GFY detectives.... I need your help.

**seeandsee** · 06-25-2011, 10:21 AM

maybe they do this like team

j/k but interesting, somebody must know what is going on

**GAMEFINEST** · 06-25-2011, 10:26 AM

Thats confusing

**DWB** · 06-25-2011, 10:27 AM

Originally posted by seeandsee

maybe they do this like team

Probably both owned by Manwin.

**NetHorse** · 06-25-2011, 10:34 AM

Originally posted by seeandsee

maybe they do this like a team

As much as that would suck for the OP that would be hilarious.

OP, I get the same thing as you doing a reverse IP look-up..

218.129.120.174.in-addr.arpa name = da.81.78ae.static.theplanet.com

Then I did a TR, here it is..

**Barry-xlovecam** · 06-25-2011, 10:37 AM

Name Servers:
jay.ns.cloudflare.com
jean.ns.cloudflare.com

Sat Jun 25 14:34:55 2011
Change Packet Size: 0
Size Range: 28-4470, < 0:random.
Host Loss% Snt Last Avg Best Wrst StDev
1. ************ 0.0% 101 30.6 34.5 10.5 402.7 57.1
2. **************** 0.0% 101 10.9 10.4 8.6 29.0 3.1
3. 68.87.190.77 0.0% 101 16.9 16.4 13.4 28.4 1.9
4. 68.85.222.38 0.0% 101 15.7 15.9 12.4 30.5 2.4
5. 68.86.90.109 1.0% 101 27.1 26.7 24.8 46.5 2.3
6. 68.86.87.250 0.0% 101 25.9 27.6 24.9 61.9 4.8
7. 208.178.58.61 0.0% 100 25.2 35.0 24.9 201.4 27.2
8. 69.31.110.229 0.0% 100 28.7 28.3 26.1 32.6 1.3
9. 69.31.111.242 0.0% 100 33.6 30.5 26.2 61.2 5.3
10. 69.31.111.238 0.0% 100 30.1 27.4 25.0 43.6 2.5
11. 199.27.135.76 0.0% 100 26.7 27.2 24.9 47.0 4.0

http://whois.arin.net/rest/poc/ABUSE2916-ARIN

**marketsmart** · 06-25-2011, 10:46 AM

Originally posted by DWB

Probably both owned by Manwin.

after looking at this for a bit, i am going to say that this guy is either using a redirect of some sort so it appears that the site is located at cloudfare when it is actually located at the planet.

at first i thought that cloudfare might be a dummy host set up but after digging around many of their dns servers, the sites they host are way to broad for that to be the case..

.

**marketsmart** · 06-25-2011, 10:51 AM

From this, it looks like asianwench is hosted at cloudfare..

http://www.robtex.com/ip/174.120.129.218.html

http://www.robtex.com/ip/199.27.134.76.html

but then look at direct-connect.asianwench.com

it is hosted at planet...

what do i win?

.

**DWB** · 06-25-2011, 10:59 AM

Originally posted by Barry-xlovecam

Name Servers:
jay.ns.cloudflare.com
jean.ns.cloudflare.com

Sat Jun 25 14:34:55 2011
Change Packet Size: 0
Size Range: 28-4470, < 0:random.
Host Loss% Snt Last Avg Best Wrst StDev
1. ************ 0.0% 101 30.6 34.5 10.5 402.7 57.1
2. **************** 0.0% 101 10.9 10.4 8.6 29.0 3.1
3. 68.87.190.77 0.0% 101 16.9 16.4 13.4 28.4 1.9
4. 68.85.222.38 0.0% 101 15.7 15.9 12.4 30.5 2.4
5. 68.86.90.109 1.0% 101 27.1 26.7 24.8 46.5 2.3
6. 68.86.87.250 0.0% 101 25.9 27.6 24.9 61.9 4.8
7. 208.178.58.61 0.0% 100 25.2 35.0 24.9 201.4 27.2
8. 69.31.110.229 0.0% 100 28.7 28.3 26.1 32.6 1.3
9. 69.31.111.242 0.0% 100 33.6 30.5 26.2 61.2 5.3
10. 69.31.111.238 0.0% 100 30.1 27.4 25.0 43.6 2.5
11. 199.27.135.76 0.0% 100 26.7 27.2 24.9 47.0 4.0

http://whois.arin.net/rest/poc/ABUSE2916-ARIN

Right! Any idea why cloudflare would send me to theplanet.com?

There's some confusion here because our IPs show because we act as a
reverse proxy (digs or nslookups will reflect our IPs). The IP address
of the site's server, however, hasn't changed & it is located at IP
174.120.129.218.

That makes my head spin.

**RycEric** · 06-25-2011, 11:07 AM

FYI - They are being served next week so we'll let them explain it.

**DWB** · 06-25-2011, 11:14 AM

Originally posted by RycEric

FYI - They are being served next week so we'll let them explain it.

That's what I'm talking about.

Just sent you an e-love letter.

**digitaldivas** · 06-25-2011, 12:41 PM

Originally posted by RycEric

FYI - They are being served next week so we'll let them explain it.

Hell yeah! Hit 'em in the nuts!

**Bladewire** · 06-25-2011, 01:06 PM

a bit more info

**Brujah** · 06-25-2011, 01:20 PM

Cloudflare is a CDN, sort of, not an actual host. ThePlanet is the host.

**Captain Kawaii** · 06-25-2011, 01:21 PM

I'm naming my first born, Eric!

**Brujah** · 06-25-2011, 01:26 PM

174.120.129.218 = Hostgator.com
Hostgator's servers are with ThePlanet

**RycEric** · 06-25-2011, 01:49 PM

Originally posted by Brujah

Cloudflare is a CDN, sort of, not an actual host. ThePlanet is the host.

Indeed. As DWB pointed out though they have no real sense of 'giving a shit' which needs to be remedied. They could've shut the dns caching service off... but continue to let him run with it. Thus, they can be held contributory as well.. confirmed by copyright counsel before I even screwed with it.

**DWB** · 06-25-2011, 01:53 PM

Originally posted by Brujah

Cloudflare is a CDN, sort of, not an actual host. ThePlanet is the host.

Yup.

ThePlanet.com totally denies it and sends me back to CloudFlare, who in turn sends me back to ThePlanet.

**DWB** · 06-25-2011, 02:07 PM

Originally posted by Brujah

174.120.129.218 = Hostgator.com
Hostgator's servers are with ThePlanet

Nada. Host Gator says no go.

**halfpint** · 06-25-2011, 02:12 PM

Oh the hackers love Cloudflare They like hosting thier sites with them

**Barry-xlovecam** · 06-25-2011, 02:13 PM

(Request-Line) GET / HTTP/1.1

Host asianwench.com

User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language en-us,en;q=0.5

Accept-Encoding gzip, deflate

Accept-Charset ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive 115

DNT 1

Connection keep-alive

Referer http://gfy.com/showthread.php?t=1027944

Cookie __cfduid=db09e9af9f6676a050a421a40af35e23a13090391 80; __utma=119040409.1038048610.1309039231.1309039231. 1309039231.1; __utmb=119040409.1.10.1309039231; __utmc=119040409; __utmz=119040409.1309039231.1.1.utmcsr=gfy.com|utm ccn=(referral)|utmcmd=referral|utmcct=/showthread.php; __qca=P0-305264067-1309039231391

Cache-Control max-age=0

=====

(Status-Line) HTTP/1.1 200 OK

Server cloudflare-nginx

Date Sat, 25 Jun 2011 22:00:01 GMT

Content-Type text/html; charset=UTF-8

Transfer-Encoding chunked

Connection keep-alive

X-CF-Powered-By WP 1.1.6

X-Pingback http://asianwench.com/xmlrpc.php

Vary User-Agent,Accept-Encoding

Content-Encoding gzip

=====

They have no traffic registering with Google ...
http://trends.google.com/websites?q=...ate=all&sort=0

**Brujah** · 06-25-2011, 02:14 PM

Originally posted by DWB

Nada. Host Gator says no go.

Really? http://174.120.129.218

171 domains hosted on IP address 174.120.129.218
Most using Hostgator DNS.

**marketsmart** · 06-25-2011, 02:15 PM

Originally posted by DWB

Nada. Host Gator says no go.

i think hostgator is confused. if you go to direct-connect.asianwench.com

you get a HG 404..

i have a feeling what this guy is doing and my money is that the content is sitting on that HG box...

.

**halfpint** · 06-25-2011, 02:18 PM

check where the luzsec site is hosted

That is why they use it

DNS1: may.ns.cloudflare.com
DNS2: rob.ns.cloudflare.com

**Brujah** · 06-25-2011, 02:18 PM

Originally posted by RycEric

Indeed. As DWB pointed out though they have no real sense of 'giving a shit' which needs to be remedied. They could've shut the dns caching service off... but continue to let him run with it. Thus, they can be held contributory as well.. confirmed by copyright counsel before I even screwed with it.

Good luck with that. Maybe you'll get lucky and find some success trying to DMCA DNS providers now instead of hosts.

If it works, you don't have to bother with the hosts anymore, just hit whoever provides a DNS service. Have you tried the registrar?

**Zverka** · 06-25-2011, 02:22 PM

Originally posted by Squirtit

a bit more info

yep the are at hostgator

look at ASIANWENCH.COM DNS RECORDS

http://mail.asianwench.com/

hostagator servrs are at theplanet

**lagcam** · 06-25-2011, 02:28 PM

Good job bringing it here DWB, but I wouldn't be surprised if the guy claiming to be asianwench in the other place is not the actual site owner but somebody caught up in all this Philippines "he said she said" comedy bullshit they have there.....

**DWB** · 06-25-2011, 02:35 PM

Originally posted by lagcam

Good job bringing it here DWB, but I wouldn't be surprised if the guy claiming to be asianwench in the other place is not the actual site owner but somebody caught up in all this Philippines "he said she said" comedy bullshit they have there.....

Yea, some of those cats are in a world of their own.

I'm just trying to pin point where the site is. I've never had this happen before. Very clever and a total pain in the ass. I'd expect more from US based companies.

**DWB** · 06-25-2011, 02:37 PM

Originally posted by Zverka

yep the are at hostgator

look at ASIANWENCH.COM DNS RECORDS

http://mail.asianwench.com/

hostagator servrs are at theplanet

404s right to Host Gator, yet they say its not with them either.

I spoke to their tech, now I'm waiting to hear back from "abuse@" to confirm it's not there, but the tech said he couldn't find it and suggested I mail abuse.

**Brujah** · 06-25-2011, 02:49 PM

Originally posted by DWB

Yea, some of those cats are in a world of their own.

I'm just trying to pin point where the site is. I've never had this happen before. Very clever and a total pain in the ass. I'd expect more from US based companies.

Definitely with Hostgator, and I'm guessing the most likely conclusion to take away from this isn't that anyone's trying to hide it from you, but that the techs you've spoken with at Planet or Hostgator just aren't very good and it's confusing them because of the DNS. The only one that's given you accurate information here was probably more knowledgable of the bunch, and that being Cloudflare.

**RycEric** · 06-25-2011, 02:50 PM

Originally posted by Brujah

Good luck with that. Maybe you'll get lucky and find some success trying to DMCA DNS providers now instead of hosts.

If it works, you don't have to bother with the hosts anymore, just hit whoever provides a DNS service. Have you tried the registrar?

Thanks Esq...

**Captain Kawaii** · 06-25-2011, 02:53 PM

With HG you gotta bump it up to Level 3...Tell them to. Serious issue. Then a brain steps in...
They also have an email that goes direct to owner of HG. Ask them for it.

DWB, I believe you were speaking with the douche last night here. New member, June 2011.
I may be wrong but I believe its same guy at foo...

**barcodes** · 06-25-2011, 03:11 PM

**Zverka** · 06-25-2011, 03:12 PM

you should be abble to cut it directly at cludflare according
theirs terms http://www.cloudflare.com/terms.html
SECTION 11: PROHIBITED USES

**marketsmart** · 06-25-2011, 03:13 PM

Originally posted by DWB

404s right to Host Gator, yet they say its not with them either.

I spoke to their tech, now I'm waiting to hear back from "abuse@" to confirm it's not there, but the tech said he couldn't find it and suggested I mail abuse.

i told you 3 times in this thread already..

direct-connect.asianwench.com

thats what is sitting on the HG ip...

ask them to see if that subdomain has a folder on the HG server..

.

**Brujah** · 06-25-2011, 03:26 PM

Originally posted by marketsmart

i told you 3 times in this thread already..

direct-connect.asianwench.com

thats what is sitting on the HG ip...

ask them to see if that subdomain has a folder on the HG server..

.

No, probably not. The way Cloudflare works is they leave you with a 'direct' DNS entry to your host, so that you can still connect direct instead of going through the Cloudflare DNS or reverse proxy.

If you were to add a site to Cloudflare, they mirror the current DNS and add one called 'direct' that leaves the real IP in place.

**marketsmart** · 06-25-2011, 03:33 PM

Originally posted by Brujah

No, probably not. The way Cloudflare works is they leave you with a 'direct' DNS entry to your host, so that you can still connect direct instead of going through the Cloudflare DNS or reverse proxy.

If you were to add a site to Cloudflare, they mirror the current DNS and add one called 'direct' that leaves the real IP in place.

asianwench.com is sitting on the cloudflare ip

direct-connect.asianwench.com is sitting on the HG ip

i am assuming that he is redirecting asianwench.com to direct-connect.asianwench.com and then back to asianwench.com..

,

**AdultKing** · 06-25-2011, 03:37 PM

Wen Li
Jinshan Plaza
Nanjing, Jiangsu
People’s Republic of China
210009

Make a complaint via a telephone interpreter to Crime Prevention and Detection Command Center, Ministry of Public Security http://www.mps.gov.cn

If you can speak to the right person you might find the results pleasantly surprising. It's a serious criminal offence in China to run a porn site.

**Brujah** · 06-25-2011, 03:42 PM

Originally posted by marketsmart

asianwench.com is sitting on the cloudflare ip

direct-connect.asianwench.com is sitting on the HG ip

i am assuming that he is redirecting asianwench.com to direct-connect.asianwench.com and then back to asianwench.com..

,

Right, Cloudflare is certainly caching the pages and filtering the dns but not hosting the content. The caches expire regularly and Cloudflare retrieves them from HostGator. HostGator is hosting asianwench.com and www.asianwench.com, but not direct-connect.asianwench.com even though it is pointed to their IP.

Not that you'd need to but you can also confirm this is hosted at HostGator by editing your HOSTS file.

Code:

174.120.129.218  asianwench.com www.asianwench.com

It resolves correctly to the page hosted at HostGator. You get the 404 because HostGator's configuration doesn't have 'direct-connect' added, but the webmaster can use the direct-connect entry for SSH or FTP or whatever.

**marketsmart** · 06-25-2011, 03:45 PM

Originally posted by Brujah

Right, Cloudflare is certainly caching the pages and filtering the dns but not hosting the content. The caches expire regularly and Cloudflare retrieves them from HostGator. HostGator is hosting asianwench.com and www.asianwench.com, but not direct-connect.asianwench.com even though it is pointed to their IP.

Not that you'd need to but you can also confirm this is hosted at HostGator by editing your HOSTS file.

Code:

174.120.129.218  asianwench.com www.asianwench.com

It resolves correctly to the page hosted at HostGator. You get the 404 because HostGator's configuration doesn't have 'direct-connect' added, but the webmaster can use the direct-connect entry for SSH or FTP or whatever.

yes, now i see...

this is very clever..

i wish this was available back when i was spamming...

.

**Brujah** · 06-25-2011, 03:58 PM

Originally posted by marketsmart

yes, now i see...

this is very clever..

i wish this was available back when i was spamming...

.

Wouldn't that have been convenient for landing pages? The way I understand it, if HG does kill his site, it'll still be served for a little while from Cloudflare's caches.

This article highlights exactly what DWB is going through.
http://www.plagiarismtoday.com/2010/...g-much-harder/

**MaDalton** · 06-25-2011, 04:36 PM

Originally posted by Brujah

Wouldn't that have been convenient for landing pages? The way I understand it, if HG does kill his site, it'll still be served for a little while from Cloudflare's caches.

This article highlights exactly what DWB is going through.
http://www.plagiarismtoday.com/2010/...g-much-harder/

besides the problem with this, the Cloudflare thing sounds really interesting. i think i'm gonna try this

**Barry-xlovecam** · 06-25-2011, 06:37 PM

direct-connect.asianwench.com

Is at hostgator ... so? Not uncommon for subdomains to be at different server locations ...

mck-deathstar-7 (0.0.0.0) Sat Jun 25 22:29:16 2011
Change Packet Size: 0
Size Range: 28-4470, < 0:random.
Host Loss% Snt Last Avg Best Wrst StDev
1. ** 0.0% 11 14.9 25.7 14.9 42.1 7.2
2. ** 0.0% 12.8 13.8 9.3 29.3 7.1
3. ** 0.0% 11 12.4 10.5 9.0 13.2 1.4
4. ** 0.0% 11 12.5 14.7 12.5 16.1 1.1
5. pos-3-5-0-0-cr01.chicago.il.ibon 0.0% 10 26.1 26.8 24.1 42.4 5.6
6. pos-1-12-0-0-cr01.denver.co.ibon 0.0% 10 49.9 52.6 48.9 66.2 5.4
7. pos-2-14-0-0-cr01.dallas.tx.ibon 0.0% 10 63.3 67.5 62.6 83.7 8.0
8. pos-0-0-0-0-pe01.1950stemmons.tx 0.0% 10 68.3 66.7 62.9 81.9 5.6
9. theplanet-cr01.dallas.tx.ibone.c 0.0% 10 63.2 63.6 61.8 68.3 1.9
10. te7-1.dsr02.dllstx3.networklayer 0.0% 10 62.6 64.3 62.4 70.8 2.5
11. te2-1.dsr02.dllstx2.networklayer 0.0% 10 64.5 64.7 63.0 66.8 1.2
12. te6-1.car12.dllstx6.networklayer 0.0% 10 63.8 64.2 62.6 68.4 1.8
13. da.81.78ae.static.theplanet.com 0.0% 10 64.5 63.6 62.2 64.9 1.0

The webpage downloads are from filesharing downloads ...

**vdbucks** · 06-25-2011, 07:29 PM

Yeah, we're going through the same runaround...

Contact cloudflare, they say go here. Go here and they say go back there.. annoying.

Here's how it works, for those that don't know... there's nothing clever about what the guy is doing.

Cloudflare is basically a proxy for websites -- or, look at it like an external router. Like our sites.. they pass through a load balancing router to our servers. The external IP belongs to the load balancer, which in turn directs traffic to our internal IPs. The actual IP's of our web servers aren't accessible to the outside world, only through the LB routers. The cloudflare service is much like this.

Domain dns is setup with cloudflare, they in turn point the domain to their IP, which is just a proxy.

Traffic filters through the proxy, directly to the host.

This being said, I think the only way to get any cooperation fromthe actual host, we need to hammer cloudflare and have them disable the proxy pass through for the domain so it goes directly to the host. I've done this already, but we're only one voice.

So I urge the rest of you to hammer cloudflare with DMCA's and cease and desist* notifications until they deem the $20 a month they're making from the asianwench site isn't worth it.

*Not sure if cease and desist is appropriate as I'm just a brain, not a lawyer... but notifications to have them disable the account and proxy pass through for asianwench.

**vdbucks** · 06-25-2011, 07:50 PM

Also... can't we just hammer the hell out of the registrar, name.com?

We've fired off a DMCA to them as well but not really sure if that'll get anything resolved. But if we can get the domain name itself shut down... then this run around we're facing wouldn't be an issue...

**SmokeyTheBear** · 06-25-2011, 07:58 PM

http://www.ww.foogie.com/showthread.php?t=16380&page=3

discussing asianwench.com

user asianwench http://www.ww.foogie.com/member.php?u=5021

**Captain Kawaii** · 06-25-2011, 10:41 PM

Originally posted by vdbucks

Also... can't we just hammer the hell out of the registrar, name.com?

We've fired off a DMCA to them as well but not really sure if that'll get anything resolved. But if we can get the domain name itself shut down... then this run around we're facing wouldn't be an issue...

Dude...if the guy is in China and a foreigner...which sounds like he is...Smartest thing to do is to inform Chinese Police and other groups whose content he is stealing...end of asianwench, permanent end of him and his friends. capiche? Hold on, Whitey's on the line. Some trouble with the caviar and the hookers in lock up...laters...

**OneHungLo** · 06-25-2011, 11:12 PM

http://asianwench.com/

edit
was down now it's back up

**DWB** · 06-26-2011, 03:31 AM

Originally posted by Brujah

Right, Cloudflare is certainly caching the pages and filtering the dns but not hosting the content. The caches expire regularly and Cloudflare retrieves them from HostGator. HostGator is hosting asianwench.com and www.asianwench.com, but not direct-connect.asianwench.com even though it is pointed to their IP.

Not that you'd need to but you can also confirm this is hosted at HostGator by editing your HOSTS file.

Code:

174.120.129.218  asianwench.com www.asianwench.com

It resolves correctly to the page hosted at HostGator. You get the 404 because HostGator's configuration doesn't have 'direct-connect' added, but the webmaster can use the direct-connect entry for SSH or FTP or whatever.

Everyone who said HostGator gets a free handjob.

Someone at HostGator.com just confirmed.

Thanks everyone.

**lagcam** · 06-26-2011, 04:33 AM

Originally posted by DWB

Everyone who said HostGator gets a free handjob.

Someone at HostGator.com just confirmed.

Thanks everyone.

I earned my handjob on 9th June but have yet to receive it (check FIRST page of thread on foogie).

GFY detectives.... I need your help.

GFY detectives.... I need your help.

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment