Possible login/password grabbing ploy

I have found that most of the common mis-spellings of our domain name
have been registered with the Internic by a company named Americaoffline.

They have also grabbed other mis-spellings of popular domains

Originally I thought they were using these to build a bulk email list.
Then I found they have configured ftp addresses in each domain. This
will allow them to gather valid usernames and passwords anytime someone
makes a typo and trys to upload something to their ISP.

We have listed their servers as bogus in our DNS configuration for now
and are looking into other more complete solutions.

Bind 8.X configuration addition:
server { bogus yes; };
server { bogus yes; };