Reward to who ever can find out more about this fuckface

**Fred Quimby** · 03-07-2005, 06:12 AM

Thanks for the interesting read this morning

**crockett** · 03-07-2005, 06:48 AM

ok guys if this guy is connected to 700k.com

I have some more info on him.. seems he is the guy I call the .biz cheater..

He seems to also be behind a good portion of the hit bot traffic hitting TGP's.. This guy's routine is to use a new domain every few days and signs up to shit loads of TGP's and hit bots the shit out of them.

his latest domains that I have found are

freshpussy.biz hosts the domains at Chinanet
pussyjuice.biz

however he has new domains all the time..

He used to redirect to teensexx.biz but now seems to be redirecting to 195.225.177.27/default.php?id=98809&c=tAZ1f1Pw13x02m2Q0eSc9i5U8UL 382B6 notice the 700k.com admin e-mail addy.. whois info on that IP http://www.whois.sc/195.225.177.27

This guy IMO is responsible for diluting a very large part of the TGP traffic out there with pure hit bot traffic.. as his hit bot goes straight through the affected site right to it's trades.

Would be great to find out who this asshole is and take his ass down. He is a big time problem IMO.

**ravo** · 03-07-2005, 07:11 AM

Yes, this is the same guy as 700k.com

**RawAlex** · 03-07-2005, 07:20 AM

Welcome to the first step before skim TGPs become worthless... mark the date on your agendas.

Alex

**crockett** · 03-07-2005, 07:33 AM

also when checking the above site on the IP I came up with the affiliate IP of "12089" for freepassbucks.com

and ID "paxan001" for realitycash.net

he also seems to be sending some clicked traffic to empgs.com whois info

which if you follows some of the links on that MGP you come up with the ID "extron" for cams.com wich links him back to the first sites.. so it seems empgs.com was where he was trying to launder his legit traffic through..

affilate links on empgs.com

cams.com aff ID = extron

xbang.com aff ID of 10000752 ??? (never heard of them but he has their galleries for eurocarsex.com, hugerackclub.com and milfscaughtoncamera.com

btw the trade link on empgs.com leads to http://www.gals-post.com/
whois info

which lists several other sites..
http://www.fanclips.com/ whois info cams.com aff ID "extron" confirmed on this one 8)
http://www.antmovies.com/ whois info
http://www.thehard.net/ whois info
http://www.galsteam.com/ whois info
http://www.oldmummy.com/ whois info

so anyone know who he is with this info? should be easy enough to figure him out with the given info

**crockett** · 03-07-2005, 07:49 AM

Just because I really want to fuck this ass hole over here are some more aff ID's Let's see some action from these program owners..

dollars4babes.com aff ID = 102483
icoonet.com aff ID = gallery link not sure what the ID is in that string.. "hotvideo" maybe?
smokinhd.com CCbill ID = 890017
adult.com ID = Mjc0OTo1OjEw gallery link

**Rui** · 03-07-2005, 07:55 AM

SmokeyTheBear - thx for the research you did on this subject m8!

**pradaboy** · 03-07-2005, 07:59 AM

bump so the aff. progs see this

**crockett** · 03-07-2005, 08:14 AM

I just did a reverse look up on his phone number in his whois.. seems it's a UPS store with post office boxes..

http://www.reversephonedirectory.com...r=212-964-5528

**RawAlex** · 03-07-2005, 08:31 AM

Curious: how is this different from spammers or toolbar people? Is there any reason for these programs to remove this guy, considering that if he makes sales, his traffic is good?

You guys have a problem with your tracking of your skimming... fix that instead :-)

Alex

**crockett** · 03-07-2005, 08:43 AM

Originally posted by RawAlex

Curious: how is this different from spammers or toolbar people? Is there any reason for these programs to remove this guy, considering that if he makes sales, his traffic is good?

You guys have a problem with your tracking of your skimming... fix that instead :-)

Alex

are you crazy? he is if nothing else stealing traffic from other affiliates by hitbotting their TGP sites. This asshole has screwed with a lot of people's traffic including my own.

If a program wont ban a guy like this then I wont promote that program. I think there are quite a few others that would say the same. This guy is one of the biggest cheats I've seen in the TGP game and he has been hitting my site with his hit bot sites for months.

**nojob** · 03-07-2005, 08:52 AM

go get him AFF!

**SmokeyTheBear** · 03-07-2005, 09:05 AM

Originally posted by crockett

are you crazy? he is if nothing else stealing traffic from other affiliates by hitbotting their TGP sites. This asshole has screwed with a lot of people's traffic including my own.

If a program wont ban a guy like this then I wont promote that program. I think there are quite a few others that would say the same. This guy is one of the biggest cheats I've seen in the TGP game and he has been hitting my site with his hit bot sites for months.

Good job doing the rest of the cleaning and work !!!!

Its the same guy all the way , and furthermore this guy has been screwing over tgp trades for YEARS.

This guy prey's on ADULT WEBMASTERS. not surfers ( well in a roundabout way he also preys on surfers )

**justsexxx** · 03-07-2005, 09:39 AM

Bump, curious what cams,aff etc will do

**crockett** · 03-07-2005, 09:50 AM

Here is a simple list of his affilate ID's listed on his sites..

TCG aff ID = scorp galery link
freepassbucks.com aff ID = 12089
realitycash.net aff ID = paxan001 (not lensmans realitycash.com)
cams.com aff ID = extron
dollars4babes.com aff ID = 102483
smokinhd.com CCbill ID = 890017
adult.com ID = Mjc0OTo1OjEw gallery link
icoonet.com aff ID = hotvideo gallery url
PornAccess.com aff ID = 12094
perfectgonzo.com aff ID = 283591
triplexcash.com aff ID = 105613
joinrightnow aff ID = extron
pornopayouts.com aff ID = pp11020
skintraffic.com aff ID = extron
socalcash.com aff ID = 2618 ?? gallery link to confirm
juicybucks.com aff ID = extron
adultlounge.com aff ID = 102319 ????gallery link to confirm

all of these links came from his site fanclips.com

**crackerboy** · 03-07-2005, 09:52 AM

damn thats a nice list very good work mate i hope all the sponsors on that list will see it and delete him of there programs if that is really him

**viki** · 03-07-2005, 09:56 AM

Originally posted by JFPdude

Administrative Contact:
Medvedeva, Ioulia [email protected]
8130 SW Beaverton-Hillsdale
Portland, OR 97225
US
8666400126

I know this is off-topic but it made me laugh a bit. The last name "Medvedeva" is a form of the word bear... so it's silly that Smokey The Bear dug up all the info.

**Twe Russ** · 03-07-2005, 09:58 AM

Originally posted by dvd316

probably Russian.. fuckin douchebag

Dont make a fucking remark like that unless your sure.

**DamageX** · 03-07-2005, 10:33 AM

Some disturbing facts in this thread. Digging deeper myself, I have a bad feeling about this...

**SmokeyTheBear** · 03-07-2005, 10:35 AM

Originally posted by DamageX

Some disturbing facts in this thread. Digging deeper myself, I have a bad feeling about this...

Yup me too . I have found some stuff i dont even wanna post here. ( YET )

**DamageX** · 03-07-2005, 10:41 AM

OK, in that AWI thread posted on page one of this thread, immortal76 comes forward and demands that his domains should bve removed from that cheater list, he only bought them two months earlier. The date of that post is 04-12-2004. Funny though, here's what the directnic whois says about that domain:

Record last updated 04-29-2003 01:01:51 PM
Record expires on 04-29-2005
Record created on 04-29-2003

Had the domain name changed owner, shouldn't there have been a note about the change?

**crockett** · 03-07-2005, 10:43 AM

smokey can you hit me on ICQ? 203838

**crackerboy** · 03-07-2005, 10:57 AM

damn smokey are you digging more? good work

**SmokeyTheBear** · 03-07-2005, 11:02 AM

Originally posted by DamageX

OK, in that AWI thread posted on page one of this thread, immortal76 comes forward and demands that his domains should bve removed from that cheater list, he only bought them two months earlier. The date of that post is 04-12-2004. Funny though, here's what the directnic whois says about that domain:

Record last updated 04-29-2003 01:01:51 PM
Record expires on 04-29-2005
Record created on 04-29-2003

Had the domain name changed owner, shouldn't there have been a note about the change?

I dont think thats him , but he got the domains from the guy who is the scammer , so he either knows him or knows of him.

**DamageX** · 03-07-2005, 11:35 AM

Originally posted by SmokeyTheBear

I dont think thats him , but he got the domains from the guy who is the scammer , so he either knows him or knows of him.

Well, he lied about the "two months earlier" so I'd say it's him.

**khs** · 03-07-2005, 01:20 PM

I can do reverse dns lookups on ips/domains for all domains on the boxes if you need it.

icq me
347-487-446

**DamageX** · 03-07-2005, 01:22 PM

So, anyone else being able to shed more light onto this?

**QuaWee** · 03-07-2005, 02:08 PM

yea, yea blame the RUSSIANS for everything, lol

**Steve** · 03-07-2005, 02:34 PM

I see domains that I trade with, or that trade with my top trades, all over this thread
not good

**imageman** · 03-07-2005, 02:54 PM

Good thread

Nice to see people helping each other out. Some useful info .

**ravo** · 03-07-2005, 03:37 PM

Originally posted by QuaWee

yea, yea blame the RUSSIANS for everything, lol

Well, *this* guy is Russian.

**stev0** · 03-07-2005, 04:04 PM

Any company affiliated with this guy should nuke his accounts and withhold his payments... I wouldn't want to be associated with this scamming fuck.

Report him to law enforcement, and sue him for damages... he needs a wake up call.

**jimmyf** · 03-07-2005, 04:26 PM

Originally posted by crockett

Here is a simple list of his affilate ID's listed on his sites..

TCG aff ID = scorp galery link
freepassbucks.com aff ID = 12089
realitycash.net aff ID = paxan001 (not lensmans realitycash.com)
cams.com aff ID = extron
dollars4babes.com aff ID = 102483
smokinhd.com CCbill ID = 890017
adult.com ID = Mjc0OTo1OjEw gallery link
icoonet.com aff ID = hotvideo gallery url
PornAccess.com aff ID = 12094
perfectgonzo.com aff ID = 283591
triplexcash.com aff ID = 105613
joinrightnow aff ID = extron
pornopayouts.com aff ID = pp11020
skintraffic.com aff ID = extron
socalcash.com aff ID = 2618 ?? gallery link to confirm
juicybucks.com aff ID = extron
adultlounge.com aff ID = 102319 ????gallery link to confirm

all of these links came from his site fanclips.com

perfectgonzo.com if I'm not **MIS-TAKEN** don't give a flying fuck, I get spam's from them every day

**jimmyf** · 03-07-2005, 04:27 PM

Originally posted by Twe Russ

Dont make a fucking remark like that unless your sure.

tracktraff.cc
Domain Name: TRACKTRAFF.CC
Registrar: TV CORPORATION
Whois Server: whois.www.tv
Referral URL: http://www.tv
Name Server: NS1.TRACKTRAFF.CC
Name Server: NS2.TRACKTRAFF.CC
Status: ACTIVE
Updated Date: 24-feb-2005
Creation Date: 24-feb-2005
Expiration Date: 24-feb-2006
Last update of whois database: Mon, 7 Mar 2005 20:00:18 EST
tracktraff.cc

Registrant:
Pavel Petroff ([email protected])

PO BOX 2176
Moscow, NONE 119992
RU
+7.5017000206

Domain Name: tracktraff.cc

Administrative, Technical, Billing Contact:
Pavel Petroff ([email protected])

PO BOX 2176
Moscow, NONE 119992
RU
+7.5017000206
Record created on Feb 24 2005.
Record expires on Feb 24 2006.
Domain servers:
ns1.tracktraff.cc
ns2.tracktraff.cc

------------------------------------------------------
700k.com

Registrant:
Invisible group
295 Greenwich str. #353, Spb/P
New York, NY 10007
US
+1.2129645528
Domain Name: 700K.COM
Administrative Contact:
WM, Paul [email protected]
295 Greenwich str. #353, Spb/P
New York, NY 10007
US
+1.2129645528
Technical Contact:
WM, Paul [email protected]
295 Greenwich str. #353, Spb/P
New York, NY 10007
US
+1.2129645528
Record expires on 04-23-2005
Record created on 04-23-2003
Domain servers in listed order:
NS1.YELLOW500.COM 81.3.164.1
NS2.YELLOW500.COM 217.146.192.22
----------------------------------------------------------------
Domain Name: GALSTEAM.COM

Registrant:
Invisible group
Paul ([email protected])
295 Greenwich st. #353, Spb/Pint #20
New York
NY,NY-10007
US
Tel. +1.2129645528
Creation Date: 17-Apr-2004
Expiration Date: 17-Apr-2005
Domain servers in listed order:
ns1.galsteam.com
ns2.galsteam.com
Administrative Contact:
Invisible group
Paul ([email protected])
295 Greenwich st. #353, Spb/Pint #20
New York
NY,NY-10007
US
Tel. +1.2129645528
Technical Contact:
Invisible group
Paul ([email protected])
295 Greenwich st. #353, Spb/Pint #20
New York
NY,NY-10007
US
Tel. +1.2129645528
Billing Contact:
Invisible group
Paul ([email protected])
295 Greenwich st. #353, Spb/Pint #20
New York
NY,NY-10007
US
Tel. +1.2129645528
--------------------------------------------------------------

**QuaWee** · 03-07-2005, 04:27 PM

Originally posted by ravo

Well, *this* guy is Russian.

just joking

**crackerboy** · 03-07-2005, 10:56 PM

well the mother fucker dont seem to care that we are after him beacuse he is still doing it to us 14 times this night when i was sleeping its a good thing my parnter is in a nother time zone

we are talking to the superviser from extremerack tomorrow and hope to god they can do something about this mother fucker

and still the tech claim nobody has been on the server but my partner was online at the same time as him deleteing the shit he did only to see that 2 sec later he rebuilt the site agian with his shit

what I find odd is that how can someone upload or edit the main page on the server, without leaving his IP in logs

we altso found out that he dosent only add a code he modifys all outgoing link to the thumbs

this is the real comus thumb link:
<a href="/ct/cx.php?i=3316&s=65&t=1">
<img src="/ct/thumbs/tn3316.jpg"
alt="http://www.nsgalleries.com/hosted1/jb/gals/avena2/index.php?id=102233" width="120" height="120"
class="stateoff" onmouseover="mo(this);
window.status='Rating=76.91 Votes=66603 Used=866 Age=17';
return true;"
onmouseout="mx(this);"
onclick="mc(this);" >

bad one:
<a onclick="doclick(this)" href="/ct/cx.php?i=3316&s=65&t=1">
<img src="/ct/thumbs/tn3316.jpg"
alt="http://www.nsgalleries.com/hosted1/jb/gals/avena2/index.php?id=102233" width="120" height="120"
class="stateoff" onmouseover="mo(this);
window.status='Rating=77.56 Votes=66162 Used=853 Age=17';
return true;"
onmouseout="mx(this);"
onclick="mc(this);" ></a></td><td>

doclick(this)" isn't supposed to be in the link!!!!!
that loads his code that he places on the site

<script>
clicks = 0;
function doclick(a) {
clicks++;
if(clicks hahahaha 2) a.href='http://www.tracktraff.cc/cnt/processor?reddevil';
}
</script>

So basicly he have a premade comus template that he simply uploads and rebuilds its not even halg the same as the one we use all the time so

So can somebody find him and kick the shit out of him?

**pradaboy** · 03-07-2005, 11:25 PM

bump so this mofo gets busted

**foxxx** · 03-07-2005, 11:48 PM

arent any of the sponsors lookin at this shit eh?

they'd have all his real info and anyone who wanted to could do something from there...

**crackerboy** · 03-07-2005, 11:51 PM

i hope they do beacuse like you sade all the info is there so now we can only hope they will close him down and that we can find how the fuck he is getting on our server

**toddler** · 03-07-2005, 11:52 PM

Nice digging folks, and a bump....

**juve20** · 03-07-2005, 11:58 PM

this has turned out to be quit an intresting read. well done guys.

tony

**crackerboy** · 03-07-2005, 11:59 PM

its going to be well done when we find the fucker and he is totaly out of bizz

**crackerboy** · 03-08-2005, 12:00 AM

this is fucking amazing he edited the site now agian god damn yea ha

**crackerboy** · 03-08-2005, 12:03 AM

did this happen to anybody else that is hosted at extremerack?
do there security suck or?

**V_RocKs** · 03-08-2005, 12:06 AM

Originally posted by crackerboy

however it must be a hack
our ssi atx code was replaced...an iframe is an iframe...but an ssi code is an ssi code
he cant do that with a exploid he needs acces to change that shit ftp, shell htacess
god knows

Doesn't need FTP, doesn't need SSH.. Doesn't even need 3-D matrix style hacking consols...

Code:

open (FILE,"$name_supplied_by_user_in_a_form");
or
include ("$name_supplied_by_user_in_a_form_or_link");

And the hacker has shell access...

**crackerboy** · 03-08-2005, 12:07 AM

but who the fuck can he get the pass agian after we changed it 5 times?

**V_RocKs** · 03-08-2005, 12:08 AM

Originally posted by crackerboy

did this happen to anybody else that is hosted at extremerack?
do there security suck or?

It has nothing to do with the hosting company and almost zero hosting companies will include securing your web apps (TM3, UCJ, AutoRank, etc..) in the price of the hosting package.

Try googling your software + ver # + 'exploit' and see what you come up with.

**V_RocKs** · 03-08-2005, 12:09 AM

Originally posted by crackerboy

but who the fuck can he get the pass agian after we changed it 5 times?

ONCE AGAIN.. HE DOESN"T GET IN THROUGH THE FRONT DOOR DIPSHIT...

What is your URL, I'll take a look.

**crackerboy** · 03-08-2005, 12:09 AM

doing it now

**crackerboy** · 03-08-2005, 12:10 AM

[QUOTE=V_RocKs]ONCE AGAIN.. HE DOESN"T GET IN THROUGH THE FRONT DOOR DIPSHIT...

DIPSHIT

Reward to who ever can find out more about this fuckface

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment