Hacker help, asap thanks - GoFuckYourself.com

RedMonkey · 08-19-2003, 09:54 AM

Someone hacked into my GoDaddy account and changed all my domains under his account. GoDaddy tells me I have to dispute it with Wipo.org and they cant help me here he is:

Registrant: ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation Registered through: GoDaddy.com Domain Name: RACIALLYMOTIVATED.COM Created on: 28-Dec-02 Expires on: 28-Dec-03 Last Updated on: Administrative Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408 Technical Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408

The email point to a yahoo email
the only thing that comes up is this
http://profiles.yahoo.com/domain_public

Can Anybody help me?
167694994 Thanks

aflex · 08-19-2003, 10:00 AM

i use godaddy as my registrar, was your account / password easy to guess? fill us in that want to secure our domains

KMR Stitch · 08-19-2003, 10:00 AM

Got Keylogged?

goBigtime · 08-19-2003, 10:00 AM

RaciallyMotivated.com was your domain?

goBigtime · 08-19-2003, 10:02 AM

First thing to do is get get the last freeware version of tiny personal firewall (2.0.15) so you can keep them from getting back into your box.

Also suggest you get a hardware firewall as well.

Then reinstall your operating system from scratch.

RedMonkey · 08-19-2003, 10:02 AM

I have about 15-17 names in there my uN was some random numbers and my PW similar to others but not super easy they tell me they cant do anything? godaddy i mean

SKULL · 08-19-2003, 10:06 AM

always a good old Russian... hacking and fucking people up... do they teach these guys about ethics in Rusia?

modF · 08-19-2003, 10:12 AM

Fucked by a Russian? I don't believe it.

Someone else had a similar problem recently with about 10 domains using godaddy. I'll see if I can find it for you.

SplitInfinity · 08-19-2003, 10:13 AM

Want to catch him?

Heres a tip.

Compose an email in html with a 1x1 transparant pixel image
embedded inside the email. Make this pixel the first thing to load
but make sure it is hidden and fully transparant.

Next, MAKE SURE THIS IMAGE LOADS FROM YOUR WEB SERVER
not from the email itself. Also, make sure it has a GOOD name
that is unique so you can spot it later....

Now, keep an eye on your web servers logs... perhaps with:

tail -f /var/log/http/access_log | grep NameOfFileHere.gif

Or just scan through them looking for the image name.

The theory here is simple...
When the hacker checks his anon email account, the image loads in his browser
and the ip that shows up in the logs is his home computer if he isnt smart.

:-)

I have put 12 hackers in jail using that trick since 1997.

-Chris Jester-
SplitInfinity Web Hosting

Need security work done? Ring me. Or ICQ...

Obie Trice · 08-19-2003, 10:14 AM

You got cracked By Brutus no doubt

wargames · 08-19-2003, 10:15 AM

Quote:

Originally posted by RedMonkey
Someone hacked into my GoDaddy account and changed all my domains under his account. GoDaddy tells me I have to dispute it with Wipo.org and they cant help me here he is:

Registrant: ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation Registered through: GoDaddy.com Domain Name: RACIALLYMOTIVATED.COM Created on: 28-Dec-02 Expires on: 28-Dec-03 Last Updated on: Administrative Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408 Technical Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408

The email point to a yahoo email
the only thing that comes up is this
http://profiles.yahoo.com/domain_public

Can Anybody help me?
167694994 Thanks

Thats fucked up

goBigtime · 08-19-2003, 10:21 AM

Quote:

Originally posted by SplitInfinity
Want to catch him?

Heres a tip.
I have put 12 hackers in jail using that trick since 1997.

-Chris Jester-
SplitInfinity Web Hosting

Need security work done? Ring me. Or ICQ...

Slick one Chris

... I'm digging up some info on this guy as we speak. I have a feeling he is in the US.

RedMonkey · 08-19-2003, 10:21 AM

Quote:

Originally posted by wargames

Thats fucked up

Who is Brutus?

goBigtime · 08-19-2003, 10:44 AM

....developing...

p00p · 08-19-2003, 10:49 AM

Quote:

Originally posted by RedMonkey

Who is Brutus?

A beauty of a program. Still works great after all these years....

TomsPics · 08-19-2003, 11:16 AM

www.hoobie.net i think

nobull · 08-19-2003, 11:19 AM

If it is your name on the registration just transfer them from GoDaddy to a different company.... but all you should have to do is fax them your ID and your all set

EZRhino · 08-19-2003, 11:21 AM

Quote:

Originally posted by SplitInfinity
Want to catch him?

Heres a tip.

Compose an email in html with a 1x1 transparant pixel image
embedded inside the email. Make this pixel the first thing to load
but make sure it is hidden and fully transparant.

Next, MAKE SURE THIS IMAGE LOADS FROM YOUR WEB SERVER
not from the email itself. Also, make sure it has a GOOD name
that is unique so you can spot it later....

Now, keep an eye on your web servers logs... perhaps with:

tail -f /var/log/http/access_log | grep NameOfFileHere.gif

Or just scan through them looking for the image name.

The theory here is simple...
When the hacker checks his anon email account, the image loads in his browser
and the ip that shows up in the logs is his home computer if he isnt smart.

:-)

I have put 12 hackers in jail using that trick since 1997.

-Chris Jester-
SplitInfinity Web Hosting

Need security work done? Ring me. Or ICQ...

I would go with Jester's idea asap.

goBigtime · 08-19-2003, 11:46 AM

Well heres the deal...

They guy ( [email protected] ) stole:

www.hackcab.com
www.boyeurism.com
www.crackcash.com
www.crackcash.net
www.innovativeadultmedia.com
www.raciallymotivated.com
www.stickyproductions.com
www.undermycontrol.com
www.wiggawhat.com

From RedMonkey - who lives in Philadelphia, PA 19149....

But awhile ago [email protected] was offering up Ouch.com for sale:

http://216.239.51.104/search?q=cache...hl=en&ie=UTF-8

Ouch.com is (now?) owned by:

John Berryhill
[email protected]
1601 market st
suite 720
Philadelphia, Pennsylvania 19103
United States

(About 20 minutes away from RedMonkey)

When investigating John Berryhill you find out he has a Ph.D.
and works for Dann, Dorfman, Herrell, & Skillman P.C. (ddhs.com)

http://www.johnberryhill.com/

He's into patent work apparently.

Anyway... there is a definite tie between John Berryhill & the person that stole those domains.

Either John Berryhill was the original owner of Ouch.com & got it back (through the legal means available to him)... or he purchased the domain from the crook.

It is a strange coincidence that the person whos domains were stolen is in PA & the person who now owns Ouch.com is in PA. But under the cirumstances, I'm betting that's all it is.

Unless... the crook is ALSO in PA possibly working for RedMonkey's ISP & sniffing/intercepting data....Hmm.

Anyway I'm done with this one. Call John Berryhill and ask him how he wound up with Ouch.com.

foolio · 08-19-2003, 11:51 AM

I love a good fight

RedMonkey · 08-20-2003, 11:47 AM

To anyone following this story:
I have found many alias' so far and an ebay account, he has all ready tried selling someone elses domain (OUCH.com) for 3K at http://www.dnforum.com, he is deff. not russian, the FBI (Internet), local, and a couple other online fraud investigators havent responded to me. GoDaddy or Ebay can care less avout helping me on his. I understand Ebay but I am holding GoDaddy responsible, they're saying I gave out my info. (All lost about 15-17 names total including my company name and names purchased the same day 8/5, they were are all changed.) This hacker makes a lving off of stealing and selling "our" domain names to people who buy them unknowingly which is the case in OUCH.com. I know many of this doesn't affect any of you but how safe is really all of our sites, how many man hours goes bend many of them. There is NO SECURITY at GODADDY, any one that supports me on the FUCK GODADDY campaign, thanks, that should be followed by the FUCK NS campaign, lol. Regardless, I ain't letting the hacker have my domains I spent too much time behind them as well as a couple $100's. I hope he ain't in Philly people get shot over less. FUCK GODADDY!

08-19-2003, 09:54 AM	#1
RedMonkey Confirmed User Join Date: Feb 2003 Location: Philly, PA Posts: 204	Hacker help, asap thanks Someone hacked into my GoDaddy account and changed all my domains under his account. GoDaddy tells me I have to dispute it with Wipo.org and they cant help me here he is: Registrant: ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation Registered through: GoDaddy.com Domain Name: RACIALLYMOTIVATED.COM Created on: 28-Dec-02 Expires on: 28-Dec-03 Last Updated on: Administrative Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408 Technical Contact: Mazilov, Maxim [email protected] ROSTEX LLC Pushkinskaya 87 Rostov-on-Don 355000 Russian Federation +79034069408 The email point to a yahoo email the only thing that comes up is this http://profiles.yahoo.com/domain_public Can Anybody help me? 167694994 Thanks

08-19-2003, 10:06 AM	#7
SKULL Confirmed User Industry Role: Join Date: Jun 2003 Location: The Moon Posts: 1,953	always a good old Russian... hacking and fucking people up... do they teach these guys about ethics in Rusia? __________________ www.traffic-trades.com

08-19-2003, 10:12 AM	#8
modF Confirmed User Join Date: Aug 2002 Posts: 1,888	Fucked by a Russian? I don't believe it. Someone else had a similar problem recently with about 10 domains using godaddy. I'll see if I can find it for you. __________________ I do things skype:themodF

08-19-2003, 11:19 AM	#17
nobull Confirmed User Join Date: Oct 2002 Location: Las Vegas Posts: 1,256	If it is your name on the registration just transfer them from GoDaddy to a different company.... but all you should have to do is fax them your ID and your all set __________________ NOREBILLS -- MAKE CASH NOW WITH THE NEWEST IDEA IN ONLINE PORN!

08-19-2003, 11:46 AM	#19
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	Well heres the deal... They guy ( [email protected] ) stole: www.hackcab.com www.boyeurism.com www.crackcash.com www.crackcash.net www.innovativeadultmedia.com www.raciallymotivated.com www.stickyproductions.com www.undermycontrol.com www.wiggawhat.com From RedMonkey - who lives in Philadelphia, PA 19149.... But awhile ago [email protected] was offering up Ouch.com for sale: http://216.239.51.104/search?q=cache...hl=en&ie=UTF-8 Ouch.com is (now?) owned by: John Berryhill [email protected] 1601 market st suite 720 Philadelphia, Pennsylvania 19103 United States (About 20 minutes away from RedMonkey) When investigating John Berryhill you find out he has a Ph.D. and works for Dann, Dorfman, Herrell, & Skillman P.C. (ddhs.com) http://www.johnberryhill.com/ He's into patent work apparently. Anyway... there is a definite tie between John Berryhill & the person that stole those domains. Either John Berryhill was the original owner of Ouch.com & got it back (through the legal means available to him)... or he purchased the domain from the crook. It is a strange coincidence that the person whos domains were stolen is in PA & the person who now owns Ouch.com is in PA. But under the cirumstances, I'm betting that's all it is. Unless... the crook is ALSO in PA possibly working for RedMonkey's ISP & sniffing/intercepting data....Hmm. Anyway I'm done with this one. Call John Berryhill and ask him how he wound up with Ouch.com. Last edited by goBigtime; 08-19-2003 at 11:53 AM..

08-19-2003, 10:00 AM	#2
aflex Confirmed User Join Date: Oct 2002 Location: New Jersey - adaptweb at gmail.com Posts: 3,127	i use godaddy as my registrar, was your account / password easy to guess? fill us in that want to secure our domains

08-19-2003, 10:00 AM	#3
KMR Stitch I am cool Join Date: Jul 2003 Posts: 14,494	Got Keylogged?

08-19-2003, 10:02 AM	#5
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	First thing to do is get get the last freeware version of tiny personal firewall (2.0.15) so you can keep them from getting back into your box. Also suggest you get a hardware firewall as well. Then reinstall your operating system from scratch.

08-19-2003, 10:13 AM	#9
SplitInfinity Confirmed User Join Date: Dec 2002 Location: San Diego, CA Posts: 3,047	Want to catch him? Heres a tip. Compose an email in html with a 1x1 transparant pixel image embedded inside the email. Make this pixel the first thing to load but make sure it is hidden and fully transparant. Next, MAKE SURE THIS IMAGE LOADS FROM YOUR WEB SERVER not from the email itself. Also, make sure it has a GOOD name that is unique so you can spot it later.... Now, keep an eye on your web servers logs... perhaps with: tail -f /var/log/http/access_log \| grep NameOfFileHere.gif Or just scan through them looking for the image name. The theory here is simple... When the hacker checks his anon email account, the image loads in his browser and the ip that shows up in the logs is his home computer if he isnt smart. :-) I have put 12 hackers in jail using that trick since 1997. -Chris Jester- SplitInfinity Web Hosting Need security work done? Ring me. Or ICQ...

08-19-2003, 10:14 AM	#10
Obie Trice So Fucking Banned Join Date: Aug 2003 Posts: 205	You got cracked By Brutus no doubt

08-19-2003, 10:44 AM	#14
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	....developing...

08-19-2003, 11:16 AM	#16
TomsPics Confirmed User Join Date: Aug 2002 Location: Detroit, MI Posts: 498	www.hoobie.net i think

08-19-2003, 11:51 AM	#20
foolio ICQ: 178725656 Join Date: Nov 2002 Location: Sunny San Diego Posts: 12,366	I love a good fight __________________

08-20-2003, 11:47 AM	#21
RedMonkey Confirmed User Join Date: Feb 2003 Location: Philly, PA Posts: 204	To anyone following this story: I have found many alias' so far and an ebay account, he has all ready tried selling someone elses domain (OUCH.com) for 3K at http://www.dnforum.com, he is deff. not russian, the FBI (Internet), local, and a couple other online fraud investigators havent responded to me. GoDaddy or Ebay can care less avout helping me on his. I understand Ebay but I am holding GoDaddy responsible, they're saying I gave out my info. (All lost about 15-17 names total including my company name and names purchased the same day 8/5, they were are all changed.) This hacker makes a lving off of stealing and selling "our" domain names to people who buy them unknowingly which is the case in OUCH.com. I know many of this doesn't affect any of you but how safe is really all of our sites, how many man hours goes bend many of them. There is NO SECURITY at GODADDY, any one that supports me on the FUCK GODADDY campaign, thanks, that should be followed by the FUCK NS campaign, lol. Regardless, I ain't letting the hacker have my domains I spent too much time behind them as well as a couple $100's. I hope he ain't in Philly people get shot over less. FUCK GODADDY!