WARNING! Clickzs.com associated with trojan/codec installs - GoFuckYourself.com

rowan · 05-15-2007, 08:38 PM

pornstarsxtra.com - came across this site mentioned on another board. It appears to be an old school paysite, but it also has pages that show a fake video player window (it's just an image, no attempt at embedding a video) with a link to an executable:

Description of IE SecPlugin
IE SecPlugin is an adware application that hijacks search page and monitors internet activities of the user.

WHOIS shows the registrant as Netsaits BV with the admin contact Gerco Marsch. clickzs.com has the same details.

clickzs.com lives at 64.237.39.70, pornstarsxtra.com lives at 64.237.39.66. 127 IPs from that block are allocated to Netsaits BV, which includes those two IPs.

So we have these two domains sharing the same company name, same admin contact, same host, same IP block.........

It's not the first time clickzs has been associated with shifty stuff, it wasn't so long ago that they were linking their buttons to Zango.

So who links to clickzs?

clickzs.com - Inlinks (166,840)
www.clicksz.com - Inlinks (95,762)

If they ever decided to be more blatant about their installs then there'd be a lot of shit going down.

fris · 05-15-2007, 08:41 PM

a lot of people (big sites) use clickzs, this blows

GAMEFINEST · 05-15-2007, 08:53 PM

good heaeds up

RawAlex · 05-15-2007, 08:58 PM

I think very few people either understand or choose to understand just how far these codec and spyware installers have gone into the porn business.

I would place a guess today that 30% or more of the joins / money are going to these types of operations, either as direct sales or a traffic buys from PPC sites that use these tools to generate traffic.

Quickdraw · 05-15-2007, 11:08 PM

Here is what just happened when browsing through freedailyporn.com(another site on 64.237.39.66 and same whois)

The following log shows clicking a link to a gallery and being redirected to trojans on the 85.255 ip range posing as spyware removers. The redirect happened instantly and all the other files you see loaded from the initial redirected page.
85.255.115.222/ind.htm?e404=1&src=124&surl=vip.clickzs.com

Code:

GET http://www.freedailyporn.com/
200 OK
***Click starts here***
GET http://vip.clickzs.com/tgp.php?fdp&thenudeteens.com/ebony/index.html
302 Found to http://85.255.115.222/ind.htm?e404=1&src=124&surl=vip.clickzs.com

GET http://85.255.115.222/ind.htm?e404=1&src=124&surl=vip.clickzs.com
200 OK

GET http://85.255.115.222/site.htm?lng=1&trg=cln&oip=0&trk=xicawxshtfnfffi
200 OK

GET http://85.255.115.222/_cntr.htm?trk=xicawxshtfnfffi
200 OK

GET http://free-spy-cam.net/index.htm?trk=xicawxshtfnfffi
200 OK

GET http://85.255.115.222/cnte-eshdvvw.htm?trk=xicawxshtfnfffi
200 OK

GET http://free-spy-cam.net/loading.htm
200 OK

GET http://69.50.172.115/sp/fpa/index.html
200 OK

GET http://85.255.115.222/cnte-ani_dthcbdg.htm?trk=xicawxshtfnfffi
200 OK

GET http://85.255.115.222/cnte-dhncgts.jar?trk=xicawxshtfnfffi
200 OK

GET http://85.255.115.222/back.htm
200 OK

GET http://85.255.115.222/com/ms/security/SecurityClassLoader.class
404 Not Found

GET http://85.255.115.222/riff_last.bin
200 OK

Tempest · 05-15-2007, 11:39 PM

Quote:

Originally Posted by Quickdraw

The following log shows clicking a link to a gallery and being redirected to trojans on the 85.255 ip range posing as spyware removers.

I believe that the server has been hacked with a modified version of apache... I've seen that before and that's what the host said. Not to me, but someone else.

Tempest · 05-15-2007, 11:45 PM

By the way 85.255.112.0 – 85.255.127.255 is INHOSTER and it looks like they're associated with Intercage and the codec installing "group".

graphicsp1mp · 05-16-2007, 02:37 AM

damn this shit is huge isnt it

nice find rowan

NTM · 05-16-2007, 02:42 AM

Clickzs

Turboface · 05-16-2007, 02:47 AM

Using a remotely hosted traffic trading script service is just a flawed idea from the get go.

en21 · 05-16-2007, 03:24 AM

those big site should be able to afford paid script

Iron Fist · 05-16-2007, 03:42 AM

Brutal. It's no wonder why I dont use any 3rd party software on my network, just can't trust anyone anymore.

percy · 05-16-2007, 04:14 AM

Hello,

it looks like our server has been hacked. We are working on the problem.

Thanks

Percy

percy · 05-16-2007, 04:38 AM

This was not our doing, someone hacked our server and placed something on the server causing that fake video player window and it's executable to appear. We are working on the problem and will have it fixed asap.

Thanks again

Percy
Netsaits/ClickZs

martinsc · 05-16-2007, 04:46 AM

Quote:

Originally Posted by percy

This was not our doing, someone hacked our server and placed something on the server causing that fake video player window and it's executable to appear. We are working on the problem and will have it fixed asap.

Thanks again

Percy
Netsaits/ClickZs

better get this fixed soon....

boneless · 05-16-2007, 05:32 AM

ah it was all an error peeps, nothing to see here.

same with that zango bs you guys pushed right? also a hack or error.

seems that clicksz gets more and more shitty, and i for one hope every big site owner will drop this shit on the fly.

Quickdraw · 05-16-2007, 06:15 AM

Quote:

Originally Posted by percy

Hello,

it looks like our server has been hacked. We are working on the problem.

Thanks

Percy

Are you able to tell how long ago you were hacked?

Godsmack · 05-16-2007, 06:56 AM

Quote:

Originally Posted by boneless

ah it was all an error peeps, nothing to see here.

same with that zango bs you guys pushed right? also a hack or error.

seems that clicksz gets more and more shitty, and i for one hope every big site owner will drop this shit on the fly.

Yeah, good thing there are hackers, so we can all blame them LOL

JamesK2 · 05-16-2007, 06:58 AM

Quote:

Originally Posted by boneless

ah it was all an error peeps, nothing to see here.

same with that zango bs you guys pushed right? also a hack or error.

u-Bob · 05-16-2007, 08:06 AM

Quote:

Originally Posted by Tempest

By the way 85.255.112.0 ? 85.255.127.255 is INHOSTER and it looks like they're associated with Intercage and the codec installing "group".

correct, inhost(er) is just one of many fake hosting companies used by scammers and thieves.

u-Bob · 05-16-2007, 08:07 AM

Quote:

Originally Posted by percy

it looks like our server has been hacked. We are working on the problem.

you'll have to do better than that...

percy · 05-16-2007, 08:53 AM

The executable was placed on our domain pornstarsxtra.com by a hacker. We do not know how they did it but there are just a few sites linking to that content (according to our server logs) and those sites are not ours. Check mommysuncensored dot com (not ours), the top left thumbs are linking to the content on our server (will probably be changed now we have removed the content from our server)

Anyone know the owner of mommysuncensored dot com?

Percy
Netsaits/ClickZs

RawAlex · 05-16-2007, 09:04 AM

percy, I got news for you... what you found on the domain isn't 10% of the hack. Good luck, the entire box is likely rooted beyond understanding.

yahoo-xxx-girls.com · 05-16-2007, 09:23 AM

Not a good way to conduct business, thanks for the heads up !

RawAlex · 05-16-2007, 09:53 AM

Quote:

Originally Posted by Tempest

By the way 85.255.112.0 ? 85.255.127.255 is INHOSTER and it looks like they're associated with Intercage and the codec installing "group".

This is an IP block that shouldn't be carried by anyone. It is amazing how much shit they are getting away with.

fris · 05-16-2007, 10:03 AM

use chkrootkit to find which files have been modified

RawAlex · 05-16-2007, 11:10 AM

Quote:

Originally Posted by Fris

use chkrootkit to find which files have been modified

Run it daily - because part of the trick is how they get access - the initial breakin occurs via FTP, usually obtained by a compromised webmaster PC. So the webmaster gets their server cleaned up, and the next day, they walk right back in (because even when you change the FTP or telnet passwords, they pick them right up again on your next access).

You need to check and clean not only the server, but any and all PCs that may have FTP or telnet access to the server, including all systems used by your hosting company that might have access.

Good fucking luck.

JD · 05-16-2007, 11:54 PM

fuck me....

rowan · 05-17-2007, 11:47 AM

bump....

rowan · 05-17-2007, 09:59 PM

One more bump

Quickdraw · 05-19-2007, 06:51 PM

Quote:

Originally Posted by Tempest

I believe that the server has been hacked with a modified version of apache... I've seen that before and that's what the host said. Not to me, but someone else.

I would like to believe that, this trojan redirect has been happening for months, and is still happening at this moment.

They took care of those videos right away, but the redirection to the trojans was never addressed. They have had plenty of time to clean up their server, so why is the redirect still happening? Lazy admin, bad host, maybe not a hack? The longer it takes to get fixed the less I believe it is a hack.

Aussie Rebel · 05-19-2007, 07:11 PM

Bump.....

boneless · 05-20-2007, 12:54 AM

as per my topic, thnk god for hacker, else there wasnt an excuse for this type of bad behaviour.

Godsmack · 05-21-2007, 12:56 AM

Quote:

Originally Posted by boneless

as per my topic, thnk god for hacker, else there wasnt an excuse for this type of bad behaviour.

LOL thats what i said earlier..

hdkiller · 05-21-2007, 02:26 AM

this is a gohackyourself thread?

boneless · 05-21-2007, 02:45 AM

Quote:

Originally Posted by hdkiller

this is a gohackyourself thread?

i think so yes

Godsmack · 05-21-2007, 05:00 PM

Quote:

Originally Posted by hdkiller

this is a gohackyourself thread?

Lolol, sure looks like it

rowan · 05-21-2007, 08:27 PM

Quote:

Originally Posted by hdkiller

this is a gohackyourself thread?

That's a better name for a knockoff board than many have come up with.

NyLoS · 06-03-2007, 03:49 AM

not again, gerco ! wake up !!! jeeez

klinton · 06-03-2007, 04:32 AM

Quote:

Originally Posted by Tempest

By the way 85.255.112.0 ? 85.255.127.255 is INHOSTER and it looks like they're associated with Intercage and the codec installing "group".

I have also problems with this ip on my sites....redirects...and I also don't know how this could happen :P...damn

biskoppen · 06-03-2007, 04:57 AM

Nice... another 100k users infected with the codec trojan, another drop in our sales...

Let me repeat myself.. : I'm pretty sure, from stuff I've seen, that these guys are in the top 3 of affiliates overall with all programs.. You have NO IDEA how much they're stealing

RawAlex · 06-03-2007, 07:21 AM

The amount they are stealing is pretty stunning - and most programs know it and smile and take their traffic anyway.

Tempest · 06-03-2007, 09:00 AM

Quote:

Originally Posted by klinton

I have also problems with this ip on my sites....redirects...and I also don't know how this could happen :P...damn

Have your host check the apache binary and ensure it hasn't been replaced.

klinton · 06-03-2007, 10:57 AM

Quote:

Originally Posted by Tempest

Have your host check the apache binary and ensure it hasn't been replaced.

at first I thought that it was dns cache poisoning...
but it looks like it is something different,maybe this what you are saying...hopefully..I'll contact them asap

ServerGenius · 06-03-2007, 11:03 AM

Quote:

Originally Posted by Fris

use chkrootkit to find which files have been modified

chkrootkit isn't nearly as good as rkunter free for download @ http://www.rootkit.nl/

Miguel T · 06-03-2007, 11:59 AM

Happy I dont use that ;)

Quickdraw · 07-13-2007, 09:38 AM

Still hacked? This redirect happened today.

htxp://cz8.clickzs.com/tgp.php?bbgx&60&CJ1&hxtp://galleries.babes.tv/mg/08/?nats=MTAwMDQ5OjM6Ng,0,0,0,1107875810&content=suzi ecarina2b

htxp://85.255.115.222/ind.htm?e404=1&src=130&surl=cz8.clickzs.com

05-15-2007, 08:38 PM	#1
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	WARNING! Clickzs.com associated with trojan/codec installs pornstarsxtra.com - came across this site mentioned on another board. It appears to be an old school paysite, but it also has pages that show a fake video player window (it's just an image, no attempt at embedding a video) with a link to an executable: Description of IE SecPlugin IE SecPlugin is an adware application that hijacks search page and monitors internet activities of the user. WHOIS shows the registrant as Netsaits BV with the admin contact Gerco Marsch. clickzs.com has the same details. clickzs.com lives at 64.237.39.70, pornstarsxtra.com lives at 64.237.39.66. 127 IPs from that block are allocated to Netsaits BV, which includes those two IPs. So we have these two domains sharing the same company name, same admin contact, same host, same IP block......... It's not the first time clickzs has been associated with shifty stuff, it wasn't so long ago that they were linking their buttons to Zango. So who links to clickzs? clickzs.com - Inlinks (166,840) www.clicksz.com - Inlinks (95,762) If they ever decided to be more blatant about their installs then there'd be a lot of shit going down.

05-15-2007, 08:41 PM	#2
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,481	a lot of people (big sites) use clickzs, this blows __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. My Cam Feeds Script

05-15-2007, 08:53 PM	#3
GAMEFINEST Make STACK$ Industry Role: Join Date: Nov 2006 Location: sexy time Posts: 14,474	good heaeds up __________________ Compound interest.

05-16-2007, 02:37 AM	#8
graphicsp1mp Registered User Join Date: May 2007 Location: Australia Posts: 35	damn this shit is huge isnt it nice find rowan __________________ Graphics Pimp

05-16-2007, 02:47 AM	#10
Turboface Back in Black Industry Role: Join Date: Mar 2002 Posts: 9,976	Using a remotely hosted traffic trading script service is just a flawed idea from the get go. __________________ Search Engine Optimization Services for Adult Sites

05-15-2007, 08:58 PM	#4
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	I think very few people either understand or choose to understand just how far these codec and spyware installers have gone into the porn business. I would place a guess today that 30% or more of the joins / money are going to these types of operations, either as direct sales or a traffic buys from PPC sites that use these tools to generate traffic.

05-15-2007, 11:45 PM	#7
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	By the way 85.255.112.0 – 85.255.127.255 is INHOSTER and it looks like they're associated with Intercage and the codec installing "group".

05-16-2007, 02:42 AM	#9
NTM So Fucking Banned Join Date: Jul 2006 Posts: 1,087	Clickzs

05-16-2007, 03:24 AM	#11
en21 Confirmed User Join Date: May 2006 Posts: 2,640	those big site should be able to afford paid script __________________ Free Asian Sex : http://www.asian4free.com Free Amateur Sex : http://www.lustamateur.com Free Porn : http://www.mysexbookmark.com Free Sex : http://www.goliathlist.com Free Hardcore : http://www.xlust.com Sex For Free : http://www.sexforfee.com

05-16-2007, 03:42 AM	#12
Iron Fist Too lazy to set a custom title Join Date: Dec 2006 Posts: 23,400	Brutal. It's no wonder why I dont use any 3rd party software on my network, just can't trust anyone anymore.

05-16-2007, 04:14 AM	#13
percy Registered User Join Date: Aug 2002 Posts: 11	Hello, it looks like our server has been hacked. We are working on the problem. Thanks Percy

05-16-2007, 04:38 AM	#14
percy Registered User Join Date: Aug 2002 Posts: 11	This was not our doing, someone hacked our server and placed something on the server causing that fake video player window and it's executable to appear. We are working on the problem and will have it fixed asap. Thanks again Percy Netsaits/ClickZs

05-16-2007, 05:32 AM	#16
boneless Confirmed User Industry Role: Join Date: Dec 2002 Location: in your head Posts: 3,625	ah it was all an error peeps, nothing to see here. same with that zango bs you guys pushed right? also a hack or error. seems that clicksz gets more and more shitty, and i for one hope every big site owner will drop this shit on the fly. __________________ icq:148573096 skype:dabone2 email:boneless(a)mgpteam(.)com

05-16-2007, 08:53 AM	#22
percy Registered User Join Date: Aug 2002 Posts: 11	The executable was placed on our domain pornstarsxtra.com by a hacker. We do not know how they did it but there are just a few sites linking to that content (according to our server logs) and those sites are not ours. Check mommysuncensored dot com (not ours), the top left thumbs are linking to the content on our server (will probably be changed now we have removed the content from our server) Anyone know the owner of mommysuncensored dot com? Percy Netsaits/ClickZs

05-16-2007, 09:04 AM	#23
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	percy, I got news for you... what you found on the domain isn't 10% of the hack. Good luck, the entire box is likely rooted beyond understanding.

05-16-2007, 09:23 AM	#24
yahoo-xxx-girls.com Confirmed User Join Date: Jul 2006 Location: Canada Posts: 3,143	Not a good way to conduct business, thanks for the heads up !

05-16-2007, 10:03 AM	#26
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,481	use chkrootkit to find which files have been modified

05-16-2007, 11:54 PM	#28
JD Too lazy to set a custom title Industry Role: Join Date: Sep 2003 Posts: 22,651	fuck me....

05-17-2007, 11:47 AM	#29
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	bump....

05-17-2007, 09:59 PM	#30
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	One more bump

05-19-2007, 07:11 PM	#32
Aussie Rebel Blow Me U Geeks Join Date: Aug 2001 Location: Maximum Security Posts: 5,108	Bump.....

05-20-2007, 12:54 AM	#33
boneless Confirmed User Industry Role: Join Date: Dec 2002 Location: in your head Posts: 3,625	as per my topic, thnk god for hacker, else there wasnt an excuse for this type of bad behaviour. __________________ icq:148573096 skype:dabone2 email:boneless(a)mgpteam(.)com

05-21-2007, 02:26 AM	#35
hdkiller Full time cybermage Industry Role: Join Date: Jun 2006 Location: Cyberspace Posts: 461	this is a gohackyourself thread? __________________ ClickPapa! - Buy and Sell traffic

06-03-2007, 03:49 AM	#39
NyLoS Confirmed User Join Date: Apr 2001 Location: Amsterdam Posts: 724	not again, gerco ! wake up !!! jeeez

06-03-2007, 04:57 AM	#41
biskoppen Confirmed User Join Date: Mar 2003 Location: Very small penis Posts: 5,809	Nice... another 100k users infected with the codec trojan, another drop in our sales... Let me repeat myself.. : I'm pretty sure, from stuff I've seen, that these guys are in the top 3 of affiliates overall with all programs.. You have NO IDEA how much they're stealing __________________ Submit my videos to make bank, tons of 5 minute videos offered right here

06-03-2007, 07:21 AM	#42
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	The amount they are stealing is pretty stunning - and most programs know it and smile and take their traffic anyway.

06-03-2007, 11:59 AM	#46
Miguel T ♦ Web Developer ♦ Industry Role: Join Date: May 2005 Location: Full-Stack Developer Posts: 12,472	Happy I dont use that ;) __________________ Full Stack Webdeveloper: HTML5/CSS3, jQuery, AJAX, ElevatedX, NATS, MechBunny, Wordpress

07-13-2007, 09:38 AM	#47
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	Still hacked? This redirect happened today. htxp://cz8.clickzs.com/tgp.php?bbgx&60&CJ1&hxtp://galleries.babes.tv/mg/08/?nats=MTAwMDQ5OjM6Ng,0,0,0,1107875810&content=suzi ecarina2b htxp://85.255.115.222/ind.htm?e404=1&src=130&surl=cz8.clickzs.com Last edited by Quickdraw; 07-13-2007 at 09:39 AM..