Hacker help, asap thanks

[RedMonkey]

Someone hacked into my GoDaddy account and changed all my domains under his account. GoDaddy tells me I have to dispute it with Wipo.org and they cant help me here he is:

Registrant: ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation Registered through: GoDaddy.com Domain Name: RACIALLYMOTIVATED.COM Created on: 28-Dec-02 Expires on: 28-Dec-03 Last Updated on: Administrative Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408 Technical Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408

The email point to a yahoo email
the only thing that comes up is this
http://profiles.yahoo.com/domain_public

Can Anybody help me?
167694994 Thanks

[aflex]

i use godaddy as my registrar, was your account / password easy to guess? fill us in that want to secure our domains

[KMR Stitch]

Got Keylogged?

[goBigtime]

RaciallyMotivated.com was your domain?

[goBigtime]

First thing to do is get get the last freeware version of tiny personal firewall (2.0.15) so you can keep them from getting back into your box.

Also suggest you get a hardware firewall as well.

Then reinstall your operating system from scratch.

[RedMonkey]

I have about 15-17 names in there my uN was some random numbers and my PW similar to others but not super easy they tell me they cant do anything? godaddy i mean

[SKULL]

always a good old Russian... hacking and fucking people up... do they teach these guys about ethics in Rusia?

[modF]

Fucked by a Russian? I don't believe it.

Someone else had a similar problem recently with about 10 domains using godaddy. I'll see if I can find it for you.

[SplitInfinity]

Want to catch him?

Heres a tip.

Compose an email in html with a 1x1 transparant pixel image
embedded inside the email. Make this pixel the first thing to load
but make sure it is hidden and fully transparant.

Next, MAKE SURE THIS IMAGE LOADS FROM YOUR WEB SERVER
not from the email itself. Also, make sure it has a GOOD name
that is unique so you can spot it later....

Now, keep an eye on your web servers logs... perhaps with:

tail -f /var/log/http/access_log | grep NameOfFileHere.gif

Or just scan through them looking for the image name.

The theory here is simple...
When the hacker checks his anon email account, the image loads in his browser
and the ip that shows up in the logs is his home computer if he isnt smart.

:-)

I have put 12 hackers in jail using that trick since 1997.

-Chris Jester-
SplitInfinity Web Hosting

Need security work done? Ring me. Or ICQ...

[Obie Trice]

You got cracked By Brutus no doubt

[wargames]

Originally posted by RedMonkey
Someone hacked into my GoDaddy account and changed all my domains under his account. GoDaddy tells me I have to dispute it with Wipo.org and they cant help me here he is:

Registrant: ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation Registered through: GoDaddy.com Domain Name: RACIALLYMOTIVATED.COM Created on: 28-Dec-02 Expires on: 28-Dec-03 Last Updated on: Administrative Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408 Technical Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408

The email point to a yahoo email
the only thing that comes up is this
http://profiles.yahoo.com/domain_public

Can Anybody help me?
167694994 Thanks

Thats fucked up

[goBigtime]

Originally posted by SplitInfinity
Want to catch him?

Heres a tip.
I have put 12 hackers in jail using that trick since 1997.

-Chris Jester-
SplitInfinity Web Hosting

Need security work done? Ring me. Or ICQ...

Slick one Chris


... I'm digging up some info on this guy as we speak. I have a feeling he is in the US.

[RedMonkey]

Originally posted by wargames


Thats fucked up

Who is Brutus?

[goBigtime]

....developing...

[p00p]

Originally posted by RedMonkey

Who is Brutus?

A beauty of a program. Still works great after all these years....

[TomsPics]

www.hoobie.net i think

[nobull]

If it is your name on the registration just transfer them from GoDaddy to a different company.... but all you should have to do is fax them your ID and your all set

[EZRhino]

Originally posted by SplitInfinity
Want to catch him?

Heres a tip.

Compose an email in html with a 1x1 transparant pixel image
embedded inside the email. Make this pixel the first thing to load
but make sure it is hidden and fully transparant.

Next, MAKE SURE THIS IMAGE LOADS FROM YOUR WEB SERVER
not from the email itself. Also, make sure it has a GOOD name
that is unique so you can spot it later....

Now, keep an eye on your web servers logs... perhaps with:

tail -f /var/log/http/access_log | grep NameOfFileHere.gif

Or just scan through them looking for the image name.

The theory here is simple...
When the hacker checks his anon email account, the image loads in his browser
and the ip that shows up in the logs is his home computer if he isnt smart.

:-)

I have put 12 hackers in jail using that trick since 1997.

-Chris Jester-
SplitInfinity Web Hosting

Need security work done? Ring me. Or ICQ...

I would go with Jester's idea asap.

[goBigtime]

Well heres the deal...

They guy ( [email protected] ) stole:

www.hackcab.com
www.boyeurism.com
www.crackcash.com
www.crackcash.net
www.innovativeadultmedia.com
www.raciallymotivated.com
www.stickyproductions.com
www.undermycontrol.com
www.wiggawhat.com

From RedMonkey - who lives in Philadelphia, PA 19149....


But awhile ago [email protected] was offering up Ouch.com for sale:

http://216.239.51.104/search?q=cache...hl=en&ie=UTF-8


Ouch.com is (now?) owned by:

John Berryhill
[email protected]
1601 market st
suite 720
Philadelphia, Pennsylvania 19103
United States


(About 20 minutes away from RedMonkey)


When investigating John Berryhill you find out he has a Ph.D.
and works for Dann, Dorfman, Herrell, & Skillman P.C. (ddhs.com)


http://www.johnberryhill.com/

He's into patent work apparently.


Anyway... there is a definite tie between John Berryhill & the person that stole those domains.

Either John Berryhill was the original owner of Ouch.com & got it back (through the legal means available to him)... or he purchased the domain from the crook.


It is a strange coincidence that the person whos domains were stolen is in PA & the person who now owns Ouch.com is in PA. But under the cirumstances, I'm betting that's all it is.

Unless... the crook is ALSO in PA possibly working for RedMonkey's ISP & sniffing/intercepting data....Hmm.

Anyway I'm done with this one. Call John Berryhill and ask him how he wound up with Ouch.com.

[foolio]

I love a good fight

[RedMonkey]

To anyone following this story:
I have found many alias' so far and an ebay account, he has all ready tried selling someone elses domain (OUCH.com) for 3K at http://www.dnforum.com, he is deff. not russian, the FBI (Internet), local, and a couple other online fraud investigators havent responded to me. GoDaddy or Ebay can care less avout helping me on his. I understand Ebay but I am holding GoDaddy responsible, they're saying I gave out my info. (All lost about 15-17 names total including my company name and names purchased the same day 8/5, they were are all changed.) This hacker makes a lving off of stealing and selling "our" domain names to people who buy them unknowingly which is the case in OUCH.com. I know many of this doesn't affect any of you but how safe is really all of our sites, how many man hours goes bend many of them. There is NO SECURITY at GODADDY, any one that supports me on the FUCK GODADDY campaign, thanks, that should be followed by the FUCK NS campaign, lol. Regardless, I ain't letting the hacker have my domains I spent too much time behind them as well as a couple $100's. I hope he ain't in Philly people get shot over less. FUCK GODADDY!