Need help from experienced hacker or webmaster - GoFuckYourself.com

Mystery_Jock · 01-28-2003, 09:12 PM

OK guys, I need help from all you hackers and experienced pros out there. We manage several affilaite programs. Tonight, one of them is getting some kind of bot, signing up affiliates left right and center. In the past hour we had over 300 sign ups...all using different legit e-mail addresses of legit webmasters, and all going to various address on main street in New Jersey.

1) anyone know what is going on and how to stop it?

2) Other than malice, what could be the motive?
and experienced pros

hojo · 01-28-2003, 09:14 PM

Maybe put a check in the program to limit signups per IP address?

JasonB · 01-28-2003, 09:15 PM

I had the same problem once, but they were all for addresses in Brooklyn & NY. The accounts just sat there...never used.
Eventaully they just stopped.

echo465 · 01-28-2003, 09:16 PM

Maybe they're legit.

Why don't you contact some of the affiliates and ask them?

Mutt · 01-28-2003, 09:30 PM

what affiliate programs do u manage? what is the URL to your mail list hosting service? what is co-reg?

URL's?

WiredGuy · 01-28-2003, 09:38 PM

So this may be a malicious attempt to take down your system but some of those users may be real webmasters. So why not just let the system register them, and you delete inactive webmasters after something like 3 months?

An alternative would be that a webmaster has to confirm via email their entry into your affiliate program. That would eliminate a lot of the problems.

WG

ZoiNk · 01-28-2003, 10:07 PM

My guess on this is the person is setting up accounts to prepare for spamming. Use different affiliate IDs ever X number of emails so if someone gets 20 accounts deleted at the sponsor, they still have 280 paying them.
ZoiNk

fnet · 01-28-2003, 10:18 PM

Quote:

Originally posted by ZoiNk
My guess on this is the person is setting up accounts to prepare for spamming. Use different affiliate IDs ever X number of emails so if someone gets 20 accounts deleted at the sponsor, they still have 280 paying them.
ZoiNk

That's probably it. There's an outside chance that there is another reason for mass account creation.

The addresses may imply some kind of drop setup, but there may be a different explanation. It's doubtful, but with the information given this could something like a host setting up a per space advertising option.

Have you looked up any of the addresses?

aflex · 01-28-2003, 10:49 PM

what town in jersey?

kevinale · 01-29-2003, 12:05 AM

Why don't you implement something to make the person signing up enter a 5 digit random number displayed on an image.. Many of the mainstream sites (like Yahoo) now have this feature to prevent bots from creating a thousand email addys at any one time. They can't seem to read images.

I could implement something similar on your site if you want.. And could have it up in a day or two..

best,
kevin

kevinale )at( prontomail )dot( com

Mystery_Jock · 01-29-2003, 05:11 AM

Thanks for all the incredible info posted here. It really helps.

I think we will immediately implement some of the suggestions right away.

kevinale, I will speak to the owner of the company and have him contact you about setting that up if his webmaster is not up on that

The cities in Jersey looked like they were all made up Airedale, Burman, Juno and all the addresses had "Main" in them...Main Street, Main Road, Main Village. The only thing that was legit, were the e- mail addresses...all from legit websites, but I am sure none of them are related.

My guess after analyzing them is that it was malicious, but I am still not sure

The whole thing has now stopped, but it was horrible last night. LOL, I wish I could get 300 affiliates in a few hours.

Mutt, I will pm you the answers to your Q's. I do not want it to look like I posted this to promote anything at all..

Mystery_Jock · 01-29-2003, 05:13 AM

Mutt, Oops, looks like I can't PM you.

Feel free to e-mail me at ian @ list-city.com

fnet · 01-29-2003, 10:03 AM

Quote:

Originally posted by Mystery_Jock
Thanks for all the incredible info posted here. It really helps.
The cities in Jersey looked like they were all made up Airedale, Burman, Juno and all the addresses had "Main" in them...Main Street, Main Road, Main Village. The only thing that was legit, were the e- mail addresses...all from legit websites, but I am sure none of them are related.

My guess after analyzing them is that it was malicious, but I am still not sure

The whole thing has now stopped, but it was horrible last night. LOL, I wish I could get 300 affiliates in a few hours.

do you have a paypal option? have you written to the webmasters of any of these sites?

kevinale · 01-29-2003, 10:09 AM

Quote:

Originally posted by Mystery_Jock
kevinale, I will speak to the owner of the company and have him contact you about setting that up if his webmaster is not up on that

Well I'm here to help. Just shoot me an email if he wants it done.

best,
kevin

Mystery_Jock · 01-29-2003, 10:40 AM

Hey Kevin,

The e-mail and PM feature doesn;t seem to work. Please e-mail me at ian @ list-city.com

I would like to discuss that with you

fnet. No we do not have a paypal feature set up yet. So far it seems to be a challenge integrating it with our affilaite program. We intend on contacting all the e-mail addresses that were signed up.

I am amazed though that none of them complained to me this morning that they were signed up for an affiliate program against their knowledge and will. They all get confirmation letters, and usually if one webmaster is signed up by someone (trying to get a 2nd tier) by someone else, i would get an immediate e-mail. here we get over 300, and not one e-mail?

Makes me wonder if there is something more nefarious going on.

01-28-2003, 09:12 PM	#1
Mystery_Jock Registered User Join Date: Jan 2003 Location: Montreal Posts: 11	Need help from experienced hacker or webmaster OK guys, I need help from all you hackers and experienced pros out there. We manage several affilaite programs. Tonight, one of them is getting some kind of bot, signing up affiliates left right and center. In the past hour we had over 300 sign ups...all using different legit e-mail addresses of legit webmasters, and all going to various address on main street in New Jersey. 1) anyone know what is going on and how to stop it? 2) Other than malice, what could be the motive? and experienced pros __________________ List Hosting, Double opt-in Co-regs, Affilaite Management

01-28-2003, 09:16 PM	#4
echo465 Confirmed User Join Date: Mar 2001 Location: Indiana Posts: 265	Maybe they're legit. Why don't you contact some of the affiliates and ask them? __________________ Currently Promoting: Adult Movie Club

01-28-2003, 09:30 PM	#5
Mutt Too lazy to set a custom title Industry Role: Join Date: Sep 2002 Posts: 34,431	what affiliate programs do u manage? what is the URL to your mail list hosting service? what is co-reg? URL's? __________________ I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

01-28-2003, 09:38 PM	#6
WiredGuy Pounding Googlebot Industry Role: Join Date: Aug 2002 Location: Canada Posts: 34,484	So this may be a malicious attempt to take down your system but some of those users may be real webmasters. So why not just let the system register them, and you delete inactive webmasters after something like 3 months? An alternative would be that a webmaster has to confirm via email their entry into your affiliate program. That would eliminate a lot of the problems. WG __________________ I play with Google.

01-28-2003, 10:07 PM	#7
ZoiNk Confirmed User Join Date: Feb 2002 Location: Canada Posts: 2,370	My guess on this is the person is setting up accounts to prepare for spamming. Use different affiliate IDs ever X number of emails so if someone gets 20 accounts deleted at the sponsor, they still have 280 paying them. ZoiNk __________________ "People can have the Model T in any color - so long as it's black." - Henry Ford

01-28-2003, 09:14 PM	#2
hojo Confirmed User Join Date: Dec 2002 Posts: 130	Maybe put a check in the program to limit signups per IP address?

01-28-2003, 09:15 PM	#3
JasonB Confirmed User Industry Role: Join Date: Nov 2001 Posts: 1,183	I had the same problem once, but they were all for addresses in Brooklyn & NY. The accounts just sat there...never used. Eventaully they just stopped.

01-28-2003, 10:49 PM	#9
aflex Confirmed User Join Date: Oct 2002 Location: New Jersey - adaptweb at gmail.com Posts: 3,127	what town in jersey? __________________ self made mothafucka. buying premium domains & developed sites with revenue/traffic -> adaptweb at gmail.com

01-29-2003, 12:05 AM	#10
kevinale Confirmed User Join Date: Dec 2002 Location: Austin, TX Posts: 2,115	Why don't you implement something to make the person signing up enter a 5 digit random number displayed on an image.. Many of the mainstream sites (like Yahoo) now have this feature to prevent bots from creating a thousand email addys at any one time. They can't seem to read images. I could implement something similar on your site if you want.. And could have it up in a day or two.. best, kevin kevinale )at( prontomail )dot( com

01-29-2003, 05:11 AM	#11
Mystery_Jock Registered User Join Date: Jan 2003 Location: Montreal Posts: 11	Thanks for all the incredible info posted here. It really helps. I think we will immediately implement some of the suggestions right away. kevinale, I will speak to the owner of the company and have him contact you about setting that up if his webmaster is not up on that The cities in Jersey looked like they were all made up Airedale, Burman, Juno and all the addresses had "Main" in them...Main Street, Main Road, Main Village. The only thing that was legit, were the e- mail addresses...all from legit websites, but I am sure none of them are related. My guess after analyzing them is that it was malicious, but I am still not sure The whole thing has now stopped, but it was horrible last night. LOL, I wish I could get 300 affiliates in a few hours. Mutt, I will pm you the answers to your Q's. I do not want it to look like I posted this to promote anything at all.. __________________ List Hosting, Double opt-in Co-regs, Affilaite Management

01-29-2003, 05:13 AM	#12
Mystery_Jock Registered User Join Date: Jan 2003 Location: Montreal Posts: 11	Mutt, Oops, looks like I can't PM you. Feel free to e-mail me at ian @ list-city.com __________________ List Hosting, Double opt-in Co-regs, Affilaite Management

01-29-2003, 10:40 AM	#15
Mystery_Jock Registered User Join Date: Jan 2003 Location: Montreal Posts: 11	Hey Kevin, The e-mail and PM feature doesn;t seem to work. Please e-mail me at ian @ list-city.com I would like to discuss that with you fnet. No we do not have a paypal feature set up yet. So far it seems to be a challenge integrating it with our affilaite program. We intend on contacting all the e-mail addresses that were signed up. I am amazed though that none of them complained to me this morning that they were signed up for an affiliate program against their knowledge and will. They all get confirmation letters, and usually if one webmaster is signed up by someone (trying to get a 2nd tier) by someone else, i would get an immediate e-mail. here we get over 300, and not one e-mail? Makes me wonder if there is something more nefarious going on. __________________ List Hosting, Double opt-in Co-regs, Affilaite Management