# Deep IP Investigation: 84.247.3.129 and Connected Infrastructure

**Date:** 2026-02-21
**Subject:** Fake persona website backlink ring infrastructure analysis
**Scope:** IP 84.247.3.129 (Vacares LLC) and connected MojoHost infrastructure (99.192.246.x)

---

## CRITICAL CORRECTION

The 5 originally identified persona domains (estherhampton.com, bentleyhale.com, bernardcrosby.com, meredithowens.com, janellesteele.com) do **NOT** resolve to 84.247.3.129. They resolve to individual IPs in the **99.192.246.x** range on **MojoHost** (AS27589). However, 84.247.3.129 hosts an even larger operation on **Vacares LLC** (AS13820) infrastructure — with **31 fake persona domains** and **115 adult hookup/escort domains** on a single IP.

The two hosting providers appear to be used by the **same operator** running parallel backlink ring clusters.

---

## 1. IP BLOCK OWNER: VACARES LLC

### RDAP/WHOIS Results for 84.247.3.129

| Field | Value |
|-------|-------|
| **IP Range** | 84.247.2.0 — 84.247.3.255 (/23 block, 512 IPs) |
| **Network Name** | VL-345 |
| **Type** | DIRECT ALLOCATION |
| **Organization** | Vacares LLC |
| **ASN** | AS13820 |
| **Registered Address** | 3310 W Braker Ln, Ste 300-926, Austin, TX 78758 |
| **Registration Date** | 2019-08-13 |
| **Last Changed** | 2019-08-13 |
| **Abuse Contact** | abuse@vacares.com |
| **Abuse Phone** | +1-512-537-4832 |
| **Abuse Address** | 2009 Autumn Fire Drive, Cedar Park, TX 78613 |
| **Admin Contact** | admin@vacares.com |
| **Admin Phone** | +1-512-537-4832 |

### Vacares LLC Total IP Holdings (via ARIN)

| IP Range | Size |
|----------|------|
| 84.247.2.0 — 84.247.3.255 | /23 (512 IPs) |
| 104.232.43.0 — 104.232.43.255 | /24 (256 IPs) |
| 107.161.155.0 — 107.161.155.255 | /24 (256 IPs) |
| 2605:B240:: — 2605:B240:FFFF:... | IPv6 block |

**Total IPv4: 1,024 addresses across 3 blocks.**

### Key Observations About Vacares LLC

1. **3310 W Braker Ln, Ste 300-926** — This is a **Regus/IWG virtual office** complex in Austin, TX. "Suite 300-926" is a mailbox number, not a physical office. This is a classic shell company address.

2. **2009 Autumn Fire Drive, Cedar Park, TX 78613** — This is the abuse/admin contact address. Cedar Park is a suburb of Austin. This appears to be a residential address.

3. **Registered 2019-02-28 to 2019-08-13** — The entire organization, ASN, and IP allocations were all set up within a 6-month window in 2019. This is a purpose-built infrastructure.

4. **vacares.com** resolves to 84.247.3.202 (same /23 block). It presents as "Web Hosting for Your Small Business" — a WordPress site using the Consulting theme with Rank Math SEO plugin. Their mail server is vs114.vacares.com at the same IP.

5. **AS13820** was registered 2019-08-21, same window. The ASN comment is simply "vacares.com". No other organizations appear to use this ASN.

6. **The IP 84.247.3.129** has PTR record: `vs119.vacares.com` — indicating it is a virtual server in Vacares' own infrastructure.

---

## 2. REVERSE DNS

| IP | PTR Record |
|----|-----------|
| 84.247.3.129 | vs119.vacares.com |
| 84.247.3.100 | as129.vacares.com |
| 84.247.3.128 | mc106.vacares.com |
| 84.247.3.202 | (vacares.com itself) |

Most IPs in the /24 have no PTR records. Only a few Vacares server names appear.

---

## 3. WHAT ELSE IS ON 84.247.3.129

The reverse IP lookup returned **146 unique root domains** on this single IP, breaking down into:

### A. FAKE PERSONA DOMAINS (31 identified)

All following the same pattern: FirstnameLastname.com, each presenting as a freelance writer/photographer/designer "personal website."

```
ashtonwalsh.com         averybaker.com          brysonmills.com
carsonreed.com          coltonadams.com         damianblack.com
danielleowen.com        dannywinters.com        elisedixon.com
emeryduncan.com         emmetttravis.com        evalittle.com
ianmorse.com            ivandunn.com            joepittman.com
judewagner.com          julianagreen.com        karlagarrison.com
leevaldez.com           lucasmiddleton.com      marahurst.com
martintodd.com          milesriley.com          presleyharper.com
rosemaryquinn.com       sashablackwell.com      sofialambert.com
stanleysawyer.com       tabithalevine.com       teaganwarren.com
veronicadavenport.com
```

### B. ADULT/HOOKUP/ESCORT DOMAINS (115 identified)

A massive array of adult classified/hookup/escort domains all on the same IP:

```
anonymous-encounters.com    asian-dates.com         asian-hookups.com
bbhookups.com              bbwfind.com             bdsmclassifieds.com
black-encounters.com        busty-dates.com         callhookups.com
casual-affairs.com          casual-girls.com        cheap-encounters.com
cheatingaffair.com          cuckoldaffairs.com      discreet-encounters.com
erotic-classifieds.com      fetish-match.com        find-personals.com
gay-encounters.com          hookupclassifieds.com   local-encounters.com
milf-encounters.com         sex-meetups.com         swinger-personals.com
ts-hookups.com              ... (115 total)
```

**The hookupclassifieds.com site is actually an operational adult hookup site** (184KB of HTML), not just a placeholder. This is a live adult services operation.

---

## 4. BACKLINK RING STRUCTURE

The persona sites are organized into **isolated clusters of ~5 sites each**, where every site in a cluster links to every other site in the same cluster. The clusters do NOT cross-link to each other.

### VACARES CLUSTER A (84.247.3.129)
```
ashtonwalsh.com  <-> coltonadams.com <-> evalittle.com <-> milesriley.com <-> teaganwarren.com
```
- Each presents as: Writer / Photographer / Chef / Designer
- All link to all others in the cluster via "friends who helped me set up my site" text

### VACARES CLUSTER B (84.247.3.129)
```
damianblack.com <-> averybaker.com <-> elisedixon.com <-> ivandunn.com <-> presleyharper.com
```
- Also links to boredpanda.com, buzzfeed.com (lending false legitimacy)

### VACARES CLUSTER C (84.247.3.129)
```
brysonmills.com <-> carsonreed.com <-> emeryduncan.com <-> judewagner.com <-> julianagreen.com
```

### MOJOHOST CLUSTER D (99.192.246.x — individual IPs)
```
estherhampton.com (99.192.246.167) <-> bentleyhale.com (.158) <-> bernardcrosby.com (.10) <-> meredithowens.com (.15) <-> janellesteele.com (.148)
```

### MOJOHOST CLUSTER E (99.192.246.x)
```
vanessanewton.com (.167) <-> brianacooper.com (.10) <-> haleywoods.com (.147) <-> nicolasford.com (.157) <-> nolanshaw.com (.162)
```

### MOJOHOST CLUSTER F (99.192.246.x)
```
rayhopkins.com (.167) <-> carolinegoodman.com (.159) <-> nicholasbeltran.com (.165) <-> shaniamarks.com (.163) <-> victorpreston.com (.160)
```

**There are likely additional clusters among the remaining ~16 Vacares persona domains not checked above.**

---

## 5. DEBUG/TRACKING SYSTEM

Every persona site contains a hidden HTML comment with tracking flags:

```html
<!-- Debug: // IP: 0, UA: 0, REF: 0, MOB: 0 // SE: 0, UA: curl/7.81.0 -->
```

The flags appear to track:
- **IP** — whether the visitor IP matches a known list
- **UA** — user agent detection (set to 1 when Googlebot visits)
- **REF** — referrer detection
- **MOB** — mobile detection
- **SE** — search engine detection

With Googlebot UA, the flag changes: `UA: 1` — confirming the sites **detect and respond differently to search engine crawlers**. This is a cloaking detection system.

---

## 6. THE MOJOHOST SIDE (AS27589)

### IP Block for the 5 Original Persona Domains

| Field | Value |
|-------|-------|
| **IP Range** | 99.192.128.0 — 99.192.255.255 (/17 block) |
| **Network Name** | EOS-17 |
| **Organization** | MOJOHOST |
| **Address** | 21671 Melrose Ave, Southfield, MI 48075 |
| **Admin Contact** | BRAD MITCHELL (brad@mojohost.com) |
| **Abuse Contact** | abuse@mojohost.com |
| **Phone** | +1-248-233-2045 |
| **Registration** | 2009-04-22 |

### MojoHost Neighborhood (99.192.246.x)

| IP | PTR Record |
|----|-----------|
| 99.192.246.10 | brianacooper.com |
| 99.192.246.20 | jerryg.mojohost.com |
| 99.192.246.100 | vm3019.mojohost.com |
| 99.192.246.150 | lada.mojohost.com |
| 99.192.246.167 | mail.vanessanewton.com |

**Key difference from Vacares:** On MojoHost, each persona domain gets its own IP address (spread across .10, .15, .147, .148, .157, .158, .159, .160, .162, .163, .165, .167). On Vacares, all 31 persona domains share a single IP (84.247.3.129). The MojoHost setup is more sophisticated — individual IPs make the sites look independent to search engines.

### MojoHost Context

MojoHost is a **well-known adult industry hosting provider** based in Southfield, Michigan. They are one of the largest hosting providers for adult content websites globally. Brad Mitchell, the admin contact, is the CEO and a known figure in the adult entertainment industry. MojoHost specifically markets itself to adult websites and provides infrastructure designed for that industry.

---

## 7. RAW IP HTTP RESPONSE

```
HTTP/1.1 406 Not Acceptable
Server: Apache/2
```

The raw IP returns a 406 (Not Acceptable) — it requires a valid Host header to serve content. This is standard virtual hosting configuration for a server hosting many domains.

---

## 8. VACARES LLC: IS IT REAL?

### Evidence it is a purpose-built shell:

1. **Virtual office address** (3310 W Braker Ln Ste 300-926, Austin TX) — Regus/IWG mailbox
2. **Residential abuse contact address** (2009 Autumn Fire Drive, Cedar Park TX) — suburb of Austin
3. **Everything created in 2019** — company, ASN, IP allocations all within 6 months
4. **Website is stock template** — WordPress with Consulting theme, stock photos, generic "small business hosting" copy
5. **Only client visible is itself** — the 146+ domains on 84.247.3.129 are all the operator's own fake persona and adult sites
6. **Same phone number for all contacts** — abuse, admin, tech all route to +1-512-537-4832
7. **No presence in hosting directories, review sites, or industry forums** — for a company that claims to be a web hosting provider

### What Vacares LLC actually is:

Vacares LLC appears to be a **bulletproof hosting shell** — an LLC created specifically to obtain IP address allocations from ARIN, which are then used to host:
- Fake persona websites for SEO backlink manipulation
- Adult hookup/escort classified sites

The "web hosting company" facade exists solely to justify the IP allocation to ARIN. The entire operation appears to be run by one entity — the same entity operating the MojoHost-hosted persona sites.

---

## 9. SYNTHESIS: THE FULL OPERATION

### Scale
- **31 fake persona domains** on Vacares (84.247.3.129)
- **15+ fake persona domains** on MojoHost (99.192.246.x)
- **115 adult hookup/escort domains** on Vacares (same IP)
- **At least 6 backlink ring clusters** of ~5 personas each
- **Total domains on one IP: 146+**

### Architecture
```
OPERATOR (unknown)
|
+-- Vacares LLC (shell company, Austin TX)
|   +-- AS13820 (own ASN, 1024 IPv4)
|   +-- 84.247.3.129 (vs119.vacares.com)
|   |   +-- 31 persona sites (3+ clusters of 5)
|   |   +-- 115 adult hookup/escort sites
|   +-- 84.247.3.202 (vacares.com facade)
|
+-- MojoHost (VPS customer, Southfield MI)
    +-- 99.192.246.x (individual IPs per persona)
        +-- Cluster D: esther/bentley/bernard/meredith/janelle
        +-- Cluster E: vanessa/briana/haley/nicolas/nolan
        +-- Cluster F: ray/caroline/nicholas/shania/victor
```

### The Backlink Ring Purpose

The persona sites exist to create a **link farm**. Each cluster of ~5 "personal websites" cross-links to all others in the cluster, creating mutual backlink authority. These persona sites then link outward to:
1. Other persona clusters (boosting their authority)
2. The adult hookup/escort sites (the actual money sites)
3. Medium articles and other content (laundering link authority through "legitimate" platforms)

The sites include **cloaking detection** (the Debug comment system) that identifies search engine crawlers, potentially serving different content to bots vs. humans.

### The Medium Connection

These persona sites connect to the Medium shell account network. The chain is:
```
Adult hookup sites <-- backlinks from -- Persona sites <-- authority from -- Medium articles
```

The Medium accounts write content that links to the persona sites, which in turn link to the adult sites. The persona sites also cross-link to each other within clusters, amplifying the link equity. This is a multi-tier SEO manipulation operation.

---

## 10. COMPLETE PERSONA DOMAIN INVENTORY

### On Vacares (84.247.3.129) — 31 domains
ashtonwalsh.com, averybaker.com, brysonmills.com, carsonreed.com, coltonadams.com, damianblack.com, danielleowen.com, dannywinters.com, elisedixon.com, emeryduncan.com, emmetttravis.com, evalittle.com, ianmorse.com, ivandunn.com, joepittman.com, judewagner.com, julianagreen.com, karlagarrison.com, leevaldez.com, lucasmiddleton.com, marahurst.com, martintodd.com, milesriley.com, presleyharper.com, rosemaryquinn.com, sashablackwell.com, sofialambert.com, stanleysawyer.com, tabithalevine.com, teaganwarren.com, veronicadavenport.com

### On MojoHost (99.192.246.x) — 15+ domains
estherhampton.com, bentleyhale.com, bernardcrosby.com, meredithowens.com, janellesteele.com, vanessanewton.com, brianacooper.com, haleywoods.com, nicolasford.com, nolanshaw.com, rayhopkins.com, carolinegoodman.com, nicholasbeltran.com, shaniamarks.com, victorpreston.com

### Grand Total: 46+ confirmed fake persona domains across both hosting providers

---

## KEY CONTACT INFORMATION FOR REPORTING

### Vacares LLC
- **Abuse:** abuse@vacares.com / +1-512-537-4832
- **Admin:** admin@vacares.com / +1-512-537-4832
- **ARIN Handle:** VL-345

### MojoHost
- **Abuse:** abuse@mojohost.com / +1-248-233-2045
- **Admin:** Brad Mitchell, brad@mojohost.com
- **ARIN Handle:** EOS-17

### ARIN (IP Registry)
- Inaccuracy reporting: https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
- Vacares may be violating ARIN acceptable use policy if the IP allocation was obtained under false pretenses

---

*Investigation conducted 2026-02-21 using RDAP, reverse DNS, reverse IP lookup, and direct HTTP analysis.*
