Ryan’s for Real, Site May Be Fake

UPDATE: The site is insecure at this time. If you donate there your personal information, including credit card information, may be intercepted. For details see my next post.

UPDATE 2: Some time between Sunday afternoon and Monday morning the domain was parked. The domain no longer displays framed content from, but instead displays a page with ads, a search box, and a notice that the domain is for sale.

By now you’ve likely heard that you didn’t need to download the app to notify you of who the VP was going to be, because AP apparently found a leaker who  says that it’s Congressman Paul Ryan.  Shortly after that some inquisitive soul discovered that there was a domain called, and the word rapidly spread on Twitter.  Being of the geekish persuasion, I immediately started poking around, looking up information about the site and the domain. Meanwhile my friend Sarah Rumpf had seen that the domain name was consistent on every page, something that would not happen with a simple redirection, and posted about the site on her blog.

I started off thinking it was a domain speculator (because the domain was registered in 2010,) swung briefly to thinking it might be real when Sarah pointed out that the linked pages all said instead of MittRomney com, which suggested to me that the official Mitt Romney site had been cloned. After looking at the source code for the pages, I am now once again of the opinion that it is a domain speculator again. If that sounds like technobabble to you, fear not! Below is a slightly cleaned up version of the comments I made about Sarah’s post, with links added.

English Version:

I told Sarah some things didn’t add up with the site. Here is what I have discovered about the domain in English as much as I can make it.

Computers speak numbers, people speak words. So each site has a numerical address called an IP address for the computers to use. But people don’t want to have to remember “,” they want to go to So you can register a name for your site, and a set of special computers on the Internet called Domain Name Servers translate the words we use into numbers that computers can use. (Yes, I know the link is a Wikipedia article. It’s pretty good anyway.)

You can do a search called a “whois” search and find out who registered a particular domain name (unless they use a private registrar that registers it for you and passes messages between you and people asking about it while protecting your anonymity.)

I did a whois search on and found the record at which says that the domain was registered in February of 2010 for three years. He also got .net .org .biz .info and .us. It’s a form of gambling- You pick a domain that may become valuable, register it, list it for sale with the registrar (GoDaddy in this case) and wait for lightning to strike. If you have the GoDaddy bulk domain purchase package the whole bit will likely cost you about $80 for three years. (I will paste the current WHOIS information at the bottom in case the information changes.)

Now, here comes the tricky part. You can point a domain name anywhere. I could register “” and point it to You do not have to have access to the destination site to point a domain name at it. ( likely would not last long for reasons I won’t go into.)

Seeing the domain was likely held by a domain speculator and it appearing to land on the official web site made me think that the domain speculator had pointed the domain name to the official Mitt Romney site. But Sarah pointed out all of the links worked. Not a problem, if you landed on the new site all of the links SHOULD work. But the domain name stayed at “” on the linked pages. That made me think it was legitimate and that they had just not changed the registration yet to hide it.

But wait! Each page displayed “” not Something tricky was afoot. So despite having told Sarah I thought it was probably legit right before she tweeted she was heading to bed, I kept digging. I looked at the source code that is used to generate the web page. (I am not an expert, but I can muddle through reading it most of the time.)

Now we need to talk about another piece of Internet Magic called “iframes.” An iframe is a way of pulling a page or an element of a page from someplace else and displaying it on another page. It is a useful feature. For instance, the comment editor on this page (which I am using right now) exists someplace else on Google, and is pulled in on pages as needed. Instead of ten million copies of the editor and worrying about keeping them all up to date there is one editor and a copy is remotely loaded onto any page that needs it using an iframe.

The source code for is 18 lines long, including 2 lines to declare the document type and 3 blank lines to separate different parts of the code. To build the page you create a frame with a border 0 pixels wide, and pull in a page from There is also an instruction to make the displayed URL be (I’ll paste the source code at the bottom for fellow geeks in case the page changes.)

So, we now have three possibilities I can think of after tweeting with some other people who are savvy about web stuff:

1. The Romney campaign bought the domain, but left the registration in the name of the domain speculator to avoid tipping off the press.

2. The domain speculator decided to turn up the heat on the Romney campaign by pulling in the official Romney site, then saying that he will remove that unless they want to buy it.

3. The domain speculator is a Romney supporter who has decided to make an “in kind” contribution by pulling in the official site. I hesitate to speculate about campaign finance law, but I suspect the only part that he would have to report would be the value of one year of the domain registration and hosting. Even if it’s 3 years, all of the domains he got and hosting for all of them (plus the time to create the sites) would be considerably less than the individual maximum contribution.

If you’ve made it this far, congratulations! You’re done; what follows are the WHOIS record and source code mentioned above. Only geeks who actually care need go farther.


WHOIS lookup:

Reverse Whois:
“Peter Crowley” owns about56 other domains
Email Search:
 is associated with about 78 domains
Registrar History:
NS History:
3 changes on 3 unique name servers over 2 years.
IP History:
28 changes on 10 unique IP addresses over 2 years.
Whois History:
22 records have been archived since 2010-02-24 .
Reverse IP:
6,429 other sites hosted on this server.
Peter Crowley
3285 33rd Street
Astoria, New York 11106
United StatesRegistered through:, LLC (
Created on: 22-Feb-10
Expires on: 22-Feb-13
Last Updated on: 02-Jun-12Administrative Contact:
Crowley, Peter  
3285 33rd Street
Astoria, New York 11106
United States
+1.7815009478Technical Contact:
Crowley, Peter  
3285 33rd Street
Astoria, New York 11106
United States
+1.7815009478Domain servers in listed order:

=================================== source code as of time I started writing this post (with comment code added so it will display and not pull in the page):
<frameset rows=”100%,*” border=”0″>
src=”” frameborder=”0″ />
<frame frameborder=”0″ noresize />

One Response to “Ryan’s for Real, Site May Be Fake”

  1. [...] On my last post I explained why I thought that the page is a fake. held by a domain speculator. After posting I returned to Twitter where a friend who probably doesn’t want her name used pointed out that the donation page on is insecure. [...]

Leave a Reply

Your server is running PHP version 4.4.9 but WordPress 4.0 requires at least 5.2.4.