Was Netbilling Really Hacked? - GoFuckYourself.com

4kFU · 09-02-2005, 02:00 PM

I heard this through the grapevine and thought I would mention it here.

As some of you know, Netbilling was "hacked" a few months ago and the "hacker" only got access to email addresses and names.

Strange that the hacker didn't get any credit card numbers isn't it?

This "hacker" has been spamming email addresses used in transactions passed to Netbilling.

If you look at the sites the mailer is spamming, they are all .info and .biz domains hosted at 64.157.9.184

http://www.whois.sc/reverse-ip/64.157.9.184

Take a look at this IP and the domains hosted there.

There are 542 domains hosted on this IP. They are all .info and .biz domains.

Also, guess where this IP is located? Candidhosting.
http://www.whois.sc/reverse-ip/64.157.9.184

Candidhosting is hosting 542 .info and .biz domains that are constantly spammed and does nothing? Sounds strange?

It gets better.

Guess who controls the DNS for www.netbilling.com? Yep.

Candidhosting

www.netbilling.com
NS2.CANDIDHOSTING.COM 64.159.90.10
NS1.CANDIDHOSTING.COM 64.159.90.4

http://www.whois.sc/netbilling.com

So, a "hacker" hacks in to the Netbilling database and only takes names and email addresses but no credit card numbers, sets up a server right at Candidhosting and starts spamming away, while Netbilling and Candidhosting do nothing.

Sound about right?

spunkmaster · 09-02-2005, 02:12 PM

I doubt Mitch would do anything like this on purpose?

iBanker · 09-02-2005, 02:14 PM

Holy crap...

Well, speaking from my experiences with Mitch, I doubt there is any foul play going on. Stand up guy.

iBanker · 09-02-2005, 02:16 PM

Would be nice if you posted under your real nick....

4kFU · 09-02-2005, 02:23 PM

I am. This is my real nick.

NETbilling · 09-02-2005, 02:24 PM

Quote:

Originally Posted by 4kFU

I heard this through the grapevine and thought I would mention it here.

As some of you know, Netbilling was "hacked" a few months ago and the "hacker" only got access to email addresses and names.

Strange that the hacker didn't get any credit card numbers isn't it?

This "hacker" has been spamming email addresses used in transactions passed to Netbilling.

If you look at the sites the mailer is spamming, they are all .info and .biz domains hosted at 64.157.9.184

http://www.whois.sc/reverse-ip/64.157.9.184

Take a look at this IP and the domains hosted there.

There are 542 domains hosted on this IP. They are all .info and .biz domains.

Also, guess where this IP is located? Candidhosting.
http://www.whois.sc/reverse-ip/64.157.9.184

Candidhosting is hosting 542 .info and .biz domains that are constantly spammed and does nothing? Sounds strange?

It gets better.

Guess who controls the DNS for www.netbilling.com? Yep.

Candidhosting

www.netbilling.com
NS2.CANDIDHOSTING.COM 64.159.90.10
NS1.CANDIDHOSTING.COM 64.159.90.4

http://www.whois.sc/netbilling.com

So, a "hacker" hacks in to the Netbilling database and only takes names and email addresses but no credit card numbers, sets up a server right at Candidhosting and starts spamming away, while Netbilling and Candidhosting do nothing.

Sound about right?

You are suggesting something that is completely wrong. No credit card numbers were hacked whatsoever. Some emails and names were but that is all and it was fixed within minutes. I know nothing about where the spamming came from but will surely show this post to our network engineers and get back to this thread after they investigate. I assure you that we are completely honest and always have been since day.

Thanks for the heads up, Mitch

3piece chicken Dinner · 09-02-2005, 02:26 PM

I assume, it will be bumped by the real nick behind this in the next day or two when this drops off the first page like a hot rock.

I wish the anon's would stop with the potential drama thread their first post.

and if your not an anon, then and introduction as to who you are and what you do should be in order if you plan on posting drama in your first thread.

iBanker · 09-02-2005, 02:30 PM

And I'd be willnig to bet he actually does get back to us, unlike most

4kFU · 09-02-2005, 02:37 PM

Well, I'm sorry you don't like me making a 1st post Drama thread, but the facts are laid out on the table.

Sorry you don't like it.

Fetish · 09-02-2005, 02:40 PM

Quote:

Originally Posted by iBanker

And I'd be willnig to bet he actually does get back to us, unlike most

Mitch and his group are the most stand up bunch I have ever met in this industry. You know he will get down to the bottom of this.

iBanker · 09-02-2005, 02:41 PM

Quote:

Originally Posted by 4kFU

Well, I'm sorry you don't like me making a 1st post Drama thread, but the facts are laid out on the table.

Sorry you don't like it.

It would be nice if you told us who you were at least .

4kFU · 09-02-2005, 02:43 PM

Just someone who is sick of SPAM.

Sammy4u · 09-02-2005, 02:48 PM

Quote:

Originally Posted by Fetish

Mitch and his group are the most stand up bunch I have ever met in this industry. You know he will get down to the bottom of this.

Exactly. Mitch and Sarah are very honest and wouldn't do anything to jeopardize everything they have worked so hard building, including their outstanding reputation in this industry.

4kFU · 09-02-2005, 02:51 PM

Yes, Yes...Mitch is great etc. etc.

If thats the case, the spammer is right under their nose, could even be a server right next to theirs, or a provider and nothing has been done.

Bottom line, something is fishy here.

mlj · 09-02-2005, 02:51 PM

Quote:

Originally Posted by NetBilling

Some emails and names were but that is all and it was fixed within minutes.

so Netbilling did get hacked? yikes.

frankfortuna · 09-02-2005, 03:07 PM

Quote:

Originally Posted by mlj

so Netbilling did get hacked? yikes.

We're a customer and I'm disappointed that I had to hear about this through a message board.

AlienQ - BANNED FOR LIFE · 09-02-2005, 03:12 PM

Quote:

Originally Posted by 4kFU

Well, I'm sorry you don't like me making a 1st post Drama thread, but the facts are laid out on the table.

Sorry you don't like it.

What the fuck does a webmaster from "Portland Oregon" fucking know...

God damn idiots.

Questioning Mitches ( Netbilling ) integrity is just fucking stupid. I hope that is not what I am reading.

Netbilling is an incredibly honest outfit, there really is not a bad bone in this guys body I have known him since day one.

Inferring a conspiracy is completely out of line.

If anything Netbilling is a victim of cybercrime if the email addresses were compromised.

4kFU · 09-02-2005, 03:16 PM

Quote:

Originally Posted by AlienQ

If anything Netbilling is a victim of cybercrime if the email addresses were compromised.

There is no question of "IF" AlienQ, as Mitch stated above, they were "hacked".

You're correct, Mitch could be a victim.

If that's the case, the spammer has some balls setting up shop right next to Netbilling right in the same datacenter, don't you think?

iBanker · 09-02-2005, 03:20 PM

Quote:

Originally Posted by frankfortuna

We're a customer and I'm disappointed that I had to hear about this through a message board.

Same here a bit...

iBanker · 09-02-2005, 03:21 PM

Quote:

Originally Posted by AlienQ

What the fuck does a webmaster from "Portland Oregon" fucking know...

God damn idiots.

Questioning Mitches ( Netbilling ) integrity is just fucking stupid. I hope that is not what I am reading.

Netbilling is an incredibly honest outfit, there really is not a bad bone in this guys body I have known him since day one.

Inferring a conspiracy is completely out of line.

If anything Netbilling is a victim of cybercrime if the email addresses were compromised.

Note to self. Mark this day.

I agree with AlienQ for the first time ever on something.

NETbilling · 09-02-2005, 04:34 PM

Quote:

Originally Posted by frankfortuna

We're a customer and I'm disappointed that I had to hear about this through a message board.

Customers that were effected were notified. There were only a few and it only lasted a few minutes. It was email addreses and some names only. No sensitive casrd or trasaction data whatsoever.

So you are aware, we employee some of the best securrity experts and engineers in the industry just as some of the other top gateways and #PP do. All of us are under regular attempted attacks from malicious hackers and do a tremendous job keeping them away. This was the first time in 7 years that anything got leaked and it is a great record.

Mitch

Rexk · 09-02-2005, 04:52 PM

I'll go to battle with Mitch anyday....great company...knows all of his customers personally..If he did get hacked...we should support him instead of criticize him...I get hacked 6 times a day by password traders....happens all the time

4kFU · 09-02-2005, 04:55 PM

How come noone knew that the hacker/spammer was hosted at Candid?

It's clear as day if you just look at the emails.

How come nothing has been done?

Advanced Intellect · 09-02-2005, 04:59 PM

Interesting.

Thanks Mitch.

frankfortuna · 09-02-2005, 05:02 PM

Quote:

Originally Posted by NetBilling

Customers that were effected were notified. There were only a few and it only lasted a few minutes. It was email addreses and some names only. No sensitive casrd or trasaction data whatsoever.

So you are aware, we employee some of the best securrity experts and engineers in the industry just as some of the other top gateways and #PP do. All of us are under regular attempted attacks from malicious hackers and do a tremendous job keeping them away. This was the first time in 7 years that anything got leaked and it is a great record.

Mitch

Thanks for the clarification, I'm sorry that it happened, but I'm glad it was an isolated incident.

Incidentally, I'm not sure if I've just not had the opportunity to deal with him in the past, or perhaps he is new, but Andy is a great support resource over there. He's in the process of assisting us with a a change on your end to enhance the way we use your API, which is beyond what I expected.

NETbilling · 09-02-2005, 05:07 PM

Quote:

Originally Posted by frankfortuna

Thanks for the clarification, I'm sorry that it happened, but I'm glad it was an isolated incident.

Incidentally, I'm not sure if I've just not had the opportunity to deal with him in the past, or perhaps he is new, but Andy is a great support resource over there. He's in the process of assisting us with a a change on your end to enhance the way we use your API, which is beyond what I expected.

Thank you for the kind words. Andy is a great guy and a great addition to our tech team.

Mitch

NETbilling · 09-02-2005, 05:10 PM

Quote:

Originally Posted by 4kFU

How come noone knew that the hacker/spammer was hosted at Candid?

It's clear as day if you just look at the emails.

How come nothing has been done?

Casn you forward me one or more of the emails please?

[email protected]

Thank you

4kFU · 09-02-2005, 05:39 PM

Mitch,

All links in the emails point back to the following:

-------------
Reverse IP: Web server hosts 542 websites
IP Address: 64.157.9.184
IP Location: - New Jersey - Newark - Candidhosting Inc
-------------

There are many sites, all .info and .biz domains.

If Candid is honest, you can easily track them down.

Goodluck.

NETbilling · 09-02-2005, 05:47 PM

Quote:

Originally Posted by 4kFU

Mitch,

All links in the emails point back to the following:

-------------
Reverse IP: Web server hosts 542 websites
IP Address: 64.157.9.184
IP Location: - New Jersey - Newark - Candidhosting Inc
-------------

There are many sites, all .info and .biz domains.

If Candid is honest, you can easily track them down.

Goodluck.

Do you actually have any of the emails?

Mitch

4kFU · 09-02-2005, 06:03 PM

Of course, I've been getting them for months now, every single day.

I told you the links that they point to, its up to you if you want to act on it or not.

Fetish · 09-02-2005, 06:51 PM

Quote:

Originally Posted by 4kFU

Of course, I've been getting them for months now, every single day.

I told you the links that they point to, its up to you if you want to act on it or not.

It seems you came here just to bash Netbilling. Your intentions are pretty obvious. If you are truly concerned you should forward some of the emails that you received to mitch as he requested.

4kFU · 09-02-2005, 06:58 PM

Again, the proof is there and Mitch knows whats up.

Failing to act says a lot.

3piece chicken Dinner · 09-02-2005, 06:58 PM

This will never happen, as this person is here to start shit, not solve it.
It is obvious. Otherwise, this person who is so tired of spam would have picked up the phone and called netbilling and advised them of this situation instead of coming to GFY for the very "first" time and posting this.

Send the man a few emails complete with headers, and give him a few days. If you are right you have saved the day and I am sure Netbilling would be very thankful.

Shoehorn! · 09-02-2005, 09:00 PM

This is the first I've heard about this as well, but from my experiences NetBilling is a great company and I trust them.

09-02-2005, 02:00 PM	#1
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Was Netbilling Really Hacked? I heard this through the grapevine and thought I would mention it here. As some of you know, Netbilling was "hacked" a few months ago and the "hacker" only got access to email addresses and names. Strange that the hacker didn't get any credit card numbers isn't it? This "hacker" has been spamming email addresses used in transactions passed to Netbilling. If you look at the sites the mailer is spamming, they are all .info and .biz domains hosted at 64.157.9.184 http://www.whois.sc/reverse-ip/64.157.9.184 Take a look at this IP and the domains hosted there. There are 542 domains hosted on this IP. They are all .info and .biz domains. Also, guess where this IP is located? Candidhosting. http://www.whois.sc/reverse-ip/64.157.9.184 Candidhosting is hosting 542 .info and .biz domains that are constantly spammed and does nothing? Sounds strange? It gets better. Guess who controls the DNS for www.netbilling.com? Yep. Candidhosting www.netbilling.com NS2.CANDIDHOSTING.COM 64.159.90.10 NS1.CANDIDHOSTING.COM 64.159.90.4 http://www.whois.sc/netbilling.com So, a "hacker" hacks in to the Netbilling database and only takes names and email addresses but no credit card numbers, sets up a server right at Candidhosting and starts spamming away, while Netbilling and Candidhosting do nothing. Sound about right?

09-02-2005, 02:12 PM	#2
spunkmaster Confirmed User Join Date: Jan 2004 Posts: 2,052	I doubt Mitch would do anything like this on purpose? __________________

09-02-2005, 02:14 PM	#3
iBanker Confirmed User Join Date: Dec 2004 Location: San Diego, moving to Portland. Posts: 2,758	Holy crap... Well, speaking from my experiences with Mitch, I doubt there is any foul play going on. Stand up guy. __________________ www.JasonandAlex.com Christopher's ICQ: 268-843-170

09-02-2005, 02:16 PM	#4
iBanker Confirmed User Join Date: Dec 2004 Location: San Diego, moving to Portland. Posts: 2,758	Would be nice if you posted under your real nick.... __________________ www.JasonandAlex.com Christopher's ICQ: 268-843-170

09-02-2005, 02:26 PM	#7
3piece chicken Dinner Confirmed User Join Date: Jan 2005 Location: On your plate Posts: 1,065	I assume, it will be bumped by the real nick behind this in the next day or two when this drops off the first page like a hot rock. I wish the anon's would stop with the potential drama thread their first post. and if your not an anon, then and introduction as to who you are and what you do should be in order if you plan on posting drama in your first thread. __________________ "We are told to let our light shine, and if it does, we won't need to tell anybody it does. Lighthouses don't fire cannons to call attention to their shining- they just shine."

09-02-2005, 02:23 PM	#5
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	I am. This is my real nick.

09-02-2005, 02:30 PM	#8
iBanker Confirmed User Join Date: Dec 2004 Location: San Diego, moving to Portland. Posts: 2,758	And I'd be willnig to bet he actually does get back to us, unlike most __________________ www.JasonandAlex.com Christopher's ICQ: 268-843-170

09-02-2005, 02:37 PM	#9
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Well, I'm sorry you don't like me making a 1st post Drama thread, but the facts are laid out on the table. Sorry you don't like it.

09-02-2005, 02:43 PM	#12
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Just someone who is sick of SPAM.

09-02-2005, 02:51 PM	#14
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Yes, Yes...Mitch is great etc. etc. If thats the case, the spammer is right under their nose, could even be a server right next to theirs, or a provider and nothing has been done. Bottom line, something is fishy here.

09-02-2005, 04:52 PM	#22
Rexk Confirmed User Join Date: Jul 2003 Location: San Diego Posts: 704	I'll go to battle with Mitch anyday....great company...knows all of his customers personally..If he did get hacked...we should support him instead of criticize him...I get hacked 6 times a day by password traders....happens all the time __________________

09-02-2005, 04:55 PM	#23
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	How come noone knew that the hacker/spammer was hosted at Candid? It's clear as day if you just look at the emails. How come nothing has been done?

09-02-2005, 04:59 PM	#24
Advanced Intellect Confirmed User Join Date: Jan 2005 Posts: 118	Interesting. Thanks Mitch. Last edited by Advanced Intellect; 09-02-2005 at 05:01 PM..

09-02-2005, 05:39 PM	#28
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Mitch, All links in the emails point back to the following: ------------- Reverse IP: Web server hosts 542 websites IP Address: 64.157.9.184 IP Location: - New Jersey - Newark - Candidhosting Inc ------------- There are many sites, all .info and .biz domains. If Candid is honest, you can easily track them down. Goodluck.

09-02-2005, 06:03 PM	#30
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Of course, I've been getting them for months now, every single day. I told you the links that they point to, its up to you if you want to act on it or not.

09-02-2005, 06:58 PM	#32
4kFU Registered User Join Date: Sep 2005 Location: Portland, OR Posts: 10	Again, the proof is there and Mitch knows whats up. Failing to act says a lot.

09-02-2005, 09:00 PM	#34
Shoehorn! Die With Your Boots On Join Date: Oct 2003 Location: Hawaii Posts: 22,872	This is the first I've heard about this as well, but from my experiences NetBilling is a great company and I trust them. __________________