I got spammed by THEHUN - Page 2 - GoFuckYourself.com

Fletch XXX · 05-08-2003, 09:30 AM

50 million ways to die.

use one.

cluck · 05-08-2003, 09:50 AM

What kind of idiot would send spam traffic to a TGP? Way to turn the best converting traffic there is into the worst

Rick Latona · 05-08-2003, 10:19 AM

This is crazy. Go get 'em Patrick.

PowerCum · 05-08-2003, 10:47 AM

Ok, it appears like this dude is usint this method:

1) Find and hack a vulnerable Windows 2000 server.
2) Send mails throught it inserting 2 or 3 random fake headers so the only real working IP is the one that the hacked server has.

Methods to stop him:

1) ask the hacked servers admins to patch them (probably they will not know how to do that or will ignore this, so no way).
2) hack back the hacked servers and install sniffers on them, so the next time the spammer sends his flames around he will be traced and there will be proof to fuck him at all. It would be a nice idea to ask the server admins to put a "honeypot" box for this guy, but I think they will not know how to do that or will not want to do it.
3) call the authorityes and tell them that all these servers are suplanting your internet identity with some strange reason. The most you will get with this is the cops to shutdown the hacked servers, but in 99,99% they will do nothing.

0zzy · 05-08-2003, 03:08 PM

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 16529 invoked by uid 0); 8 May 2003 11:13:59 -0000
Received: from unknown (HELO penispills.com) (217.98.39.122)
by smtp.gammae.com with SMTP; 8 May 2003 11:13:58 -0000
Received: from [190.163.78.175] by mtu23.bigping.com with asmtp; 08 May 2003 00:36:40 +0700
Received: from [157.28.250.74] by smtp.doneohx.com with SMTP; Thu, 08 May 2003 07:29:48 +0800
Received: from [70.4.186.128] by mailout.endmonthnow.com with asmtp; 08 May 2003 15:22:56 -0200
Message-ID: <017001c31557$573b2da0$d52a0174@bdtmeikbo>
Reply-To: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: The Hun's Yellow Pages._-.. .. Rtpcmsbrl
Date: Thu, 08 May 2003 21:45:36 +1000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_68D_A86E_B4987A6C.A40BCD52"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000

natas · 05-08-2003, 05:54 PM

wow good work PowerCum

Shoplifter · 05-08-2003, 06:49 PM

I got this as well.

Porn Mickey · 05-08-2003, 10:46 PM

Quote:

Originally posted by nickbaauw
stop crying man!
someone else is trying to joke around, thehun will never spam

Received the same e-mail

Why post this on a board????

spam is not for kidding

cash69 · 05-08-2003, 10:57 PM

heh me 2

mrbling · 05-08-2003, 11:08 PM

thehun,
Just for your information...

I would not mess with spammers if you know whats good for you.

You fuck with them, they take you down to chinatown.

ALL huge players are all spammers, ask candidclicks what happened to them when they canceled a spammer.

oops.. candidclicks is not alive anymore hehe.

good luck.

PowerCum · 05-09-2003, 02:12 AM

Quote:

Originally posted by 0zzy
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 16529 invoked by uid 0); 8 May 2003 11:13:59 -0000
Received: from unknown (HELO penispills.com) (217.98.39.122)
by smtp.gammae.com with SMTP; 8 May 2003 11:13:58 -0000
Received: from [190.163.78.175] by mtu23.bigping.com with asmtp; 08 May 2003 00:36:40 +0700
Received: from [157.28.250.74] by smtp.doneohx.com with SMTP; Thu, 08 May 2003 07:29:48 +0800
Received: from [70.4.186.128] by mailout.endmonthnow.com with asmtp; 08 May 2003 15:22:56 -0200
Message-ID: <017001c31557$573b2da0$d52a0174@bdtmeikbo>
Reply-To: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: The Hun's Yellow Pages._-.. .. Rtpcmsbrl
Date: Thu, 08 May 2003 21:45:36 +1000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_68D_A86E_B4987A6C.A40BCD52"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000

This last leads to a DSL user pt122.dhcp.adsl.tpnet.pl.

This box is slightly diferent from the other ones.

The main differences are:

1) It does not share the hard drives to the outside network
2) It is frewalled in order not to respond to the ping requests (all others responded to ping in the first scan)
3) It is running SMTP AnalogX Proxy 4.10 with several changes or atleast it looks like it's so.
4) It's a dynamic IP, so it could not appear at a public proxy list or so. This means 2 possible things. This is the real spammer (I doubt that), or the real spammer is making continuous scans in order to get opened mail proxies or hackeable mail servers.
5) Definitely the box is running some kind of firewall becasue it takes lot of time to scan it.

Conclusions (for now)

1) All the mail agents appear to be different (from the different headers, Including Outlook versions are different).
2) Affected servers appear to "harden" their security 24 hours after the spam. Perhaps they have realized that their boxes have been used to spam. the other two servers have shut down their mail servervices.
3) Due to the mail agents used to perform the attack it could be a bot that fakes a random mail agent or it could be a virus spreading spam around. It appears to be a bot faking the mail agent because if it was a virus it would be a known one after some days of spam.
4) I am not shure, but I think I have seen a bot that emulates these actions somewhere. Must take a look at my software database.

The more headers we get, the more acurate will become this report.

cash69 · 05-09-2003, 02:16 AM

the anti's are gonna have fun with those... gonna have 50 fresh url's to report every time new galleries are updated

KRL · 05-09-2003, 02:21 AM

I got it also tonight.

DarkJedi · 05-09-2003, 02:35 AM

Smithers,
Release the hounds.

Machete_ · 05-09-2003, 02:41 AM

I just go this SPAM from TheHun

-----------------------------------------------------------

Submission: http://www.lordoftheteens.com/tgpgal...0/04index.html
Submitted: 2003-05-03 19:14:21

Your gallery is accepted. It will be on-line soon (could be anywhere between 1 day to a month)

The Hun

-----------------------------------------------------------

But he may do that as often as he wants to

The Hun · 05-09-2003, 02:55 AM

PowerCum... going for that reward ;-)

Good work, thanks! Could you give me your e-mail address... I have a couple of returned spams that have the original header in 'em...

PowerCum · 05-09-2003, 03:07 AM

Quote:

Originally posted by The Hun
PowerCum... going for that reward ;-)

Good work, thanks! Could you give me your e-mail address... I have a couple of returned spams that have the original header in 'em...

ice -at- icefire.org

The more headers you give me the easy it will be to trace this guy.
Anyways, it will take some time to do that. Sometimes it takes up to a month or never traced. Even that, I need the $$$ so I have no problems to try tracing this guy.

NickB. · 05-09-2003, 03:08 AM

Now this is too funny, we are talking about getting a spammer and some are crying "Why aren't you listing my galleries?? "

Stop Crying and go buy a listing at cybercatinc ( dot ) com

NickB. · 05-09-2003, 03:09 AM

Quote:

Originally posted by PowerCum
ice -at- icefire.org
The more headers you give me the easy it will be to trace this guy.
Anyways, it will take some time to do that. Sometimes it takes up to a month or never traced. Even that, I need the $$$ so I have no problems to try tracing this guy.

Hope you get this guy!!!!

kios · 05-09-2003, 03:12 AM

Thehun, try to trace as many different servers used for it as possible, then try to get in contact with the admin on them and see if they can provide any logfiles to you. BTW, is he still spamming? If yes, anyone have any headers to post?

i_know_who_it_is · 05-09-2003, 03:58 AM

i am pretty sure who it is... i want some kind of reward my icq is 220741482 thehun icq me..

michel · 05-09-2003, 04:36 AM

Quote:

Originally posted by i_know_who_it_is
i am pretty sure who it is... i want some kind of reward my icq is 220741482 thehun icq me..

TheHun has no icq

KRL · 05-09-2003, 05:04 AM

Quote:

Originally posted by michel

TheHun has no icq

05-09-2003, 05:08 AM

Quote:

Originally posted by nickbaauw
Now this is too funny, we are talking about getting a spammer and some are crying "Why aren't you listing my galleries?? "

Stop Crying and go buy a listing at cybercatinc ( dot ) com

If you were referring to me, I wasn't complaining about not getting galleries listed, I was asking why his site still said I was blacklisted when he personally said I was not blacklisted.

SR · 05-09-2003, 05:28 AM

Quote:

Originally posted by mrbling
thehun,
Just for your information...

I would not mess with spammers if you know whats good for you.

You fuck with them, they take you down to chinatown.

ALL huge players are all spammers, ask candidclicks what happened to them when they canceled a spammer.

oops.. candidclicks is not alive anymore hehe.

good luck.

Spammers are nothing more then a bunch of keyboard warriors.
Geeks without friends sitting in their basements sending out spam.
Happy with the money they make but never be able to spend it since they don't go outside.

HS-Trixxxia · 05-09-2003, 05:34 AM

evildick,
Your gallery must have a link back to your site. I believe that is why TheHun's bot is seeing it, even if the surfer may not.
Michel or Patrick could tell you for sure, but I think this may be the reason.

Try making another gallery - leave only the links of the sponsor and the images - test that all images work (and will not give a 404) then try submitting to him again.

I haven't seen the gallery, I could be wrong - but this is a possiblity.

05-09-2003, 06:56 AM

Quote:

Originally posted by Trixxxia
evildick,
Your gallery must have a link back to your site. I believe that is why TheHun's bot is seeing it, even if the surfer may not.
Michel or Patrick could tell you for sure, but I think this may be the reason.

Try making another gallery - leave only the links of the sponsor and the images - test that all images work (and will not give a 404) then try submitting to him again.

I haven't seen the gallery, I could be wrong - but this is a possiblity.

No, there's no links back to other pages on my site. I think Michel must have just ran my index page through their bot, which would have detected the link to gammacash. If they run one of my galleries through the bot it would be impossible for that to happen.

Here's the last one I tried to submit.

http://loadedgirls.com/galleries/hungallery23.html

I still get a "sorry that is blacklisted, redirects 404 to ads" message.

Here's what happens when you get a 404:

http://loadedgirls.com/typewhatevert...youwantinthere

nofx · 05-09-2003, 07:17 AM

Quote:

Originally posted by SR

Spammers are nothing more then a bunch of keyboard warriors.
Geeks without friends sitting in their basements sending out spam.
Happy with the money they make but never be able to spend it since they don't go outside.

kinda like most adult webmasters, they only go out for webmaster partys...

05-09-2003, 07:37 AM

That's because this forum automatically opens it in a new window silly. There's no place to go back to!

Visit my gallery page then type in a 404. You can hit the back button then.

05-09-2003, 07:39 AM

Oops. Looks like you removed the post.

05-08-2003, 09:30 AM	#51
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	50 million ways to die. use one. __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

05-08-2003, 09:50 AM	#52
cluck Confirmed User Join Date: Dec 2002 Location: New Jersey Posts: 5,248	What kind of idiot would send spam traffic to a TGP? Way to turn the best converting traffic there is into the worst __________________ icq 279990726 www.mcdonalds.com <- great money making opportunity

05-08-2003, 10:19 AM	#53
Rick Latona The Best Ideas Start Here Join Date: Dec 2002 Location: Atlanta Posts: 6,037	This is crazy. Go get 'em Patrick. __________________ Regards, Rick Latona http://latonas.com Latona's - We Sell Money Making Web Properties Note to buyers of websites and traffic: please check our inventory at http://latonas.com/websites-for-sale. If you would like to make an offer on something, just let me know.

05-08-2003, 10:47 AM	#54
PowerCum CjOverkill Industry Role: Join Date: Apr 2003 Location: Woldwide Posts: 1,328	Ok, it appears like this dude is usint this method: 1) Find and hack a vulnerable Windows 2000 server. 2) Send mails throught it inserting 2 or 3 random fake headers so the only real working IP is the one that the hacked server has. Methods to stop him: 1) ask the hacked servers admins to patch them (probably they will not know how to do that or will ignore this, so no way). 2) hack back the hacked servers and install sniffers on them, so the next time the spammer sends his flames around he will be traced and there will be proof to fuck him at all. It would be a nice idea to ask the server admins to put a "honeypot" box for this guy, but I think they will not know how to do that or will not want to do it. 3) call the authorityes and tell them that all these servers are suplanting your internet identity with some strange reason. The most you will get with this is the cops to shutdown the hacked servers, but in 99,99% they will do nothing. __________________ CjOverkill Traffic Trading Script Free, secure and fast traffic trading script. Get your copy now

05-08-2003, 03:08 PM	#55
0zzy Confirmed User Join Date: Jan 2002 Location: Montreal, Quebec, Canada Posts: 505	Return-Path: <[email protected]> Delivered-To: [email protected] Received: (qmail 16529 invoked by uid 0); 8 May 2003 11:13:59 -0000 Received: from unknown (HELO penispills.com) (217.98.39.122) by smtp.gammae.com with SMTP; 8 May 2003 11:13:58 -0000 Received: from [190.163.78.175] by mtu23.bigping.com with asmtp; 08 May 2003 00:36:40 +0700 Received: from [157.28.250.74] by smtp.doneohx.com with SMTP; Thu, 08 May 2003 07:29:48 +0800 Received: from [70.4.186.128] by mailout.endmonthnow.com with asmtp; 08 May 2003 15:22:56 -0200 Message-ID: <017001c31557$573b2da0$d52a0174@bdtmeikbo> Reply-To: <[email protected]> From: <[email protected]> To: <[email protected]> Subject: The Hun's Yellow Pages._-.. .. Rtpcmsbrl Date: Thu, 08 May 2003 21:45:36 +1000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_68D_A86E_B4987A6C.A40BCD52" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000 __________________ Ozzy

05-08-2003, 05:54 PM	#56
natas Confirmed User Join Date: Mar 2002 Location: : unknown Posts: 3,377	wow good work PowerCum

05-08-2003, 06:49 PM	#57
Shoplifter Richest man in Babylon Industry Role: Join Date: Jan 2002 Location: Posts: 10,002 Posts: 5,742	I got this as well.

05-08-2003, 10:57 PM	#59
cash69 So Fucking Banned Join Date: Oct 2002 Location: chandler, az Posts: 1,052	heh me 2

05-08-2003, 11:08 PM	#60
mrbling Confirmed User Join Date: Jun 2002 Posts: 365	thehun, Just for your information... I would not mess with spammers if you know whats good for you. You fuck with them, they take you down to chinatown. ALL huge players are all spammers, ask candidclicks what happened to them when they canceled a spammer. oops.. candidclicks is not alive anymore hehe. good luck. __________________ millionare by 18 , beat that hOES

05-09-2003, 02:16 AM	#62
cash69 So Fucking Banned Join Date: Oct 2002 Location: chandler, az Posts: 1,052	the anti's are gonna have fun with those... gonna have 50 fresh url's to report every time new galleries are updated

05-09-2003, 02:21 AM	#63
KRL Entrepreneur Join Date: Oct 2002 Location: USA Posts: 31,429	I got it also tonight. __________________ If you would like to develop your domains, you can lease inexpensive foreign labor from the leaders in the field at iWebmasters.com TO LOWER YOUR COSTS AND INCREASE YOUR PRODUCTION! * * * * * * * * * * * * Domains Adult News KRL's Newsletter Biz Tips Just Listed Domains

05-09-2003, 02:35 AM	#64
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	Smithers, Release the hounds.

05-09-2003, 02:41 AM	#65
Machete_ WINNING! Industry Role: Join Date: Oct 2002 Posts: 14,579	I just go this SPAM from TheHun ----------------------------------------------------------- Submission: http://www.lordoftheteens.com/tgpgal...0/04index.html Submitted: 2003-05-03 19:14:21 Your gallery is accepted. It will be on-line soon (could be anywhere between 1 day to a month) The Hun ----------------------------------------------------------- But he may do that as often as he wants to

05-09-2003, 02:55 AM	#66
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	PowerCum... going for that reward ;-) Good work, thanks! Could you give me your e-mail address... I have a couple of returned spams that have the original header in 'em...

05-09-2003, 03:08 AM	#68
NickB. Confirmed User Industry Role: Join Date: Aug 2001 Posts: 8,855	Now this is too funny, we are talking about getting a spammer and some are crying "Why aren't you listing my galleries?? " Stop Crying and go buy a listing at cybercatinc ( dot ) com

05-09-2003, 03:12 AM	#70
kios Confirmed User Join Date: Jan 2003 Posts: 544	Thehun, try to trace as many different servers used for it as possible, then try to get in contact with the admin on them and see if they can provide any logfiles to you. BTW, is he still spamming? If yes, anyone have any headers to post?

05-09-2003, 03:58 AM	#71
i_know_who_it_is Registered User Join Date: May 2003 Posts: 1	i am pretty sure who it is... i want some kind of reward my icq is 220741482 thehun icq me..

05-09-2003, 05:34 AM	#76
HS-Trixxxia Confirmed User Join Date: Mar 2002 Location: Montreal Canada Posts: 2,946	evildick, Your gallery must have a link back to your site. I believe that is why TheHun's bot is seeing it, even if the surfer may not. Michel or Patrick could tell you for sure, but I think this may be the reason. Try making another gallery - leave only the links of the sponsor and the images - test that all images work (and will not give a 404) then try submitting to him again. I haven't seen the gallery, I could be wrong - but this is a possiblity. __________________ ~~♥~~♥~~♥~~♥~~♥~~♥~~♥~~♥~~ Patrizia COO - ♥ MassiveDollars Email: patrizia at MassiveDollars dot com ICQ: 465.826.441 Yahoo: trixxxia_me MSN: trixxxia at hotmail dot com

05-09-2003, 07:37 AM	#79
evildick Guest Posts: n/a	That's because this forum automatically opens it in a new window silly. There's no place to go back to! Visit my gallery page then type in a 404. You can hit the back button then.

05-09-2003, 07:39 AM	#80
evildick Guest Posts: n/a	Oops. Looks like you removed the post.