GoFuckYourself.com - Adult Webmaster Forum - Who will be the first sponsor to step up about the link code change / trojan problem?

Page 2 of 3

Show 40 post(s) from this thread on one page

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - Who will be the first sponsor to step up about the link code change / trojan problem? (https://gfy.com/showthread.php?t=713455)

martinsc

03-11-2007 11:15 PM

Quote:

Originally Posted by TheDoc (Post 12053660)

Anyone that finds a webmaster frauding us, using spyware, or breaking our terms in a full out bad way.. I will pay you the amount the webmaster earned + $100 bonus. And if you can find spyware and frauders on these programs I will give you $100. mayorsmoney, topbucks, brutalbucks, madeinporn, yappodollars, and smashbucks.

:thumbsup :thumbsup :thumbsup

intercage

03-11-2007 11:19 PM

BTW here is my contact information if anyone needs it:

Thanks!

will76

03-11-2007 11:27 PM

Quote:

Originally Posted by TheDoc (Post 12052452)

I'm sure if anyone here can find affiliates stealing from other affiliates and you let the affiliate program know, they will take care of it. In general, affiliate programs "want affiliates to convert" and not one asshole to steal others sales.

Spyware/malware in general is hated and rejected by 99% of the affiliate programs. So rather than coming out to see which of the 1000's of us that already of course hate it. Find the other 1% that allow and produce spyware/malware.

I wish what you were saying was true but AFF/CAMS, and Sex Search off the top of my head pretty much go against everything you just said.

Or I guess to put it better, AFF/CAMS and SEX Search fall into your 1%... but I do think it is bigger than 1 %, I am sure there are a good bit more companies that don't care where they get their signups from.

Gaybucks

03-12-2007 03:04 AM

Quote:

Originally Posted by borked (Post 12056558)

Can I ask how far your commitment stretches? Do you actively check your affiliate's signup ups coming in against fraud like dustman and made2ordervideos do?

We've always done our best to ensure that our affiliates are treated honestly and fairly, but to be honest, I was not aware of the extent of the problem until very recently.

We do monitor signups and look for fraud, but the problem with the malware is the joins won't look obviously different from any others, so (as I said in the other thread) one of the things we want to look into is statistical analysis of the patterns behind the joins... if you have a sponsor with traffic literally coming from everywhere and not concentrated in any one source, and that sponsor has different conversion rates than other sponsors sending traffic from similar sites/promotion types, that would be very suspicious and we would act on it.

But to do that, we will have to write new scripts to analyze the traffic, and in the other thread there was some discussion about a collaborative effort to do that, which we'd be supportive of. Perhaps it can eventually be built into NATS, MPA3 and CCBill's own affiliate tracking.

But we're committed to acting on anything we can identify now, as well as investigating and acting on any reports we get from affiliates.

pornonada

03-12-2007 06:25 AM

Quote:

Originally Posted by intercage (Post 12057743)

Hi Nation-X,

I am the President of Intercage, Inc. and let me clear a few things up. InHosters , Estdomains, Esthost are in no way affiliated with Intercage, Inc. Understand this can be a little confusing especially since Intercage has no web presence. But that will be changing in the near future. Over the years we have supposed many resellers and continue to do so, it's just a shame of course sometimes the abusive ones get all the attention.

Those links you are referring to are old and I personally have worked with Spamhuntress to remove a few issues before. Don't follow these forums but a current customer spoted this and sent me a link. Thanks Chip ;-).

Only a few?

Let's see what it writes in some articles step by step:

taken from http://blogs.zdnet.com/Spyware/?p=763

Quote:

ISPs hosting spyware - who are they?

Recently I mentioned ISPs hosting spyware and said "Everyone in the anti-spyware community knows who these ISPs are." Now we have a perfect example. It starts with a SANS post today recommending to unblock an IP range they previously recommended blocking.

Based on feedback from Intercage customers, we no longer recommend to block them. Please let us know if you see any problems from 69.50.160.0/19 and we will try to facility contact and a resolution.

SANS had previously posted:

I hate block lists? maybe because I have been on the ?wrong end? of them in the past. But after careful consideration, we do recommend blocking traffic from these two netblocks:

InterCage Inc.: 69.50.160.0/19 (69.50.160.0 - 69.50.191.255)
Inhoster: 85.255.112.0/20 (85.255.112.0 - 85.255.127.255)

The list may be updated later. We do not expect to make this a "regular feature". But at this time we find that it is necessary to point out these particular two netblocks.

They have been associated with a number of high profile criminal activities in the past. A good number of WMF exploits use name servers or other resources in these netblocks. They have been non responsive to current and past requests to remove malicious content.
When I read the SANS update this morning, I shook my head. This afternoon, I saw that I wasn?t alone in my thinking. SunbeltBLOG has posted screenshots of malware being downloaded from InterCage and Inhoster IP addresses. The screenshot of the domain at Inhoster shows a wmf file along with the system tray pop-up for a rogue anti-spyware program, like what we?ve seen with SpyAxe. There are some interesting comments on the blog post, notably one from Johannes Ullrich of SANS saying "This range appears to be more on "auto pilot" then "malicious on purpose". My reply to that was it doesn?t matter if the range is on auto pilot or malicious on purpose, the end result is the same for anyone with an unprotected computer. Boom!! Infected with spyware and malware. Apparently legitimate customers of the ISPs were complaining about being blocked. I see that like good people living in a bad neighborhood. If there are gang shootouts or drive-by shootings, the good guys will likely get hurt too eventually. If it were me, I?d get the hell out - out of the bad neighborhood or the rogue ISP/hosting company.

Andrew Clover of Doxdesk.com, well known for his parasite list left a comment. Andrew has been tracking spyware, malware and the pushers for years now, before a lot of us heard about spyware. He wrote:

Atrivo/Intercage do have *some* legitimate customers, and they can be very vocal. But the sheer quantity of abuse in their netblock, from exploits to fraud to KP to spam of all forms, outweighs the legit material by a mile IMO.
And it?s no accident: they are unresponsive to complaints, and have admitted they won?t can Esthost - their biggest customer, CWS epicentre and #1 blackhat host in the world - despite being aware of the immense abuse they are responsible for.

The other block listed by SANS, ?Inhoster?, appears to be the same company as Esthost - as are Critical Internet, Estdomains and Web-Namez. This netblock used also to be Atrivo?s; it?s not clear to me whether that block is operated by Esthost themselves or by Atrivo for Esthost.

Blocking single domain names is barely feasible any more: there are thousands to block and more new ones all the time. I consider blocking entire netblocks operated by Esthost and Atrivo a very reasonable and measured move.
Andrew mentions other companies like Pilosoft and Netcathost but they will be the subject of another blog. So what about InterCage, formerly Atrivo or Atrivo Technologies? A quick Google search turns up hits like this one.

And, in fact, that up to half of Atrivo?s income is dependent on criminal activities, and that Atrivo knowingly (if passively) permits that criminal activity to continue.

That?s not an admission calculated to inspire trust. You have another job lined up somplepace, Russ? I?d say the final nail is now in Atrivo?s coffin.

Here:

The fine folks at esthost/atrivo are hosting a web site which distributes a variation of the W32/Apher.AE69-tr trojan at hxxp://24-7-search.com/12.hta then same URL cmdexe.exe.

Anyway, the author thoughtfully included a web bug in the hta file so that he, and consequently we, can watch the hits come in on his lovely little baby.

There are complaints about spam, blog comment spam and even wiki spam from InterCage/Atrivo. Webhelper lists some 200 to 300, maybe more, known CoolWebSearch domains hosted on InterCage IPs, domain names that are so disgusting I wouldn?t post them here. Interestingly enough, forum members at Webhostingtalk.com speak highly of InterCage and its owner, Emil Kacperski.

Atrivo is the best place to get a server. Excellent Support, no downtimes ..

We work with Emil extensively and he is a super cool guy.

I don?t know about that. I?ve personally checked a number of domains on InterCage IP?s and got hit with spyware through exploits. InterCage.com has no visible information on their website, just a blank white page, and InterCage.net is parked at GoDaddy, as is InterCage.biz. The whois info shows the same registrant and lists the contact as Emil Kacperski for all three domains.

so esthost is one of your biggest customers but your are NOT affilted with them? So all these criminals host with you but you are not affilated with them?

pornonada

03-12-2007 06:54 AM

Quote:

Originally Posted by intercage (Post 12057743)

Hi Nation-X,

I am the President of Intercage, Inc. and let me clear a few things up. InHosters , Estdomains, Esthost are in no way affiliated with Intercage, Inc. Understand this can be a little confusing especially since Intercage has no web presence. But that will be changing in the near future. Over the years we have supposed many resellers and continue to do so, it's just a shame of course sometimes the abusive ones get all the attention.

Those links you are referring to are old and I personally have worked with Spamhuntress to remove a few issues before. Don't follow these forums but a current customer spoted this and sent me a link. Thanks Chip ;-).

Nation-X if you want to drop me a e-mail at [email protected] I will go ahead and make sure the abusive content get's removed.

Thanks!

taken from http://spamhuntress.com/wiki/Dyakon

conclusion of the article:

Quote:

All access to any and all Intercage.com websites are from nlayer.net as seen by any worldwide trace route machine just as this one which can be carried out on an HTML webpage : http://www.completewhois.com/traceroute.htm Choose any server located in any part of the world and the first hop before reaching any IP hosted by the Intercage.com nuisance is managed by us.nlayer.net and the server bares the name of "Atrivo.com". A domain name that goes back long ago and for which we can track back Emil Kacperski, same guy everybody search for. His main Internet activities are provided through an internet access located at us.layer.net networks.

This is it ! Is this man really really involved in the promotion of Sexual Child abuse ? In the promotion of bestiality sex, In criminal SPAMSCAM ? WSell, for the least, he obviouly offer to anybody all the tools to promote any and all concepts surrounding these criminal activities. Who else on planet earth would enjoy making money out all these concepts ? Ask him ! :-) But you'll need the police to enforce your questions.

from http://spamhuntress.com/2005/05/03/a...-up-their-act/

Quote:

We?ve got so many examples of bots from Atrivo. Maybe we should complain to them next time we see a bot we can clearly demonstrate is associated with a spam run? abuse at atrivo dot com

Ah, this is interesting. He?s talking about yanking machines from clients, including Esthost!

Sounds like it?s about time to hit Atrivo with abuse messages - remember, only FRESH sighthings!

from http://spamhuntress.com/2006/01/07/i...-wmf-exploits/

Quote:

« Responsible use of disposable addressesCatch all test »Intercage with lots of wmf exploits
I was reading up on SANS, and found this gem:

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System

Basically, they advocate blocking all of Intercage due to a large number of wmf exploits.

Since Microsoft released the patch, those might be harmless by now (if you?re running a patched XP computer).

But the point is, when there?s a new exploit, Intercage (and it seems Inhoster), are likely to have a lot of exploits hidden in their IP range. Until they find and disable them. But considering ESThost is on Intercage, and the regular recruitment of badasses from there, the problem is they first have to find the exploits and shut them down.

So, I guess blocking those ranges might be a good idea in general.

TampaToker

03-12-2007 07:02 AM

Quote:

Originally Posted by Scootermuze (Post 12052589)

The bigger problem would be the sponsors themselves who are possibly creating these affiliate accounts using the various wares..

And I have a feeling this is being done more than people realize..

Thank you i didnt feel like typin that :winkwink:

pornonada

03-12-2007 07:08 AM

Quote:

Originally Posted by intercage (Post 12057743)

Hi Nation-X,

I am the President of Intercage, Inc. and let me clear a few things up. InHosters , Estdomains, Esthost are in no way affiliated with Intercage, Inc. Understand this can be a little confusing especially since Intercage has no web presence. But that will be changing in the near future. Over the years we have supposed many resellers and continue to do so, it's just a shame of course sometimes the abusive ones get all the attention.

Those links you are referring to are old and I personally have worked with Spamhuntress to remove a few issues before. Don't follow these forums but a current customer spoted this and sent me a link. Thanks Chip ;-).

Nation-X if you want to drop me a e-mail at [email protected] I will go ahead and make sure the abusive content get's removed.

Thanks!

from http://netrn.net/spywareblog/archive...um-on-the-run/

Quote:

SpywareQuake scum on the run?
When I first wrote about SpywareQuake at SpywareConfidential and here, the domains spywarequake.com, spywarequake.net and spywarequake.info were hosted at a California ISP known to host spyware (CWS) and malware, and other Super Rogue anti-spyware apps such as SpySheriff (whois).

That ISP is InterCage (whois), formerly known as Atrivo (whois) or Atrivotechnologies, located in the San Francisco Bay area (corporation lookup) of California. More on InterCage/Atrivo later.

I just checked the whois information for the 3 Spyware Quake domains and it looks like the sites are now hosted at a different location, different ISP, (maybe different?there is or was a relationship between InterCage and the current hosting company but I?m not clear what.)

The current IP address for spywarequake.com, according to Dnsstuff.com is this:

Pinging spywarequake.com [85.255.117.202]:

Ping #1: Got reply from 85.255.117.202 in 82ms [TTL=57]
Ping #2: Got reply from 85.255.117.202 in 82ms [TTL=57]
Ping #3: Got reply from 85.255.117.202 in 82ms [TTL=57]
Ping #4: Got reply from 85.255.117.202 in 82ms [TTL=57]

Done pinging spywarequake.com!

Whois for IP 85.255.117.202 shows that it belongs to Inhoster in the Ukraine.

85.255.117.202

Blacklist Status: Listed ? Cached Today (details)
Cached Whois: Cached today
Record Type: IP Address
IP Location: Ukraine ? Inhoster Hosting Company
Reverse IP: Web server hosts 1 websites (reverse ip tool requires free login)
Reverse DNS: not set
inetnum: 85.255.112.0 ? 85.255.127.255
netname: inhoster
descr: Inhoster hosting company
descr: OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine

More in Inhoster in a bit, too.

Spywarequake.info shows the same IP as spywarequake.com.

Pinging spywarequake.info [85.255.117.202]:

Ping #1: Got reply from 85.255.117.202 in 82ms [TTL=57]

Spywarequake.net seems to be in a different location.

Pinging spywarequake.net [66.116.200.239]:

Ping #1: * [No response]

66.116.200.239 is located in Hopkinsville, Kentucky according to whois.sc and dnsstuff.com. The page at spywarequake.net says ?web server is ok ?.
Odd.

So who is behind InterCage/Atrivo? And who is behind Inhoster, formerly Esthost? Are the two related or are they actually one and the same?

The name shown in the whois information for most of the InterCage/Atrivo domains is Emil Kacpersky, (not to be confused with Eugene Kaspersky of the antivirus company Kaspersky.) Inhoster.com (whois) is registered to:

Registration Service Provided By: ESTDOMAINS
Contact: +1.3027224217
Website: http://www.estdomains.com

Domain Name: INHOSTER.COM

Registrant:

Inhoster Inc. Andrei Kislizin () Lenina str. 23/95 Odessa ,54302 UA Tel. +38.0664637362 Fax. +38.0664637362
Creation Date: 01-Jun-2005
Expiration Date: 01-Jun-2006

Note the registrar, ESTDOMAINS, at estdomains.com (whois).

Estdomains.com is hosted at InterCage, at IP address 69.50.183.26 (whois)

The IP addresses now shown at Inhoster were fomerly shown as belonging to Esthost. Esthost.com is still alive and hosted at InterCage also. Esthost.com shares the IP address 69.50.176.228 with Estcertificates.com (whois).

SpamHuntress has blogged about Esthost and Atrivo/InterCage as well, and links to a thread on Google Groups where the relationship between Esthost and Atrivo is discussed.

This blog post is getting long and I?m going to break here for now, but I have more information about Emil Kacpersky, Atrivo/InterCage and Esthost/Inhoster to post in the next episode.

Lanceman

03-12-2007 07:37 AM

Any Sponsors that are interested in having spyware removed from their programs please see my thread

Anit Spyware Coilation Sign Up

There is a guy there who claims to be the inventor of spyware and he says that he has the cure!!!!

Also any Webmasters that are sick of loosing money sign up!

Stop the madness..........

pornonada

03-12-2007 07:59 AM

Quote:

Originally Posted by Lanceman (Post 12059102)

any link??

Lanceman

03-12-2007 08:13 AM

Quote:

Originally Posted by pornonada (Post 12059196)

any link??

http://www.gofuckyourself.com/showth...13712:thumbsup

intercage

03-12-2007 10:48 AM

Pinging spywarequake.info [195.225.177.7] with 32 bytes of data:

20 104 ms 88 ms 88 ms 64.111.192.205
21 87 ms 90 ms 88 ms 66.230.128.91
22 92 ms 84 ms 86 ms 195.225.177.7

OrgName: ISPrime, Inc.
OrgID: IPRM
Address: 25 Broadway
Address: 6th Floor, Suite #2
City: New York
StateProv: NY
PostalCode: 10004-1086
Country: US

ReferralServer: rwhois://rwhois.isprime.net:4321/

pornonada

03-12-2007 11:58 AM

Quote:

Originally Posted by intercage (Post 12060057)

is that all you have to reply to the bunch of posts about intercage on the last page??

here in another recent malware codec downloading site, guess where it's hosted?

Quote:

Whois for Activexvideosoftware.com ( Activex Video Software
Save | Cancel )
click to edit!
Front Page Information
Website Title: 404 Not Found
Record Type: Domain Name
AboutUs: Wiki article on Activexvideosoftware.com
SEO Score: 66%
Meta Relevance: No terms. Site needs Meta Description.
Terms: 11 (Unique: 9, Linked: 0)
Images: 0
Links: 0

Server Data
Server Type: Apache/2.0.54 (Fedora) mod_ssl/2.0.54 OpenSSL/0.9.7f
(Spry.com also uses Apache)
IP Address: 216.255.179.125
IP Location: - California - Concord - Intercage Inc
Response Code: 404
Blacklist Status: Clear
SSL Cert: No valid SSL on this Host
Website Status: Active

Registry Data
Close ICANN Registrar: ESTDOMAINS, INC.
Created: 06-mar-2007
Expires: 06-mar-2008
Registrar Status: clientTransferProhibited
Whois Server: whois.estdomains.com
Name Server: NS1.ACTIVEXVIDEOSOFTWARE.COM

your host seems to be nothing else than the "El Dorado" and "Paradise" for all kind of criminals.

I would suggest that NO adult site should be doing business anymore with sites anywa related to estdomains, eshost, intercage and any other company somehow using any of these services.

If we cap the traffic exchange with sites hosting with hosts that obviously tolerate and support criminals, than a lot of our problems should be fixed automaticly as we are not longer part of the malware distribution or at very least it will decrease a lot.

AmateurFlix

03-12-2007 12:16 PM

Quote:

Originally Posted by pornonada (Post 12060707)

I would suggest that NO adult site should be doing business anymore with sites anywa related to estdomains, eshost, intercage and any other company somehow using any of these services.

it'd be nice to know what IP ranges those hosts use

germ	03-12-2007 01:21 PM

Quote:

Originally Posted by intercage (Post 12060057)

wow....what a horrible rebuttal that was.

pornonada

03-12-2007 06:51 PM

Quote:

Originally Posted by germ (Post 12061221)

wow....what a horrible rebuttal that was.

i'am pretty sure isprime will fix things a bit faster than intercage ....

RawAlex

03-12-2007 07:00 PM

At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

Lanceman

03-12-2007 07:09 PM

Quote:

Originally Posted by AmateurFlix (Post 12060814)

it'd be nice to know what IP ranges those hosts use

It would I have to agree however it would also be nice to know that sponsors do not promote such behavior

I wage to bet that if we look closer we will find out which sponsors do and dont support this for I have a feeling that behind this organized group lies Quite of few others....

Every good band havs a front man!

Join the "Anti Spyware Coilition"

See thread.

nation-x

03-12-2007 07:54 PM

I got this email from Sunbelt Software today

Quote:

----- Original Message -----
From: "Alex Eckelberry" <AlexE[-at-]sunbelt-software.com>
To: <nation-x[-at-]artgps.com>
Sent: Monday, March 12, 2007 10:25 AM
Subject: RE: Huge trojan/spyware network and crime ring

> Shawn -- fwiw, inhosters, intercage/atrivo, etc. are well known in the
> security community as being very loose ISPs. I've talked with the FTC
> about it and a lot of people know, we just don't know when it will ever
> stop.
>
> -----Original Message-----
> From: nation-x[-at-]artgps.com [mailto:nation-x[-at-]artgps.com]
> Sent: Sunday, March 11, 2007 6:01 PM
> To: Alex Eckelberry; thomas | AdultReviews.net
> Subject: Huge trojan/spyware network and crime ring
>
> This last week I was informed about a trojan that was being spread
> around the internet
>
> http://lists.sans.org/pipermail/unis...er/026937.html
>
> I found your blog listed in one of the replies.
>
> I discovered this trojan being served via a porn site at this address
>
> http://www.fresh3xvideos.com/goanal.php
>
> If you research the traffic in alexa you will find that this site get's
> ALOT of traffic... in fact it's currently ranked 5,324
>
> http://alexa.com/data/details/traffi...2F%2Fwww.fresh
> 3xvideos.com%2Fgoanal.php
>
>
> I did a little more investigation and found that the trojan is being
> served from ACTIVEXVIDEOSOFTWARE.COM
>
> We have discovered that a huge number of spammers and ppc cheaters are
> using ESTDOMAINS to register domains and the above domain is no
> different...
> registered at estdomains.
>
> As it turns out the ip of the domains (and dns) is hosted by a comany
> called InterCage... a google search on the company shows that this
> company has been accused of alot of different crimes...
>
> and then I found this post on zdnet.
>
> http://blogs.zdnet.com/Spyware/?p=763
>
> InHosters, Intercage, Atrivo, Esthost and Estdomains are all the same
> company.
>
> I hope that you can help us in some way to defeat this serious issue.
>
> Sincerely,
> Shawn McAllister

and I also got one back from the FBI informing me that they take my report seriously and wwill be investigating....

nation-x

03-12-2007 08:06 PM

To Emil,
Thanks for taking the time to reply to this thread... I am glad I got the right name when I made the report to the FBI... you ARE Emil Kacpersky correct? I sent an email to [email protected] but I see the site is still live... as far as I know it's a crime to facilitate an international crime... you do know that disseminating viruses/trojans is a crime right?

Here is why we have a serious issue with Intercage... first of all... you host spammers, ppc cheaters, hackers, etc... wtf are you thinking? Btw... here is the email I sent you...

Quote:

----- Original Message -----
From: <nation-x[-at-]artgps.com>
To: <abuse[-at-]intercage.com>
Cc: <charlotte.public[-at-]ic.fbi.gov>; <ireport[-at-]cnn.com>
Sent: Sunday, March 11, 2007 10:10 PM
Subject: Hosting Trojan software

> Intercage,
> Although I am skeptical that you will take any action in this manner due
> to the association between Intercage, estdomains and InHosters but we have
> uncovered and international crime where a trojan is being served from an ip
> controlled by intercage ( 216.255.179.125) that is designed to steal
> affiliate sales among other things. The trojan was identified by the
> University of Minnesota as a rootkit installed trojan.
> http://lists.sans.org/pipermail/unis...er/026937.html
> http://sunbeltblog.blogspot.com/2006...am-hijack.html
>
> The website I found installing the trojan is currently 5,324 for traffic
> on the web according to alexa.
> http://alexa.com/data/details/traffi...m%2Fgoanal.php
> I have made reports to the FBI, CNN and to SBU in the Ukraine. I see
> this as a serious risk to the national security and probably one of the
> largest fraud schemes ever uncovered on the web. I am sure that they will
> uncover more widespread occurances during investigation. I suggest you take
> approriate action.
>
> Shawn McAllister
>

btw... I find it odd that you would even post here... lol

Lanceman

03-12-2007 08:08 PM

Quote:

Originally Posted by nation-x (Post 12064054)

I got this email from Sunbelt Software today

and I also got one back from the FBI informing me that they take my report seriously and will be investigating....

Great Maybe they can reimburse all of us!

Or better yet maybe they could get with this guy over on the "Anti Spyware Coilation Sign Up" Thread who claims to be the originator of spyware and pay him for a cure!

nation-x

03-12-2007 08:17 PM

In case you were interested... I downloaded a pdf of the report to the FBI... I am not going to make it public because it has my personal info in it but here is the report part...

Quote:

I am reporting a suspected international crime ring that is installing trojans on millions of pcs... The trojan
was initially identified by a Security Analyst at the University of Minnesota
http://lists.sans.org/pipermail/unis...er/026937.html
I have identified an install point... Here is the url to the alexa stats for this site.
http://alexa.com/data/details/traffi...m%2Fgoanal.php
I operate many softcore adult websites for a company based in Denmark in addition to being employed full
time as a programmer for an internet based adult service provider.
Recently it came to my attention that there was a rash of trojans being installed for the purpose of stealing
affiliate sales and spoofing websites by altering the victim pc to use the criminals dns servers. This is a
huge security risk for the victim and given the amount of traffic that the single install point that I identified
receives, I view it as a potentially serious national security issue as I believe the person behind this to be
Emil Kacpersky who I think owns Estdomains.com, InHosters.com and Intercage.com among other
companies. (I may be mistaken as I am no investigator). I have learned that these companies are believed
to be based in the Ukraine.
I don't really have any more information then that but this concerns me because I understand the amount
of money that these criminals are making from this endeavor is staggering and that millions of pcs may be
infected.

Quote:

Are there witnesses or other victims to this crime?
http://www.gofuckyourself.com/showthread.php?t=713306

Lanceman

03-12-2007 08:21 PM

Quote:

Originally Posted by nation-x (Post 12064129)

I also find that quite strange for some very good reasons:

1.This guy signed up today right before he started posting threads
2.How was he alerted of this discussion?

With those two out in the open Hmmmmmmmm?
I wonder who alerted him!

3.THE BIG PICTURE?

nation-x

03-12-2007 08:30 PM

if you don't think that these fuckers posts here then you are misguided... We swim with sharks...

HighSociety

03-12-2007 09:02 PM

Lets say someone does get caught with how I track them, Does anyone know if ccbill will give those sales to the right person? I wrote an email asking and they did not give me a clear answer

pornonada

03-13-2007 03:06 AM

Quote:

Originally Posted by made2ordervideos (Post 12064470)

Lets say someone does get caught with how I track them, Does anyone know if ccbill will give those sales to the right person? I wrote an email asking and they did not give me a clear answer

bump for an very interesting thread

nation-x

03-13-2007 04:23 AM

A member at another board I posted at provided this find:

from http://www.tunix.nl/index.php?s_cat=...loits_advisory

Quote:

Thirdly two netblocks can be blocked as well according to sources at SANS:
http://isc.sans.org/diary.php

InterCage Inc.: 69.50.160.0/19 (69.50.160.0 - 69.50.191.255)
Inhoster: 85.255.112.0/20 (85.255.112.0 - 85.255.127.255)

nation-x

03-13-2007 08:17 AM

bump this back to 1st page

Sneezy

03-13-2007 09:19 AM

Quote:

Originally Posted by RawAlex (Post 12063745)

At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

I would say that any fairly new videosharing site started late 2005 or early 2006 that have build up a lot of traffic in a short time by trading like crazy with well established sites may be suspicious if in anyway connected with ESTDOMAINS or the other suspects.

:2 cents:

pornonada

03-13-2007 04:31 PM

Quote:

Originally Posted by Sneezy (Post 12068074)

are you talking about avicash? If so, than every tgp/mgp and generally adult webmaster should have blacklist immediatly ALL sites using them, at least that's what i have done and will do. If it's another company you are talking about please forward me somehow the info.

Lanceman

03-13-2007 05:20 PM

I hear microsoft is onto this codec exploit issue now!

AmateurFlix

03-13-2007 05:47 PM

Quote:

Originally Posted by Lanceman (Post 12071918)

I hear microsoft is onto this codec exploit issue now!

link?

it would be nice for them to do so, they really shouldn't allow something as significant as this trojan to be installed without noticeable warnings being issued by the OS first.

Quickdraw

03-13-2007 06:05 PM

Quote:

Originally Posted by RawAlex (Post 12063745)

At this point, I think you can safely say: If the traffic comes from a domain registered with ESTDOMAINS, it is fairly suspect.

You mean our CWS friends at klikrevenue are suspect? Who woulda thunk it.. They still an advertiser here?

nation-x

03-13-2007 07:08 PM

I wonder why Emil never posted again :D

RawAlex

03-13-2007 08:58 PM

Quote:

Originally Posted by Quickdraw (Post 12072428)

You mean our CWS friends at klikrevenue are suspect? Who woulda thunk it.. They still an advertiser here?

I am sure there are honest people using ESTDOMAINS, but I think that having ESTDOMAINS as a registrar is one of those little flags that says "check this closely". This is especially important because these people register the domains, provide the hosting, and provide the connectivity to those hosts, with the clear intention of absorbing any negative comments, complaints, LARTs, or other notifications and not taking action. Basically, they control all three of the places that would get a DMCA notice. It's a nice touch.

It isn't a 100% sure thing that someone with ESTDOMAINS is going to be a scammer, but if you live next to a crack house, some people might think you like drugs, right?

Lanceman

03-13-2007 09:34 PM

Quote:

Originally Posted by RawAlex (Post 12073324)

Theres a very old saying "Show me your friends and I will show you what you are"!!!!!!!

RawAlex

03-13-2007 09:36 PM

Alternately, you lie down with dogs, and you will get fleas.

Lanceman

03-13-2007 10:11 PM

Microsoft Windows WMF exploits advisory

An update from Microsoft that fixes this vulnerabilty is now available:
http://www.microsoft.com/athome/secu...00601_WMF.mspx

A very serious vulnerability has been discovered in Microsoft Windows, for which exploits are found on the internet. It concerns issues with files that are interpreted by windows as .WMF files.

At this moment there is no patch from Microsoft. There are some workarounds for vulnerable systems that can be applied. More information on this issue can be found here:

urls:
http://www.security.nl/article/12594...F_exploit.html
http://secunia.com/advisories/18255/
http://isc.sans.org/diary.php
http://www.viruslist.com/en/alerts?alertid=176701669

Malicious files that can lead to an exploit can be both in e-mail attachments and on the internet on http servers.

The TUNIX/Firewall can help to avoid some risk in the following ways:

Firstly the Kaspersky virusscanner for email on TUNIX firewalls detects trojans that use this exploit, if the firewall uses a recent signature-database. It has been doing so since December 28th 2005.

Secondly a number of URLs have been identified that may contain malicious content. TUNIX recommends blacklisting the listed URLs on the TUNIX/Firewall. This can be accomplished using a simple URL blacklist.

At this moment the following URLs can be blocked:
m.cpa4.org
008k.com
mscracks.com
keygen.us
dailyfreepics.us
pornsites-reviews.com
mmxo.megaman-network.com
600pics.com
Crackz.ws
unionseek.com
www.tfcco.com
Iframeurl.biz
beehappyy.biz
Buytoolbar.biz
teens7.com

Thirdly two netblocks can be blocked as well according to sources at SANS:
http://isc.sans.org/diary.php

InterCage Inc.: 69.50.160.0/19 (69.50.160.0 - 69.50.191.255)
Inhoster: 85.255.112.0/20 (85.255.112.0 - 85.255.127.255)

This can also be implemented by http blocklists. It should be noted that blocking entire netblocks always carries the risk of blocking websites that should not be blocked.

Customers with a Managed Firewall (MF) contract, customers with a Remote Standby (RS) contract or customers with a Remote Maintenance (RB) contract can contact TUNIX Firewall Support to make the necessary adjustments to the configuration of TUNIX/txhttp or Tunix/http-gw to block this activity.

Lanceman

03-14-2007 04:39 AM

Quote:

Originally Posted by Jon Clark (Post 12053374)

When SurferBucks launches we will not except malicious traffic and will suspend any affiliate found to be using these methods... That is a PROMISE!

As far as offering a reward to those that report the issues, the only reward will be knowing you are helping clean up the community...

If we start offering incentives beyond that it will leave a gap for abuse of the system, the scammers will start reporting themselves to collect!

Im sure you have good intentions my only question is what will you do with all the sales that infected surfers computers have sent you and how will you delegate the rightful affiliate?
When this happens on a daily basis I beleive that this is where the problem starts for any sponsor!
When the thousands of redirected dollars start flowing in come on back and tell us who gets paid!
Better yet why dont you just send us a post card from the Islands:thumbsup

nation-x

03-14-2007 04:43 AM

Just for clarification... the trojan we are posting about isn't always delivered via an exploit... We have found multiple urls that are masking the trojan as a codec that users are voluntarily installing.

All times are GMT -7. The time now is 06:52 AM.

Page 2 of 3

Show 40 post(s) from this thread on one page