google.

http://jahanrakhshan-credit-card-embosser.blogspot.com/

http://jahanrakhshan-impersonated-police.blogspot.com/

http://jahanrakhshan-rakhshan-fraud-trial.blogspot.com/

http://rakhshan-vs-whatcom-county-washin...gspot.com/

http://whistleblower-legislation-canada....-page.html

However, the court order [PDF] he cites (in increasingly angry tones) only specifies the removal of three URLs.

http://rakhshan-vs-whatcom-county-washin...gspot.com/

http://jahanrakhshan-rakhshan-fraud-trial.blogspot.com/

The third URL refers to a Google Drive document.



The court's order says the person posting these must remove them, not Google. In fact, a handwritten note appended to the end of the approved order makes it clear Google is not responsible for the removal of the URLs.




(In case you can't see it, the handwritten note reads "Google is not a party to this lawsuit.")



The three other URLs listed in Rakhshan's takedown notices were struck from the court order before approval. That's because there was nothing even possibly libelous about the posts. All they contained were Canadian court documents pertaining to Andrew Rakhshan/Kamyar Jahanrakhshan which, no matter how unflattering, cannot possibly be considered defamatory.



Not that it seems to matter to Rakhshan. This note is appended to his September 2016 takedown request:

Next month is ONE-YEAR anniversary of when I first submitted this Complaint. I am attaching BOTH my Court Orders once again. TELL ME what is the problem or issue. I will then PRINT your comments, attach them to my sworn affidavit, and take it before the SAME Judge and wont leave his courtroom until he gives me a THIRD Order which is to your standards. Once again, the first 2 URLs above are explicitly stated in both orders. That means the Judge has found them to be unlawful, not once, but TWICE - No further explanation is therefore required. The 3rd, 4th and 5th URLs above are an exact replicate of what you removed between December to April. I could elaborate extensively if you wish, but in sum, the Defendant either accuses me of DDoS, or else being a same person as a convicted fraudster from Canada. Last week Google Security called me and asked that I stop contacting Google. I will NEVER do that until these 5 URLs are removed, even if it takes 10 ...

Strange that it mentions a DDoS. But by this point, he'd probably been hearing about the accusations for at least a year. According to the indictment, the attack took place in January 2015. Also stranger that it says the URLs claim he's the same person as a convicted fraudster from Canada. The URLs that remain live don't connect the two names. But the multiple takedown notices -- coupled with the recent indictment of Andrew Rakhshan -- seem to indicate these are both the same person.



However, both a 2011 Canadian news article about Rakhshan…

Westpac, St George Bank and Bankwest were just three banks and card issuers from around the world that gave evidence this year against Kamyar ''Andy'' Jahanrakhshan of North Vancouver.

In spending almost $C500,000 of other people's money, Jahanrakhshan used forged credit cards that carried his real name and supplied the various car dealers with his driver's licence.

He was found guilty last month of multiple counts of fraud by the Supreme Court in British Columbia.

And the DOJ's indictment…

Kamyar Jahanrakhshan, aka “Kamyar Jahan Rakhshan,” “Andy or Andrew Rakhshan,” “Andy or Andrew Kamyar,” and “Kamiar or Kamier Rakhshan,” 32, of Seattle, Washington, was arrested today on a federal criminal complaint charging him with extortion by threats to cause damage to the Dallas, Texas hosting company for Leagle.com, announced U.S. Attorney John Parker of the Northern District of Texas.

...make it explicit this is the same person, despite Rakhshan's protests to the contrary.



And it could be Rakhshan is impersonating the Canadian Broadcast Corporation as well. There are three notices purportedly from the CBC demanding takedowns of archived versions of the CBC's original story about Rakhshan's Canadian legal troubles.



So, it appears Rakhshan is -- or at least was -- engaging in a lot of questionable behavior attempting to scrub the web of mentions of his Canadian criminal past. Adding bogus DMCA takedown notices to an alleged DDoS isn't the ideal course of action one should pursue if they feel their search results are already a bit sketchy.



Permalink | Comments | Email This Story



Originally Published: Thu, 3 Aug 2017 09:38:42 PDT
source

[Philidor]

I'm normally loathe to belittle a person, rather than their actions. But in this case, I have to ask--did he spawn? And if not, can we find a date and time when we can all virtually celebrate?

[contrail]

This is why you pay some guy to carry out your attacks in BitCoin.

[lidlnelly]

Why would someone think a DDOS would remove all search history? All it does is overload the server with requests to a point where the server can't process all the requests? Server blinks and shuts. Information is still there

[contrail]

They have no common sense to think what is gonna happen if they do their attack. Obviously, this guy did not have it. 

[georginho92]

Haha interesting story