Ape-Testing, LLC

Passive Reconnaissance of Petco P.2

2.11.2018

This Report was Prepared By:

Taco Lemur Security
Nicolas Bautista
Jaime Ibarra
Alyssa Evans
nicbauti@uat.edu
jaiibarr@uat.edu
alyevans@uat.edu
Table of Contents
Introduction ................................................................................................................................................... 2
Overview ....................................................................................................................................................... 2
Key Employees ............................................................................................................................................. 2
Other Company Information ......................................................................................................................... 7
Visual Map & Maltego Results..................................................................................................................... 7
Netcraft Results............................................................................................................................................. 8
Suspected Network Ranges Petco.com ......................................................................................................... 9
Suspected Network Ranges Unleashedbypetco.com .................................................................................... 9
Other Hosts ................................................................................................................................................... 9
DNS Enumeration ....................................................................................................................................... 10
Banner Grabbing ......................................................................................................................................... 13
Advanced Search Strings Success............................................................................................................... 18
Advanced Search Strings Success No Good Results .................................................................................. 18
Tools/Websites Used .................................................................................................................................. 18

1|Page
Introduction
Taco Lemur Security Team were tasked with obtaining more information on the organization
previously chosen and documenting the results. PETCO Animal Supplies Stores, Inc. was further
researched with key employees in mind. The results found below were gained legally and as
unobtrusively as possible given the objective.

Overview
The purpose of this phase was to gain a better insight to PETCO and its employees. Knowing the
chain of command as well as their personal lives allow for us to better gain an idea of what kind
of person they are. This is good to know if we were to approach them in the hopes of gleaning
more information from them. Diagramming their network and continuing to verify if anything is
added to determine if there is anything new or vulnerabilities that will appear. The google search
strings are useful ways to access this information that is already available to the public.

Key Employees
 Jim Myers: Chairman & Chief Executive Officer
o Age: 58
o Total Calculated Compensation as of Fiscal Year 2014: $2,739,225
o Married to Josie Myers
o E-mail: jim.myers@petco.com
o Joined in 1990
o First assignment was Vice President and Controller
o Promoted to Executive Vice President and Chief Financial Officer in 1998
o Elected to Board of Directors in 2000
o Promoted to Chief Executive Officer in 2004
o Added Chairman in 2015
o Previous Employment
 Senior Audit Manager at KPMG
o Education
 John Carroll University
 BS, Accounting
o Serves Board Position
 Retail Industry Leaders Association
 John Carroll University
 San Diego-based Jack in the Box
 Brad Weston: President of Unleashed & Chief Merchandising Officer at Petco
o Location: La Jolla, California
o Previous Employment
 Senior Vice President & Chief Merchandising Officer at Dick's Sporting
Goods
 Senior Vice President & Chief Merchandising Officer at Golf Galaxy
 Senior Vice President & General Merchandise Manager at May Company
o Education
 University of California, Berkeley

2|Page
  BS, Business Administration
 Mike Nuzzo: EVP, Chief Financial Officer
o Age: 48
o Location: Pittsburgh, Pennsylvania
o Previous Employment
 Chief Administrative Officer and EVP Business Development at 4moms
 EVP and CFO at GNC.
 Leadership roles at Abercrombie & Fitch
o Education:
 University of Chicago Booth School of Business
 MBA, accounting and Finance
 Kenyon College
 BS, Economics
o Phone: 502-384-9174
o Petco Email: miken@petco.com
o Alternate Email: Mike.Nuzzo@petco.com
o Facebook link: https://www.facebook.com/mike.nuzzo.54
o LinkedIn: https://www.linkedin.com/in/mike-nuzzo-63237510
o Joined in Petco 2015
o Family
 Married: Shauna Nuzzo
 Nurse Practitioner at Children's Hospital of Pittsburgh of UPMC
 Worked at Nationwide Children's Hospital
 Studied at John Carroll University Cleveland, Ohio
 From Pittsburgh Pennsylvania
 Wife Family members
o Michael La Guardia
o Lisa La Guardia
 4 Children
 2 Play Soccer.
 Charlie Piscitello: SVP, Chief People Officer & President of PETCO Foundation
o Age: 53
o Total Calculated Compensation as of Fiscal Year 2014: $962,254
o Location: San Diego, California
o Board of Trustees Member
 HABRI foundation (Human Animal Bond Research Initiative)
 Pet Industry Leaders Council
o Co-chair of Chief Hum Resource Officers Council for the Retail Industry Leaders
Association
o Chair Elect and Board Member for the North San Diego Business Chamber of
Commerce
o Founding member of the i4cp Chief Human Resource Officers board
o Previous Employment
 Boston Scientific
 First Data
 Gateway Inc.

3|Page
  Coors Brewing Company
 Abbott Laboratories
o Education
 Marquette University
 BS, Communication
 Razia Richter: SVP, Chief Customer Officer
o Age: 52
o Location: San Diego, California
o Joined in 1991
o Roles
 Store Operations
 Inventory Management
 Analytical Services
 Business Development
 Company Controller
o Promoted to current role in 2012
o Previous Employment
 KPMG US
o Education
 University of San Diego
 Master of Business Administration (MBA), Business
 San Diego State University-California State University
 Bachelor of Business Administration (BBA), Accounting
 Woodside High School
 Rebecca Frechette: SVP, Merchandising
o Location: Greater San Diego Area
o Previous Employment
 Senior Vice President of Merchandising at 7-Eleven
 Merchandising, planning, and private brand leadership at Target
 Accenture
o Education
 Purdue University
 MBA, International Marketing and Finance
 Marquette University
 University of Wisconsin-Eau Claire
 BA, Organizational Communication
o Social Media information https://www.facebook.com/rebecca.c.frechette
 Married to Brian Frechette https://www.facebook.com/brian.frechette
 Went to Onalaska High School
 Green bay packer Fan
 Not Voting for Hillary Clinton
 One Daughter
 Dog Named Jake https://www.facebook.com/jake.frechette.3
 Steve Lossing: SVP, Operations
o Location: San Diego, California
o From: Mechanicsburg, Pennsylvania

4|Page
 o Serves Board of Directors for Petco Foundation
o Previous Employment
 The Foundry Big & Tall Supply Co.
 Merchandise Leadership positions at J.C. Penney
 Merchandise Leadership positions at Saks Incorporated
 Merchandise Leadership positions at Elder-Beerman Department Store
 Merchandise Leadership positions at May Department Stores
o Education
 Penn State University
 BS, Marketing
 Cumberland Valley High school
o Social Media information
 Married to Karen lossing https://www.facebook.com/karen.lossing.7
 Children
 Evan lossing https://www.facebook.com/evan.lossing
o Lives in McKinney, Texas
 Libby Lossing https://www.facebook.com/libby.lossing
o Studying at UCLA
o In the UCLA chapter of Alpha Delta Pi
o Proud Texan Girl.
 Mother: Yvonne Lossing https://www.facebook.com/ylossing
 Lives in Cincinnati
 Michael Zuna: SVP, Chief Marketing & Digital Officer
o Age: 47
o Location: San Diego, California
o Previous Employment
 Executive Vice President and Chief Marketing Officer at Aflac
 Managing Director at Saatchi & Saatchi
 Leadership roles at Arnold Worldwide
 Leadership roles at Ogilvy & Mather
o Education
 United States Naval Academy
 BS, Economics
 Ranked 31st in Forbes of the world's most influential CMOs
o Social Media Information
 Lives in Rancho santa Fe, California Su
 Has two Daughters
 Jodi Watson: SVP, Petco Direct
o Location: San Diego, California
o Previous Employment
 President, Consumer Direct at Wolverine World Wide
 Bag Borrow or Steal
 Leadership positions at Williams-Sonoma, Inc.
 Leadership positions at Eddie Bauer
o Education
 IIT Institute of Design, Chicago
 Masters, Human Centered Designs (Design Methods)

5|Page
  Portland State University
 BA, Business
o Social Media Information
 Maiden name Stahlnecker
 Other Websites
 http://www.wolverineworldwide.com
 http://www.merrell.com
 http://Www.hushpuppies.com
 http://Www.chacousa.com
 http://Www.sebago.com
 http://Www.wolverine.com
 Outspoken about women being aware or sexual harassment.
 John Carcasi: SVP, Supply Chain & Merchandise Planning
o Age: 46
o Location: San Diego, California
o Previous Employment
 Merchandising Leadership positions at JCPenny
 Tootsies
 The Childrens Collection
 Foleys Department Store
o Education
 Texas A&M University
 Master of Business Administration (M.B.A.), Retailing and Retail
Operations
 Bachelor of Arts (BA), History
 Stephen F. Austin State University
 Bachelor of Arts (B.A.), History
 Brian K. Devine: Chairman Emeritus and Director, Petco Holdings, Inc.
o Age: 74
o Total Calculated Compensation: $262,797
o Location: San Diego, California
o Previous employment
 Krause's Sofa Factory
 Toys R Us
 Department of Health, Education, and Welfare
o Education
 Georgetown University
 Bachelor of Arts (B.A.), Economics
 American University
 Graduate Statistics
 Yale University
 Graduate Statistics
o Email: briand@petco.com
o Phone #: 800-765-9878
o Secretary's #: 888-583-6044 ext. 3046
o Fax #: 858-677-3033
o Address: 9125 Rehco Rd., San Diego, CA 92121-2270

6|Page
  Nettie Pedro: Region 4 Companion Animal Coordinator
o Location: Garland, TX
o Previous employment
o Email: nettiep@petco.com
o Phone #: 972-276-4435 ext. 214
o Fax #: 972-276-4363
o Tool Free Voicemail: 888-583-6044 ext. 4088
o Address: 850 South Jupiter Rd., Suite 100, Garland, TX 75042-7781

Other Company Information

From what we can determine, none of the employees are looking for a job. Based on some of the
employee’s length of employment, it is assumed that they are very invested in PETCO. We were
able to discover Court Information pertaining to Pursuant to Stipulation v. Corporation doing
business as PETCO stores. PETCO’s associates include Pet Industry Sustainability Coalition
(PISC), Second Change Humane Society, CVC Capital Partners
Host New? (Major Shareholder), Instacart (PetcoNow), Partners for Pets, and
av.petco.com Yes
Unleashed (Owned by PetcoNow).
news.petco.com Yes
webmail.petco.com Yes
petfinder.petco.com Yes Visual Map & Maltego Results
meet.petco.com Yes
m.petco.com Yes
petco.com No
citrix.petco.com No
video.petco.com No
partners.petco.com No
secure.petco.com No
careers.petco.com No
about.petco.com No
community.petco.com No
stores.petco.com No
unleashedbypetco.com No
ns45.domaincontrol.com No
ns46.domaincontrol.com No
mailstore1.secureserver.net No
smtp.secureserver.net No

7|Page
 Netcraft Results
Hosting Netblock Client-
Site OS Web Server Server-Side
Country Owner Side
Akamai Java Servlet
petco.com Netherlands Linux AkamaiGHost JavaScript
Tech. SSL
Perl
United CGI
vdi.petco.com Petco unkown unkown JavaScript
States Applications
SSL
United F5 BIG-
stores.petco.com Rio SEO Apache N/A JavaScript
States IP
United F5 BIG- Java Servlet
partners.petco.com Petco unkown JavaScript
States IP SSL
United PR Apache
about.petco.com unkown PHP (Piwik) JavaScript
States Newswire Facebook Lite
PHP
United Footprint XML
careers.petco.com Level 3 Linux JavaScript
States V4.11 SSL
WordPress
United Lithium F5 BIG-
community.petco.com Apache SSL JavaScript
States Tech, Inc. IP
Akamai Microsoft-
petco.shoplocal.com Europe Linux N/A JavaScript
Tech. IIS/8.5
United
vpn.petco.com Petco unkown unkown N/A N/A
States
Akamai Java Servlet
secure.petco.com Netherlands Linux AkamaiGHost JavaScript
Tech. SSL
Apache/2.2.15
marketing02.petco.com.mx Mexico Megacable Linux PHP JavaScript
(Red Hat)
United Amazon.com, Apache/2.2.3
video.petco.com Linux PHP JavaScript
States Inc. CentOS
United
av.petco.com Petco unknown NA NA NA
States
United PR
news.petco.com unknown Apache PHP JavaScript
States Newswire
United
webmail.petco.com Petco unknown NA NA NA
States
United F5 BIG- Microsoft- Image
petfinder.petco.com Petco ASP.NET
States IP IIS/6.0 Map
United
meet.petco.com Petco unkown NA NA NA
States

8|Page
 Akamai
m.petco.com Netherlands Linux Apache Java Servlet JavaScript
Tech.

Suspected Network Ranges Petco.com

Petco Corporate IP Range: 69.195.220.192 /26 (DNS Enumeration)
Petco Corporate IP Range: 209.203.77.0 /24 (WHOIS)
Petco Corporate IP Range: 68.66.163.48 /29 (WHOIS)
Petco Corporate IP Range: 65.117.57.128 /27 (WHOIS)
Petco Corporate IP Range: 68.232.225.208 /29 (WHOIS)
Petco Corporate IP Range: 72.91.2.208 /29 (WHOIS)
Petco Corporate IP Range: 209.150.72.0 /23 (WHOIS)
Petco Corporate IP Range: 68.232.225.208 /29 (WHOIS)
Petco Corporate IP Range: 68.66.163.48 /29 (WHOIS)
Petco total number of available host IPs: 886

Third Party DNS Service (name servers) IP Range: 156.154.0.0 /16 (WHOIS / DNS
Enumeration)
Third Party Email Service (MX servers) IP Range: 67.231.144.0 /20 (WHOIS /DNS
Enumeration)

Suspected Network Ranges Unleashedbypetco.com

Unleashedbypetco GoDaddy Hosting IP Range: 184.168.0.0 /16 (WHOIS / DNS Enumeration)
Unleashedbypetco GoDaddy Hosting IP Range: 68.178.128.0 /17 (WHOIS / DNS Enumeration)
Unleashedbypetco GoDaddy Hosting IP Range: 72.167.0.0 /16 (WHOIS / DNS Enumeration)

Other Hosts
vpn.petco.com – IP: 209.203.77.29 – Reverse: static.twtelecom.net
Secure.petco.com – 184.85.78.9 – Reverse: static.akamaitechnologies.com (proxy service)

9|Page
DNS Enumeration
 Main domain: petco.com
o petco.com A: 204.74.99.100 – crs.ultradns.net (proxy service)
o www.petco.com A: 23.43.185.237 – akamaitechnologies.com (proxy service)
o NS: sdns67.ultradns.net – 156.154.141.67 – sdns67.ultradns.net (Neustar DNS
service)
o NS: sdns67.ultradns.com – 156.154.140.67 – sdns67.ultradns.com (Neustar DNS
service)
o NS: sdns67.ultradns.org – 156.154.143.67 – sdns67.ultradns.org (Neustar DNS
service)
o NS: sdns67.ultradns.biz – 156.154.142.67 – sdns67.ultradns.biz (Neustar DNS
service)
o MX: mx0b-00004901.pphosted.com – 67.231.152.174 (Proofpoint Email service)
o MX: mx0a-00004901.pphosted.com – 67.231.144.212 (Proofpoint Email service)

 Subdomain: vdi.petco.com
o A: vdi.petco.com – 69.195.220.235 – No reverse (possible corporate IP)

10 | P a g e
  Subdomain: stores.petco.com
o A: lb.gravitystream.com – 184.106.1.186 – No reverse (SEO Analytics service)

 Subdomain: partners.petco.com
o A: partners.petco.com – 69.195.220.200 – No reverse (possible corporate IP)

 Subdomain: about.petco.com
o A: roomssite.gtm.prnewswire.com – 199.230.28.57 – No reverse (Multimedia
service)

 Subdomain: careers.petco.com
o A: cdn.findly.com.c.footprint.net – 8.254.233.254 – No reverse (MarkMonitor
Brand Protection service)

 Subdomain: community.petco.com
o A: petco.lithium.com – 208.74.205.252 – Petco.lithium.com (Lithium Community
Site service)

11 | P a g e
  Subdomain: petco.shoplocal.com
o A: a921.g.akamai.net – 70.96.0.81 – No reverse (proxy service)
o A: a921.g.akamai.net – 70.96.0.83 – No reverse (proxy service)

 Second domain: unleashedbypetco.com

o A: unleashedbypetco.com – 184.168.221.1 – ip.secureserver.net (GoDaddy)
o NS: ns46.domaincontrol.com – 208.109.255.23 – ns46.domaincontrol.com
(hosting service)
o NS: ns45.domaincontrol.com – 216.69.185.23 – ns45.domaincontrol.com (hosting
service)
o MX: mailstore1.secureserver.net – 68.178.213.244 – ip.secureserver.net
(GoDaddy)
o MX: smtp.secureserver.net – 72.167.238.29 – prod.phx3.secureserver.net
(GoDaddy)

12 | P a g e
Banner Grabbing
 Main domain: www.petco.com
o GET & HEAD \ HTTP\1.0 & 1.1– “Bad Request” (NetCat 80)
o System/OS: AkamaiGHost HTTP Acceleration/Mirror service
 Anti-fingerprinting load balancer / cache server

 Subdomain: vdi.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “302 Object Moved Location:
https” (NetCat 80)
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1– “No Response” (NetCat 443)
o System/OS: Unknown

 Subdomain: stores.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Bad Request” (NetCat 80)
o System/OS: Apache

13 | P a g e
  Subdomain: partners.petco.com
o GET & HEAD & OPTIONS \/ HTTP\1.0 & 1.1 – “OK” (NetCat 80)
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “No Response” (NetCat 443)
o System/OS: Unknown

 Subdomain: about.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Not Found” (NetCat 80)
o System/OS: Unknown

 Subdomain: careers.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Bad Request” (NetCat 80)
o System/OS: Footprint 4.11/FPMCP
 Cache/Proxy server (anti-fingerprinting)

 Subdomain: community.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Bad Request” (NetCat 80)
o System/OS: Apache

14 | P a g e
  Subdomain: petco.shoplocal.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Bad Request” (NetCat 80)
o System/OS: AkamaiGHost HTTP Acceleration/Mirror service
 Anti-fingerprinting load balancer / cache server

 Subdomain: av.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “No Response” (NetCat 443)
o System/OS: Unknown

 Subdomain: news.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Not Found” (NetCat 80)
o System/OS: Unknown

 Subdomain: webmail.petco.com
o NetCat port 25
o System/OS: Windows
o Service: Microsoft Exchange Server 2003/2008

15 | P a g e
  Subdomain: petfinder.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Bad Request” (NetCat 80)
o System/OS: Windows
o Service: Microsoft-HTTPAPI/2.0 (Could be several things)

 Subdomain: meet.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “No Response” (NetCat 443)
o System/OS: Unknown
o Service: Skype for Business

 Subdomain: m.petco.com
o GET & HEAD & OPTIONS \ HTTP\1.0 & 1.1 – “Bad Request” (NetCat 80)
o System/OS: AkamaiGHost HTTP Acceleration/Mirror service
 Anti-fingerprinting load balancer / cache server

16 | P a g e
  System/OS: Unknown Second domain: unleashedbypetco.com
o GET & HEAD & OPTIONS HTTP/1.0 & 1.1 – “OK” (NetCat 80)
o System/OS: Microsoft-IIS/7.5
o X-AspNet-Version: 4.0.30319
o X-Powered-By: ASP.NET
o OPTIONS: OPTIONS, TRACE, GET, HEAD, POST

17 | P a g e
Advanced Search Strings Success
 inurl:petco filetype:txt
o Discovered Petco court injunction on several malpractices including charging
incorrect price, not complying with California pet store animal care act, poorly
treating animals, and more.
 Inurl:petco.com OR inurl:Unleashedbypetco.com inurl:php
o Shows many Petco web sites are using php

Advanced Search Strings Success No Good Results

 inurl:petco filetype:txt OR filetype:pdf OR filetype:docx OR filetype:doc OR filetype:xls
 Inurl:petco filetype:xlsx OR pptx
 site:unleashedbypetco.com OR site:petco.com filetype:pdf intext:password
 site:unleashedbypetco.com OR site:petco.com filetype:pdf intext:username
 site:unleashedbypetco.com OR site:petco.com filetype:pdf intext:user
 site:unleashedbypetco.com OR site:petco.com filetype:pdf intext:pass
 inurl:petco inurl:admin | intext:admin
 inurl:petco inurl:cp-admin
 site:petco.com -site:community.petco.com -site:video.petco.com -site:careers.petco.com -
inurl:shop -inurl:PetcoStore "inside" OR “password”

Tools/Websites Used
 Google
 Netcraft
 DNSStuff
 NetCat
 DnsEnum
 BurpSuite
 WHOIS (IANA, ARIN, Kali)
o Registrant Info
o Additional Network Identification
o NetBlock Info
 LinkedIn
 Maltego
 Petno-Petco
 Bloomberg
 Plps
 Facebook
 Twitter
 Petco.com

18 | P a g e