Who will be the first sponsor to step up about the link code change / trojan problem? - Page 2 - GoFuckYourself.com

Lanceman · 03-12-2007, 08:13 AM

Quote:

Originally Posted by pornonada

any link??

http://www.gofuckyourself.com/showth...13712:thumbsup

intercage · 03-12-2007, 10:48 AM

Pinging spywarequake.info [195.225.177.7] with 32 bytes of data:

20 104 ms 88 ms 88 ms 64.111.192.205
21 87 ms 90 ms 88 ms 66.230.128.91
22 92 ms 84 ms 86 ms 195.225.177.7

OrgName: ISPrime, Inc.
OrgID: IPRM
Address: 25 Broadway
Address: 6th Floor, Suite #2
City: New York
StateProv: NY
PostalCode: 10004-1086
Country: US

ReferralServer: rwhois://rwhois.isprime.net:4321/

pornonada · 03-12-2007, 11:58 AM

Quote:

Originally Posted by intercage

Pinging spywarequake.info [195.225.177.7] with 32 bytes of data:

20 104 ms 88 ms 88 ms 64.111.192.205
21 87 ms 90 ms 88 ms 66.230.128.91
22 92 ms 84 ms 86 ms 195.225.177.7

OrgName: ISPrime, Inc.
OrgID: IPRM
Address: 25 Broadway
Address: 6th Floor, Suite #2
City: New York
StateProv: NY
PostalCode: 10004-1086
Country: US

ReferralServer: rwhois://rwhois.isprime.net:4321/

is that all you have to reply to the bunch of posts about intercage on the last page??

here in another recent malware codec downloading site, guess where it's hosted?

Quote:

Whois for Activexvideosoftware.com ( Activex Video Software
Save | Cancel )
click to edit!
Front Page Information
Website Title: 404 Not Found
Record Type: Domain Name
AboutUs: Wiki article on Activexvideosoftware.com
SEO Score: 66%
Meta Relevance: No terms. Site needs Meta Description.
Terms: 11 (Unique: 9, Linked: 0)
Images: 0
Links: 0

Server Data
Server Type: Apache/2.0.54 (Fedora) mod_ssl/2.0.54 OpenSSL/0.9.7f
(Spry.com also uses Apache)
IP Address: 216.255.179.125
IP Location: - California - Concord - Intercage Inc
Response Code: 404
Blacklist Status: Clear
SSL Cert: No valid SSL on this Host
Website Status: Active

Registry Data
Close ICANN Registrar: ESTDOMAINS, INC.
Created: 06-mar-2007
Expires: 06-mar-2008
Registrar Status: clientTransferProhibited
Whois Server: whois.estdomains.com
Name Server: NS1.ACTIVEXVIDEOSOFTWARE.COM

your host seems to be nothing else than the "El Dorado" and "Paradise" for all kind of criminals.

I would suggest that NO adult site should be doing business anymore with sites anywa related to estdomains, eshost, intercage and any other company somehow using any of these services.

If we cap the traffic exchange with sites hosting with hosts that obviously tolerate and support criminals, than a lot of our problems should be fixed automaticly as we are not longer part of the malware distribution or at very least it will decrease a lot.

AmateurFlix · 03-12-2007, 12:16 PM

Quote:

Originally Posted by pornonada

I would suggest that NO adult site should be doing business anymore with sites anywa related to estdomains, eshost, intercage and any other company somehow using any of these services.

it'd be nice to know what IP ranges those hosts use

germ · 03-12-2007, 01:21 PM

Quote:

Originally Posted by intercage

Pinging spywarequake.info [195.225.177.7] with 32 bytes of data:

20 104 ms 88 ms 88 ms 64.111.192.205
21 87 ms 90 ms 88 ms 66.230.128.91
22 92 ms 84 ms 86 ms 195.225.177.7

OrgName: ISPrime, Inc.
OrgID: IPRM
Address: 25 Broadway
Address: 6th Floor, Suite #2
City: New York
StateProv: NY
PostalCode: 10004-1086
Country: US

ReferralServer: rwhois://rwhois.isprime.net:4321/

wow....what a horrible rebuttal that was.

pornonada · 03-12-2007, 06:51 PM

Quote:

Originally Posted by germ

wow....what a horrible rebuttal that was.

i'am pretty sure isprime will fix things a bit faster than intercage ....

RawAlex · 03-12-2007, 07:00 PM

At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

Lanceman · 03-12-2007, 07:09 PM

Quote:

Originally Posted by AmateurFlix

it'd be nice to know what IP ranges those hosts use

It would I have to agree however it would also be nice to know that sponsors do not promote such behavior

I wage to bet that if we look closer we will find out which sponsors do and dont support this for I have a feeling that behind this organized group lies Quite of few others....

Every good band havs a front man!

Join the "Anti Spyware Coilition"

See thread.

nation-x · 03-12-2007, 07:54 PM

I got this email from Sunbelt Software today

Quote:

----- Original Message -----
From: "Alex Eckelberry" <AlexE[-at-]sunbelt-software.com>
To: <nation-x[-at-]artgps.com>
Sent: Monday, March 12, 2007 10:25 AM
Subject: RE: Huge trojan/spyware network and crime ring

> Shawn -- fwiw, inhosters, intercage/atrivo, etc. are well known in the
> security community as being very loose ISPs. I've talked with the FTC
> about it and a lot of people know, we just don't know when it will ever
> stop.
>
> -----Original Message-----
> From: nation-x[-at-]artgps.com [mailto:nation-x[-at-]artgps.com]
> Sent: Sunday, March 11, 2007 6:01 PM
> To: Alex Eckelberry; thomas | AdultReviews.net
> Subject: Huge trojan/spyware network and crime ring
>
> This last week I was informed about a trojan that was being spread
> around the internet
>
> http://lists.sans.org/pipermail/unis...er/026937.html
>
> I found your blog listed in one of the replies.
>
> I discovered this trojan being served via a porn site at this address
>
> http://www.fresh3xvideos.com/goanal.php
>
> If you research the traffic in alexa you will find that this site get's
> ALOT of traffic... in fact it's currently ranked 5,324
>
> http://alexa.com/data/details/traffi...2F%2Fwww.fresh
> 3xvideos.com%2Fgoanal.php
>
>
> I did a little more investigation and found that the trojan is being
> served from ACTIVEXVIDEOSOFTWARE.COM
>
> We have discovered that a huge number of spammers and ppc cheaters are
> using ESTDOMAINS to register domains and the above domain is no
> different...
> registered at estdomains.
>
> As it turns out the ip of the domains (and dns) is hosted by a comany
> called InterCage... a google search on the company shows that this
> company has been accused of alot of different crimes...
>
> and then I found this post on zdnet.
>
> http://blogs.zdnet.com/Spyware/?p=763
>
> InHosters, Intercage, Atrivo, Esthost and Estdomains are all the same
> company.
>
> I hope that you can help us in some way to defeat this serious issue.
>
> Sincerely,
> Shawn McAllister

and I also got one back from the FBI informing me that they take my report seriously and wwill be investigating....

nation-x · 03-12-2007, 08:06 PM

To Emil,
Thanks for taking the time to reply to this thread... I am glad I got the right name when I made the report to the FBI... you ARE Emil Kacpersky correct? I sent an email to [email protected] but I see the site is still live... as far as I know it's a crime to facilitate an international crime... you do know that disseminating viruses/trojans is a crime right?

Here is why we have a serious issue with Intercage... first of all... you host spammers, ppc cheaters, hackers, etc... wtf are you thinking? Btw... here is the email I sent you...

Quote:

----- Original Message -----
From: <nation-x[-at-]artgps.com>
To: <abuse[-at-]intercage.com>
Cc: <charlotte.public[-at-]ic.fbi.gov>; <ireport[-at-]cnn.com>
Sent: Sunday, March 11, 2007 10:10 PM
Subject: Hosting Trojan software

> Intercage,
> Although I am skeptical that you will take any action in this manner due
> to the association between Intercage, estdomains and InHosters but we have
> uncovered and international crime where a trojan is being served from an ip
> controlled by intercage ( 216.255.179.125) that is designed to steal
> affiliate sales among other things. The trojan was identified by the
> University of Minnesota as a rootkit installed trojan.
> http://lists.sans.org/pipermail/unis...er/026937.html
> http://sunbeltblog.blogspot.com/2006...am-hijack.html
>
> The website I found installing the trojan is currently 5,324 for traffic
> on the web according to alexa.
> http://alexa.com/data/details/traffi...m%2Fgoanal.php
> I have made reports to the FBI, CNN and to SBU in the Ukraine. I see
> this as a serious risk to the national security and probably one of the
> largest fraud schemes ever uncovered on the web. I am sure that they will
> uncover more widespread occurances during investigation. I suggest you take
> approriate action.
>
> Shawn McAllister
>

btw... I find it odd that you would even post here... lol

Lanceman · 03-12-2007, 08:08 PM

Quote:

Originally Posted by nation-x

I got this email from Sunbelt Software today

and I also got one back from the FBI informing me that they take my report seriously and will be investigating....

Great Maybe they can reimburse all of us!

Or better yet maybe they could get with this guy over on the "Anti Spyware Coilation Sign Up" Thread who claims to be the originator of spyware and pay him for a cure!

nation-x · 03-12-2007, 08:17 PM

In case you were interested... I downloaded a pdf of the report to the FBI... I am not going to make it public because it has my personal info in it but here is the report part...

Quote:

I am reporting a suspected international crime ring that is installing trojans on millions of pcs... The trojan
was initially identified by a Security Analyst at the University of Minnesota
http://lists.sans.org/pipermail/unis...er/026937.html
I have identified an install point... Here is the url to the alexa stats for this site.
http://alexa.com/data/details/traffi...m%2Fgoanal.php
I operate many softcore adult websites for a company based in Denmark in addition to being employed full
time as a programmer for an internet based adult service provider.
Recently it came to my attention that there was a rash of trojans being installed for the purpose of stealing
affiliate sales and spoofing websites by altering the victim pc to use the criminals dns servers. This is a
huge security risk for the victim and given the amount of traffic that the single install point that I identified
receives, I view it as a potentially serious national security issue as I believe the person behind this to be
Emil Kacpersky who I think owns Estdomains.com, InHosters.com and Intercage.com among other
companies. (I may be mistaken as I am no investigator). I have learned that these companies are believed
to be based in the Ukraine.
I don't really have any more information then that but this concerns me because I understand the amount
of money that these criminals are making from this endeavor is staggering and that millions of pcs may be
infected.

Quote:

Are there witnesses or other victims to this crime?
http://www.gofuckyourself.com/showthread.php?t=713306

Lanceman · 03-12-2007, 08:21 PM

Quote:

Originally Posted by nation-x

To Emil,
Thanks for taking the time to reply to this thread... I am glad I got the right name when I made the report to the FBI... you ARE Emil Kacpersky correct? I sent an email to [email protected] but I see the site is still live... as far as I know it's a crime to facilitate an international crime... you do know that disseminating viruses/trojans is a crime right?

Here is why we have a serious issue with Intercage... first of all... you host spammers, ppc cheaters, hackers, etc... wtf are you thinking? Btw... here is the email I sent you...

btw... I find it odd that you would even post here... lol

I also find that quite strange for some very good reasons:

1.This guy signed up today right before he started posting threads
2.How was he alerted of this discussion?

With those two out in the open Hmmmmmmmm?
I wonder who alerted him!

3.THE BIG PICTURE?

nation-x · 03-12-2007, 08:30 PM

if you don't think that these fuckers posts here then you are misguided... We swim with sharks...

HighSociety · 03-12-2007, 09:02 PM

Lets say someone does get caught with how I track them, Does anyone know if ccbill will give those sales to the right person? I wrote an email asking and they did not give me a clear answer

pornonada · 03-13-2007, 03:06 AM

Quote:

Originally Posted by made2ordervideos

Lets say someone does get caught with how I track them, Does anyone know if ccbill will give those sales to the right person? I wrote an email asking and they did not give me a clear answer

bump for an very interesting thread

nation-x · 03-13-2007, 04:23 AM

A member at another board I posted at provided this find:

from http://www.tunix.nl/index.php?s_cat=...loits_advisory

Quote:

Thirdly two netblocks can be blocked as well according to sources at SANS:
http://isc.sans.org/diary.php

InterCage Inc.: 69.50.160.0/19 (69.50.160.0 - 69.50.191.255)
Inhoster: 85.255.112.0/20 (85.255.112.0 - 85.255.127.255)

nation-x · 03-13-2007, 08:17 AM

bump this back to 1st page

Sneezy · 03-13-2007, 09:19 AM

Quote:

Originally Posted by RawAlex

At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

I would say that any fairly new videosharing site started late 2005 or early 2006 that have build up a lot of traffic in a short time by trading like crazy with well established sites may be suspicious if in anyway connected with ESTDOMAINS or the other suspects.

pornonada · 03-13-2007, 04:31 PM

Quote:

Originally Posted by Sneezy

I would say that any fairly new videosharing site started late 2005 or early 2006 that have build up a lot of traffic in a short time by trading like crazy with well established sites may be suspicious if in anyway connected with ESTDOMAINS or the other suspects.

are you talking about avicash? If so, than every tgp/mgp and generally adult webmaster should have blacklist immediatly ALL sites using them, at least that's what i have done and will do. If it's another company you are talking about please forward me somehow the info.

Lanceman · 03-13-2007, 05:20 PM

I hear microsoft is onto this codec exploit issue now!

AmateurFlix · 03-13-2007, 05:47 PM

Quote:

Originally Posted by Lanceman

I hear microsoft is onto this codec exploit issue now!

link?

it would be nice for them to do so, they really shouldn't allow something as significant as this trojan to be installed without noticeable warnings being issued by the OS first.

Quickdraw · 03-13-2007, 06:05 PM

Quote:

Originally Posted by RawAlex

At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

You mean our CWS friends at klikrevenue are suspect? Who woulda thunk it.. They still an advertiser here?

nation-x · 03-13-2007, 07:08 PM

I wonder why Emil never posted again :D

RawAlex · 03-13-2007, 08:58 PM

Quote:

Originally Posted by Quickdraw

You mean our CWS friends at klikrevenue are suspect? Who woulda thunk it.. They still an advertiser here?

I am sure there are honest people using ESTDOMAINS, but I think that having ESTDOMAINS as a registrar is one of those little flags that says "check this closely". This is especially important because these people register the domains, provide the hosting, and provide the connectivity to those hosts, with the clear intention of absorbing any negative comments, complaints, LARTs, or other notifications and not taking action. Basically, they control all three of the places that would get a DMCA notice. It's a nice touch.

It isn't a 100% sure thing that someone with ESTDOMAINS is going to be a scammer, but if you live next to a crack house, some people might think you like drugs, right?

Lanceman · 03-13-2007, 09:34 PM

Quote:

Originally Posted by RawAlex

I am sure there are honest people using ESTDOMAINS, but I think that having ESTDOMAINS as a registrar is one of those little flags that says "check this closely". This is especially important because these people register the domains, provide the hosting, and provide the connectivity to those hosts, with the clear intention of absorbing any negative comments, complaints, LARTs, or other notifications and not taking action. Basically, they control all three of the places that would get a DMCA notice. It's a nice touch.

It isn't a 100% sure thing that someone with ESTDOMAINS is going to be a scammer, but if you live next to a crack house, some people might think you like drugs, right?

Theres a very old saying "Show me your friends and I will show you what you are"!!!!!!!

RawAlex · 03-13-2007, 09:36 PM

Alternately, you lie down with dogs, and you will get fleas.

Lanceman · 03-13-2007, 10:11 PM

Microsoft Windows WMF exploits advisory

An update from Microsoft that fixes this vulnerabilty is now available:
http://www.microsoft.com/athome/secu...00601_WMF.mspx

A very serious vulnerability has been discovered in Microsoft Windows, for which exploits are found on the internet. It concerns issues with files that are interpreted by windows as .WMF files.

At this moment there is no patch from Microsoft. There are some workarounds for vulnerable systems that can be applied. More information on this issue can be found here:

urls:
http://www.security.nl/article/12594...F_exploit.html
http://secunia.com/advisories/18255/
http://isc.sans.org/diary.php
http://www.viruslist.com/en/alerts?alertid=176701669

Malicious files that can lead to an exploit can be both in e-mail attachments and on the internet on http servers.

The TUNIX/Firewall can help to avoid some risk in the following ways:

Firstly the Kaspersky virusscanner for email on TUNIX firewalls detects trojans that use this exploit, if the firewall uses a recent signature-database. It has been doing so since December 28th 2005.

Secondly a number of URLs have been identified that may contain malicious content. TUNIX recommends blacklisting the listed URLs on the TUNIX/Firewall. This can be accomplished using a simple URL blacklist.

At this moment the following URLs can be blocked:
m.cpa4.org
008k.com
mscracks.com
keygen.us
dailyfreepics.us
pornsites-reviews.com
mmxo.megaman-network.com
600pics.com
Crackz.ws
unionseek.com
www.tfcco.com
Iframeurl.biz
beehappyy.biz
Buytoolbar.biz
teens7.com

Thirdly two netblocks can be blocked as well according to sources at SANS:
http://isc.sans.org/diary.php

InterCage Inc.: 69.50.160.0/19 (69.50.160.0 - 69.50.191.255)
Inhoster: 85.255.112.0/20 (85.255.112.0 - 85.255.127.255)

This can also be implemented by http blocklists. It should be noted that blocking entire netblocks always carries the risk of blocking websites that should not be blocked.

Customers with a Managed Firewall (MF) contract, customers with a Remote Standby (RS) contract or customers with a Remote Maintenance (RB) contract can contact TUNIX Firewall Support to make the necessary adjustments to the configuration of TUNIX/txhttp or Tunix/http-gw to block this activity.

Lanceman · 03-14-2007, 04:39 AM

Quote:

Originally Posted by Jon Clark

When SurferBucks launches we will not except malicious traffic and will suspend any affiliate found to be using these methods... That is a PROMISE!

As far as offering a reward to those that report the issues, the only reward will be knowing you are helping clean up the community...

If we start offering incentives beyond that it will leave a gap for abuse of the system, the scammers will start reporting themselves to collect!

Im sure you have good intentions my only question is what will you do with all the sales that infected surfers computers have sent you and how will you delegate the rightful affiliate?
When this happens on a daily basis I beleive that this is where the problem starts for any sponsor!
When the thousands of redirected dollars start flowing in come on back and tell us who gets paid!
Better yet why dont you just send us a post card from the Islands

nation-x · 03-14-2007, 04:43 AM

Just for clarification... the trojan we are posting about isn't always delivered via an exploit... We have found multiple urls that are masking the trojan as a codec that users are voluntarily installing.

Lanceman · 03-14-2007, 05:24 AM

Quote:

Originally Posted by nation-x

Just for clarification... the trojan we are posting about isn't always delivered via an exploit... We have found multiple urls that are masking the trojan as a codec that users are voluntarily installing.

Hey please do me a favor go read this new thread of mine and tell me if you think Im infected or not!
It will explain My story.
I would give out the URL but I took it off line till I get this problem fixed!
Oh and by the way post replies on that thread not this one-thanks

http://www.gofuckyourself.com/showthread.php?t=714455

Theo · 03-14-2007, 06:13 AM

http://alexa.com/data/details/traffi...m%2Fgoanal.php

holy fuck

Lanceman · 03-14-2007, 06:45 AM

Quote:

Originally Posted by Soul_Rebel

http://alexa.com/data/details/traffi...m%2Fgoanal.php

holy fuck

yeah not bad for a site with only 10 thumbnails on it most of which look like diseased asian hookers huh?

Quickdraw · 03-14-2007, 07:36 AM

Quote:

Originally Posted by Soul_Rebel

http://alexa.com/data/details/traffi...m%2Fgoanal.php

holy fuck

I received a little bit different prompt than you, judging from the Google bar prompt you had. The 'video' just had sound and the link in the video goes to activexvideosoftware-dot-com/main/setup.exe
It appears that the guy that owns assisass.com owns roccomovies.net. Assisass.com has been spreading trojans for a very long time now

RawAlex · 03-14-2007, 08:49 AM

There are two types of codec-style exploits:

The one that microsoft mentions, which uses either a malformed wmv file or similar, which is a true security exploit, and the "you need a codec" sites that are using pure social engineering to get installed.

The social engineering approach is the hardest one to stop, because human nature is "install stuff to see video". It is the same reason why people foolishly install things like Zango. They think they are going to see a video or play a game. They don't realize that they will be installing a spyware piece of shit that is going to pop shit all over their screens when they surf. If they knew that, they would never do it.

The only reasons any of this stuff works is because programs are willing to pay money for the traffic generated from it. Pure economics says that if nobody was paying, nobody would do it.

Then again, Zango forced Lars to do it. I wonder how many other people have been forced?

Nysus · 03-14-2007, 09:18 AM

Quote:

Originally Posted by Xplicit

Just offer a reward of %10 of whatever the scammer had in his account.

- The sponsor wins because they got all those joins and only paid out %10.

- The person reporting the scammer wins by getting the guys affiliate account killed and %10.

Win/Win situation, and overall good for the industry.

So now cheating affiliates who couldn't get any of the money they stole, can now report themselves and get 10% of it; repeat process.

Lanceman · 03-14-2007, 10:00 AM

Quote:

Originally Posted by Nysus

So now cheating affiliates who couldn't get any of the money they stole, can now report themselves and get 10% of it; repeat process.

Exactly like I said before the only way to narrow this down to a dull roar is to get sponsors to spyware proof their content and non of them are standing up to say "Hey ya thats a good Idea"!

Why would they?

They are too busy drinking martinis at the Ritz Carlton.........With our would be sales.

pornonada · 03-15-2007, 06:21 PM

bump bump

webmasterchecks · 03-15-2007, 07:37 PM

I think some of the bigger programs care, but not enough to terminate the accounts due to the possible retribution (who wants those bastards to suddenly send traffic going to my domain, somewhere else?)

Docs a smart guy and makes some good points

Anybody with half a brain can make that stuff nearly undetectable, so any complaints made from tests don?t rise above the din of the normal everyday querks or fuckups

Lanceman · 03-15-2007, 07:39 PM

Well just sit back and whatch what happens next!

BabeHunter · 03-16-2007, 01:38 AM

We closed 2 affiliate accounts, that were doing this shit, we monitor our reffering urls pretty close, and caught them pretty fast.

right now we are waiting on ccbill, to send us the money that was held from those affiliates, so we could pay directly to those who were hit by this.

I think ccbill should provide all the info they have on ppl like this so we could act on our own aswell. (of course once they confirmed the issue)

Lanceman · 03-16-2007, 04:00 AM

Quote:

Originally Posted by BabeHunter

We closed 2 affiliate accounts, that were doing this shit, we monitor our reffering urls pretty close, and caught them pretty fast.

right now we are waiting on ccbill, to send us the money that was held from those affiliates, so we could pay directly to those who were hit by this.

I think ccbill should provide all the info they have on ppl like this so we could act on our own aswell. (of course once they confirmed the issue)

What company are you?

AmateurFlix · 03-16-2007, 11:29 AM

Quote:

Originally Posted by THEMASKEDRIDER

I think some of the bigger programs care, but not enough to terminate the accounts due to the possible retribution (who wants those bastards to suddenly send traffic going to my domain, somewhere else?)

Any program owner with even the least amount of sense would not consider that arguement. If they're capable of redirecting traffic at the join page they're more likely to redirect to a different program with a higher payout - without any provocation - than they are to redirect out of retribution.

Many join pages are very generic looking, the end user probably wouldn't notice he had been redirected to a different site until the last moment.

AmateurFlix · 03-16-2007, 11:32 AM

Quote:

Originally Posted by BabeHunter

We closed 2 affiliate accounts, that were doing this shit, we monitor our reffering urls pretty close, and caught them pretty fast.
...

I think ccbill should provide all the info they have on ppl like this so we could act on our own aswell. (of course once they confirmed the issue)

glad to hear paysites like yours are being proactive about this. I agree with you re: ccbill sharing information, in their defense they may be concerned about liability for slander though (which isn't to say that such information can't be quietly leaked to program owners).

AmateurFlix · 03-21-2007, 11:10 PM

WARNING - do NOT install any of these codecs - do NOT visit without good anti-virus protection

This TGP http://adultau.com/?id=1110&t=4 is linking this gallery http://coolbestporn.com/robin/330225868/1/?id=1110

which upon clicking one of the videos loads the page http://coolbestporn.com/robin/330225...53bXY=&id=1110 kasperky is warning of "Trojan.Win32.DNSChanger.ir" trying to auto-install
the affiliate link on that gallery is http://collegepartytime.com/ref/1004000/ so maybe the blockboostercash guys can identify him.

Here's another doing the same with a TCG gallery: http://porn-room.net/obedience/1619577015/1/?id=1110
affiliate link from that gallery: http://www.castingcouchteens.com/?wm...tbond&cf=&sub=

Same for http://teenporntop.com/harman/1312166799/1/?id=1110
affiliate link: http://www.tamedteens.com/go/596263/22/9/n/

http://porntimeguide.com/alphinias/1...021/1/?id=1110
affiliate link: http://armyofass.maniacpass.com/?id=rikki&pt=p

http://pornhelp.net/pheney/1107727492/1/?id=1110
affiliate link: http://teen-stop.com/?id=crossales

http://xxxadultgold.com/bo/616802479/1/?id=1110
affiliate link: http://secure.hardcoreteeniesex.com/...0:HCTS,0,0,0,/

There's a TON more. The http://adultau.com/?id=1110&t=4 appears to be getting all traffic clicked from http://www.free-nude-photo.org/ which signed up for a trade on my site using IP 64.22.82.232 @ 15:22 EST on 3/21/07 (in case anybody really feels like tracking down this fool).

I haven't reported these yet to the proper sponsors, just too damn late at night for me to screw with atm :P so if anybody feels like messaging the sponsors before I do tomorrow go right ahead...

V_RocKs · 03-22-2007, 02:32 AM

Quote:

Originally Posted by Quickdraw

I received a little bit different prompt than you, judging from the Google bar prompt you had. The 'video' just had sound and the link in the video goes to activexvideosoftware-dot-com/main/setup.exe
It appears that the guy that owns assisass.com owns roccomovies.net. Assisass.com has been spreading trojans for a very long time now

Yeah... I always wondered why Choker still accepts his traffic.

TTiger · 03-30-2007, 12:27 PM

ive witness this code changing shit live on my girlfriend PC, i was working on my blog then testing my sponsr links and all my afilliated code were changing to another code when i was clicking my links
ive start a post on traffic cash gold board ans still waiting a response..

here is a copy on my post on TCG

Quote:

im working on a new site right now (fetish psychology) i was testing my links and see that the code were changing my main affiliated code is folichon then when i click the banner ive insert in my blog it was redirtecting to ffacgo code so who's this ffacgo??
hewre is the hacked link
http://pleasebangmywife.com/?wm_login=ffacgo

so id like to knw whats happening here?
thank you

pornonada · 03-31-2007, 05:05 PM

bump for this thread which needs the attention of every webmaster and sponsor program!

Jel · 04-01-2007, 02:23 AM

Bump to page 1 - very interesting thread.

u-Bob · 04-01-2007, 03:41 AM

Quote:

Originally Posted by RawAlex

I think that having ESTDOMAINS as a registrar is one of those little flags that says "check this closely".

It's more like a big red warning light.

03-12-2007, 10:48 AM	#52
intercage Registered User Join Date: Mar 2007 Posts: 6	Pinging spywarequake.info [195.225.177.7] with 32 bytes of data: 20 104 ms 88 ms 88 ms 64.111.192.205 21 87 ms 90 ms 88 ms 66.230.128.91 22 92 ms 84 ms 86 ms 195.225.177.7 OrgName: ISPrime, Inc. OrgID: IPRM Address: 25 Broadway Address: 6th Floor, Suite #2 City: New York StateProv: NY PostalCode: 10004-1086 Country: US ReferralServer: rwhois://rwhois.isprime.net:4321/ __________________ SF Dedicated Servers / Co-Location / Transit Company: Intercage Inc. - Atrivo (Emil Kacperski) E-Mail: [email protected] Phone: 925-550-3947 / ICQ: 23531098

03-12-2007, 09:02 PM	#65
HighSociety Confirmed User Join Date: Jun 2005 Posts: 1,786	Lets say someone does get caught with how I track them, Does anyone know if ccbill will give those sales to the right person? I wrote an email asking and they did not give me a clear answer __________________ http://www.highsociety.com http://www.playgirl.com http://www.cheri.com Jonathan "JC" Maldini ICQ: 223 643

03-13-2007, 10:11 PM	#78
Lanceman So Fucking Banned Join Date: Mar 2007 Posts: 301	Microsoft Windows WMF exploits advisory An update from Microsoft that fixes this vulnerabilty is now available: http://www.microsoft.com/athome/secu...00601_WMF.mspx A very serious vulnerability has been discovered in Microsoft Windows, for which exploits are found on the internet. It concerns issues with files that are interpreted by windows as .WMF files. At this moment there is no patch from Microsoft. There are some workarounds for vulnerable systems that can be applied. More information on this issue can be found here: urls: http://www.security.nl/article/12594...F_exploit.html http://secunia.com/advisories/18255/ http://isc.sans.org/diary.php http://www.viruslist.com/en/alerts?alertid=176701669 Malicious files that can lead to an exploit can be both in e-mail attachments and on the internet on http servers. The TUNIX/Firewall can help to avoid some risk in the following ways: Firstly the Kaspersky virusscanner for email on TUNIX firewalls detects trojans that use this exploit, if the firewall uses a recent signature-database. It has been doing so since December 28th 2005. Secondly a number of URLs have been identified that may contain malicious content. TUNIX recommends blacklisting the listed URLs on the TUNIX/Firewall. This can be accomplished using a simple URL blacklist. At this moment the following URLs can be blocked: m.cpa4.org 008k.com mscracks.com keygen.us dailyfreepics.us pornsites-reviews.com mmxo.megaman-network.com 600pics.com Crackz.ws unionseek.com www.tfcco.com Iframeurl.biz beehappyy.biz Buytoolbar.biz teens7.com Thirdly two netblocks can be blocked as well according to sources at SANS: http://isc.sans.org/diary.php InterCage Inc.: 69.50.160.0/19 (69.50.160.0 - 69.50.191.255) Inhoster: 85.255.112.0/20 (85.255.112.0 - 85.255.127.255) This can also be implemented by http blocklists. It should be noted that blocking entire netblocks always carries the risk of blocking websites that should not be blocked. Customers with a Managed Firewall (MF) contract, customers with a Remote Standby (RS) contract or customers with a Remote Maintenance (RB) contract can contact TUNIX Firewall Support to make the necessary adjustments to the configuration of TUNIX/txhttp or Tunix/http-gw to block this activity. Last edited by Lanceman; 03-13-2007 at 10:12 PM..

03-15-2007, 06:21 PM	#88
pornonada Confirmed User Join Date: Oct 2005 Posts: 440	bump bump __________________ Biggest NOskim Network open for Trades/Linkexchanges 500+ Text, TGP, MGP and Link Sites for Trade! All Linkexchanges are autoapproved! Linkexchanges here - Traffic Trades Soon!

03-15-2007, 07:37 PM	#89
webmasterchecks Confirmed User Join Date: Oct 2006 Location: Phoenix Posts: 1,685	I think some of the bigger programs care, but not enough to terminate the accounts due to the possible retribution (who wants those bastards to suddenly send traffic going to my domain, somewhere else?) Docs a smart guy and makes some good points Anybody with half a brain can make that stuff nearly undetectable, so any complaints made from tests don?t rise above the din of the normal everyday querks or fuckups __________________ Webmasterchecks Affiliate Payments - fully compatible with nats/mpa3

03-12-2007, 07:00 PM	#57
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

03-12-2007, 08:30 PM	#64
nation-x Confirmed User Industry Role: Join Date: Mar 2004 Location: Rock Hill, SC Posts: 5,370	if you don't think that these fuckers posts here then you are misguided... We swim with sharks...

03-13-2007, 08:17 AM	#68
nation-x Confirmed User Industry Role: Join Date: Mar 2004 Location: Rock Hill, SC Posts: 5,370	bump this back to 1st page

03-13-2007, 05:20 PM	#71
Lanceman So Fucking Banned Join Date: Mar 2007 Posts: 301	I hear microsoft is onto this codec exploit issue now!

03-13-2007, 07:08 PM	#74
nation-x Confirmed User Industry Role: Join Date: Mar 2004 Location: Rock Hill, SC Posts: 5,370	I wonder why Emil never posted again :D

03-13-2007, 09:36 PM	#77
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Alternately, you lie down with dogs, and you will get fleas.

03-14-2007, 04:43 AM	#80
nation-x Confirmed User Industry Role: Join Date: Mar 2004 Location: Rock Hill, SC Posts: 5,370	Just for clarification... the trojan we are posting about isn't always delivered via an exploit... We have found multiple urls that are masking the trojan as a codec that users are voluntarily installing.

03-14-2007, 06:13 AM	#82
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	http://alexa.com/data/details/traffi...m%2Fgoanal.php holy fuck

03-14-2007, 08:49 AM	#85
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	There are two types of codec-style exploits: The one that microsoft mentions, which uses either a malformed wmv file or similar, which is a true security exploit, and the "you need a codec" sites that are using pure social engineering to get installed. The social engineering approach is the hardest one to stop, because human nature is "install stuff to see video". It is the same reason why people foolishly install things like Zango. They think they are going to see a video or play a game. They don't realize that they will be installing a spyware piece of shit that is going to pop shit all over their screens when they surf. If they knew that, they would never do it. The only reasons any of this stuff works is because programs are willing to pay money for the traffic generated from it. Pure economics says that if nobody was paying, nobody would do it. Then again, Zango forced Lars to do it. I wonder how many other people have been forced?

03-15-2007, 07:39 PM	#90
Lanceman So Fucking Banned Join Date: Mar 2007 Posts: 301	Well just sit back and whatch what happens next!

03-16-2007, 01:38 AM	#91
BabeHunter Webmaster Industry Role: Join Date: Oct 2001 Location: 2nd door on the left Posts: 4,063	We closed 2 affiliate accounts, that were doing this shit, we monitor our reffering urls pretty close, and caught them pretty fast. right now we are waiting on ccbill, to send us the money that was held from those affiliates, so we could pay directly to those who were hit by this. I think ccbill should provide all the info they have on ppl like this so we could act on our own aswell. (of course once they confirmed the issue) __________________ Yep

03-21-2007, 11:10 PM	#95
AmateurFlix Confirmed User Industry Role: Join Date: Jul 2004 Posts: 7,762	WARNING - do NOT install any of these codecs - do NOT visit without good anti-virus protection This TGP http://adultau.com/?id=1110&t=4 is linking this gallery http://coolbestporn.com/robin/330225868/1/?id=1110 which upon clicking one of the videos loads the page http://coolbestporn.com/robin/330225...53bXY=&id=1110 kasperky is warning of "Trojan.Win32.DNSChanger.ir" trying to auto-install the affiliate link on that gallery is http://collegepartytime.com/ref/1004000/ so maybe the blockboostercash guys can identify him. Here's another doing the same with a TCG gallery: http://porn-room.net/obedience/1619577015/1/?id=1110 affiliate link from that gallery: http://www.castingcouchteens.com/?wm...tbond&cf=&sub= Same for http://teenporntop.com/harman/1312166799/1/?id=1110 affiliate link: http://www.tamedteens.com/go/596263/22/9/n/ http://porntimeguide.com/alphinias/1...021/1/?id=1110 affiliate link: http://armyofass.maniacpass.com/?id=rikki&pt=p http://pornhelp.net/pheney/1107727492/1/?id=1110 affiliate link: http://teen-stop.com/?id=crossales http://xxxadultgold.com/bo/616802479/1/?id=1110 affiliate link: http://secure.hardcoreteeniesex.com/...0:HCTS,0,0,0,/ There's a TON more. The http://adultau.com/?id=1110&t=4 appears to be getting all traffic clicked from http://www.free-nude-photo.org/ which signed up for a trade on my site using IP 64.22.82.232 @ 15:22 EST on 3/21/07 (in case anybody really feels like tracking down this fool). I haven't reported these yet to the proper sponsors, just too damn late at night for me to screw with atm :P so if anybody feels like messaging the sponsors before I do tomorrow go right ahead... __________________

03-31-2007, 05:05 PM	#98
pornonada Confirmed User Join Date: Oct 2005 Posts: 440	bump for this thread which needs the attention of every webmaster and sponsor program! __________________ Biggest NOskim Network open for Trades/Linkexchanges 500+ Text, TGP, MGP and Link Sites for Trade! All Linkexchanges are autoapproved! Linkexchanges here - Traffic Trades Soon!

04-01-2007, 02:23 AM	#99
Jel Confirmed User Industry Role: Join Date: Feb 2007 Posts: 6,904	Bump to page 1 - very interesting thread.