A shitload of trojan installing galleries and TONS of their affiliate codes - GoFuckYourself.com

AmateurFlix · 03-21-2007, 11:31 PM

I posted this in the tail end of another thread, thought it might be something worthy of it's own thread though:

WARNING - do NOT install any of these codecs - do NOT visit without good anti-virus protection

This TGP http://adultau.com/?id=1110&t=4 is linking this gallery http://coolbestporn.com/robin/330225868/1/?id=1110

which upon clicking one of the videos loads the page http://coolbestporn.com/robin/330225...53bXY=&id=1110 kasperky is warning of "Trojan.Win32.DNSChanger.ir" trying to auto-install
the affiliate link on that gallery is http://collegepartytime.com/ref/1004000/ so maybe the blockboostercash guys can identify him.

Here's another doing the same with a TCG gallery: http://porn-room.net/obedience/1619577015/1/?id=1110
affiliate link from that gallery: http://www.castingcouchteens.com/?wm...tbond&cf=&sub=

Same for http://teenporntop.com/harman/1312166799/1/?id=1110
affiliate link: http://www.tamedteens.com/go/596263/22/9/n/

http://porntimeguide.com/alphinias/1...021/1/?id=1110
affiliate link: http://armyofass.maniacpass.com/?id=rikki&pt=p

http://pornhelp.net/pheney/1107727492/1/?id=1110
affiliate link: http://teen-stop.com/?id=crossales

http://xxxadultgold.com/bo/616802479/1/?id=1110
affiliate link: http://secure.hardcoreteeniesex.com/...0:HCTS,0,0,0,/

There's a TON more. The http://adultau.com/?id=1110&t=4 appears to be getting all traffic clicked from http://www.free-nude-photo.org/ which signed up for a trade on my site using IP 64.22.82.232 @ 15:22 EST on 3/21/07 (in case anybody really feels like tracking down this fool).

I haven't reported these yet to the proper sponsors, just too damn late at night for me to screw with atm :P so if anybody feels like messaging the sponsors before I do tomorrow go right ahead...

Thurbs · 03-22-2007, 12:00 AM

caught one of our domains in this one .. already started to look into the details of the guys account. Just need to find a machine that I can risk wrecking with spyware to see it in action.

if you can screenshot the one for HardCoreTeenieSex that would be awesome.

hjnet · 03-22-2007, 02:12 AM

free-nude-photo.org
IP Location -> INTERCAGE
Registrar -> ESTDOMAINS

I've blacklisted every gallery/trade domain on my sites that is either registered at ESTDOMAINS, or Hosted at ATRIVO, INTERCAGE or INHOSTERS. That solved a lot of troubles, just do a board-search or use google to get more info about them.

Just add i.e. http://whois.domaintools.com/ to your bookmarks and check every domain you're doing business with, you'd be amazed how many cheaters are somehow attached to these 4 Hosts/Registrars.

TampaToker · 03-22-2007, 02:19 AM

Quote:

Originally Posted by hjnet

free-nude-photo.org
Registrar -> ESTDOMAINS

Been seeing alot of this lately

03-21-2007, 11:31 PM	#1
AmateurFlix Confirmed User Industry Role: Join Date: Jul 2004 Posts: 7,762	A shitload of trojan installing galleries and TONS of their affiliate codes I posted this in the tail end of another thread, thought it might be something worthy of it's own thread though: WARNING - do NOT install any of these codecs - do NOT visit without good anti-virus protection This TGP http://adultau.com/?id=1110&t=4 is linking this gallery http://coolbestporn.com/robin/330225868/1/?id=1110 which upon clicking one of the videos loads the page http://coolbestporn.com/robin/330225...53bXY=&id=1110 kasperky is warning of "Trojan.Win32.DNSChanger.ir" trying to auto-install the affiliate link on that gallery is http://collegepartytime.com/ref/1004000/ so maybe the blockboostercash guys can identify him. Here's another doing the same with a TCG gallery: http://porn-room.net/obedience/1619577015/1/?id=1110 affiliate link from that gallery: http://www.castingcouchteens.com/?wm...tbond&cf=&sub= Same for http://teenporntop.com/harman/1312166799/1/?id=1110 affiliate link: http://www.tamedteens.com/go/596263/22/9/n/ http://porntimeguide.com/alphinias/1...021/1/?id=1110 affiliate link: http://armyofass.maniacpass.com/?id=rikki&pt=p http://pornhelp.net/pheney/1107727492/1/?id=1110 affiliate link: http://teen-stop.com/?id=crossales http://xxxadultgold.com/bo/616802479/1/?id=1110 affiliate link: http://secure.hardcoreteeniesex.com/...0:HCTS,0,0,0,/ There's a TON more. The http://adultau.com/?id=1110&t=4 appears to be getting all traffic clicked from http://www.free-nude-photo.org/ which signed up for a trade on my site using IP 64.22.82.232 @ 15:22 EST on 3/21/07 (in case anybody really feels like tracking down this fool). I haven't reported these yet to the proper sponsors, just too damn late at night for me to screw with atm :P so if anybody feels like messaging the sponsors before I do tomorrow go right ahead... __________________

03-22-2007, 02:12 AM	#3
hjnet Confirmed User Join Date: May 2002 Location: European Union Posts: 3,815	free-nude-photo.org IP Location -> INTERCAGE Registrar -> ESTDOMAINS I've blacklisted every gallery/trade domain on my sites that is either registered at ESTDOMAINS, or Hosted at ATRIVO, INTERCAGE or INHOSTERS. That solved a lot of troubles, just do a board-search or use google to get more info about them. Just add i.e. http://whois.domaintools.com/ to your bookmarks and check every domain you're doing business with, you'd be amazed how many cheaters are somehow attached to these 4 Hosts/Registrars. Last edited by hjnet; 03-22-2007 at 02:13 AM..

03-22-2007, 12:00 AM	#2
Thurbs The Thrilla in Manila Join Date: Sep 2004 Location: Thurbs' Lagoon, Christmas Island Posts: 4,785	caught one of our domains in this one .. already started to look into the details of the guys account. Just need to find a machine that I can risk wrecking with spyware to see it in action. if you can screenshot the one for HardCoreTeenieSex that would be awesome.