DOS attack expert? - GoFuckYourself.com

strongdong · 02-24-2008, 11:25 PM

3000+ plus IP's coming my way, SteveA is the icq of the guy doing it (428-764-610) he also has icq 'davide' (168-203-434, or it is his partner)...He also installed some rootkit which has deleted everything on one of my drives. I talked to him briefly (steveA) on icq here is an exerpt:

Date : 2/24/2008 Time : 4:45 PM
From : SteveA
look igor..i dont want to steal your site or any harm to you ...we just want a
fair cut from your biz...nothing personal ec

and another exerpt where he threatens to attack another one of my sites which he eventually did...(read from bottom to top):

Date : 2/24/2008 Time : 3:16 PM
From : SteveA
should i come to moviesguy to ?

Date : 2/24/2008 Time : 3:16 PM
To : Ig

Date : 2/24/2008 Time : 3:16 PM
To : Ig
?

Date : 2/24/2008 Time : 3:16 PM
To : Ig
shall i come to hamburg

Date : 2/24/2008 Time : 3:16 PM
From : SteveA
hi

Date : 2/24/2008 Time : 3:16 PM
To : Ig
hi

Date : 2/24/2008 Time : 3:16 PM
From : SteveA
oh really ?

Date : 2/24/2008 Time : 3:15 PM
To : Ig
the guy you are stealing traffic from

Date : 2/24/2008 Time : 3:15 PM
From : SteveA
who am i speaking to ?

Date : 2/24/2008 Time : 3:15 PM
To : Ig
can you stop the attack on my site please

Date : 2/24/2008 Time : 3:15 PM
From : SteveA
yes

Date : 2/24/2008 Time : 3:14 PM
To : Ig
Matthais ?

Date : 2/24/2008 Time : 3:14 PM
To : Ig
hi

His infos are as follows:

Checks payable to : Matthias MÃ¶nch
Email : [email protected]
ICQ : 428764610
Address : Zimmerstrasse 55a
Country : Hamburg, Hamburg 22085 Germany

Hit me up if you can help! 78861564

kmanrox · 02-24-2008, 11:28 PM

dayummm grouchyadmin, u awake?

Brent 3dSexCash · 02-24-2008, 11:34 PM

lol

hit me up and I can help you out

jpoker · 02-24-2008, 11:46 PM

bump bump bump

kmanrox · 02-25-2008, 12:21 AM

bump for revenge

darksoul · 02-25-2008, 12:35 AM

157717888

jscott · 02-25-2008, 01:17 AM

Jizzstars is hitting up SpermShack too, supposedly got some hacks on that site

mrkrabs · 02-25-2008, 03:37 AM

bump for youu

V_RocKs · 02-25-2008, 03:40 AM

This is why we need ABC trading for knee caps...

Davy · 02-25-2008, 04:43 AM

Quote:

Originally Posted by strongdong

From : SteveA
look igor..i dont want to steal your site or any harm to you ...we just want a
fair cut from your biz...nothing personal ec

What the fuck???
I hope you get this asshole.

The Judge · 02-25-2008, 04:49 AM

tell him you want to pay in person

qw12er · 02-25-2008, 06:04 AM

Quote:

Originally Posted by The Judge

tell him you want to pay in person

and bring a gun ! lol

testpie · 02-25-2008, 06:32 AM

Quote:

Originally Posted by strongdong

3000+ plus IP's coming my way, SteveA is the icq of the guy doing it (428-764-610) he also has icq 'davide' (168-203-434, or it is his partner)...He also installed some rootkit which has deleted everything on one of my drives. I talked to him briefly (steveA) on icq here is an exerpt:

Date : 2/24/2008 Time : 4:45 PM
From : SteveA
look igor..i dont want to steal your site or any harm to you ...we just want a
fair cut from your biz...nothing personal ec

and another exerpt where he threatens to attack another one of my sites which he eventually did...(read from bottom to top):

Date : 2/24/2008 Time : 3:16 PM
From : SteveA
should i come to moviesguy to ?

Date : 2/24/2008 Time : 3:16 PM
To : Ig

Date : 2/24/2008 Time : 3:16 PM
To : Ig
?

Date : 2/24/2008 Time : 3:16 PM
To : Ig
shall i come to hamburg

Date : 2/24/2008 Time : 3:16 PM
From : SteveA
hi

Date : 2/24/2008 Time : 3:16 PM
To : Ig
hi

Date : 2/24/2008 Time : 3:16 PM
From : SteveA
oh really ?

Date : 2/24/2008 Time : 3:15 PM
To : Ig
the guy you are stealing traffic from

Date : 2/24/2008 Time : 3:15 PM
From : SteveA
who am i speaking to ?

Date : 2/24/2008 Time : 3:15 PM
To : Ig
can you stop the attack on my site please

Date : 2/24/2008 Time : 3:15 PM
From : SteveA
yes

Date : 2/24/2008 Time : 3:14 PM
To : Ig
Matthais ?

Date : 2/24/2008 Time : 3:14 PM
To : Ig
hi

His infos are as follows:

Checks payable to : Matthias Mönch
Email : [email protected]
ICQ : 428764610
Address : Zimmerstrasse 55a
Country : Hamburg, Hamburg 22085 Germany

Hit me up if you can help! 78861564

Go hire some freelance hacker to hack into his botnet control machine and mass DDoS the law enforcement organisation of your choice and sit back and wait.

strongdong · 02-25-2008, 09:08 AM

I am still being attacked by this idiot...he has attempted more extortions during the night, this time he has demanded traffic

The Judge · 02-25-2008, 09:12 AM

where does he want it sent? maybe u can track him that way or find a way to DOS his sites

Quote:

Originally Posted by strongdong

I am still being attacked by this idiot...he has attempted more extortions during the night, this time he has demanded traffic

ladida · 02-25-2008, 09:16 AM

Does anyone actually pay extortion like this?

If you don't have a $5 account, get on your host to sort that shit. If you run a larger operation then a tgp or something, hire someone to clean your server of the shit.

Jens Van Assterdam · 02-25-2008, 09:19 AM

Quote:

Originally Posted by strongdong

Checks payable to : Matthias Mönch
Email : [email protected]
ICQ : 428764610
Address : Zimmerstrasse 55a
Country : Hamburg, Hamburg 22085 Germany

Hit me up if you can help! 78861564

I doubt its his real info. This name is a way to famous in europe for scams/ddos/thiefs..

strongdong · 02-25-2008, 09:54 AM

Quote:

Originally Posted by Machete Rodriguez

I doubt its his real info. This name is a way to famous in europe for scams/ddos/thiefs..

He was going to have payments sent to that name.

Roald · 02-25-2008, 09:58 AM

Quote:

Originally Posted by strongdong

He was going to have payments sent to that name.

he is attacking 2 sites?

strongdong · 02-25-2008, 10:01 AM

he attacking 3 servers

strongdong · 02-25-2008, 10:01 AM

jizzonline.com moviesguy.com jizzhut.com

d-null · 02-25-2008, 10:04 AM

How much do these guys charge for an attack?

strongdong · 02-25-2008, 10:17 AM

Ig (9:10 AM) :
so now, i start to call the police
SteveA (9:10 AM) :
go go
Ig (9:10 AM) :
ok :-(
SteveA (9:11 AM) :
but wont except to come online earlier then 2 weeks
SteveA (9:11 AM) :
expect...

CyberHustler · 02-25-2008, 10:19 AM

Man... Thats fucked.

rockbear · 02-25-2008, 10:21 AM

Who hosting you? they can't help you?

Roald · 02-25-2008, 10:22 AM

I asume your host is on it too?

Fuck man, this is seriously fucked

strongdong · 02-25-2008, 10:50 AM

so far, they have now blocked 13,000 IPs

strongdong · 02-25-2008, 10:53 AM

biggest attack alphared has ever seen

Evil E · 02-25-2008, 11:12 AM

Damn that sucks. Sounds like a botnet attack. Did you get his ip off ICQ so you could send it to your host/proper authorities for investigation?

strongdong · 02-25-2008, 11:17 AM

Quote:

Originally Posted by Evil E

Damn that sucks. Sounds like a botnet attack. Did you get his ip off ICQ so you could send it to your host/proper authorities for investigation?

How can i find his IP from icq?

Evil E · 02-25-2008, 12:25 PM

Normally you can find it just within the ICQ infos. If not there is software to check it out, or you could check with a netstat.

Fucksakes · 02-25-2008, 12:35 PM

coming from the guy with the most honest history as a webmaster, sucks doesnt it?

The Judge · 02-25-2008, 01:08 PM

It sounds like you sold the guy a PA and he didn't make his money back so now he's paying back

dav3 · 02-25-2008, 02:08 PM

Here's what you should do.

Plan A:
1. Arrange to make payment
2. Shit in a box and mail it to him

Plan B:
1. Arrange to make payment
2. Show up at his house with a few friends
3. Break his fingers

Pirates>ninja · 02-25-2008, 02:27 PM

that sucks

no fun to have people take your gold and treasure

fryer · 02-25-2008, 02:42 PM

There is a very simple way to deal with this. Here is the breakdown.

If he is justing DoS'ing then it can be blocked. Your host probably won't do it for you as its too many IP's and their uplink provider will probably just shut you off.

SO

Goto prolexic.com and they can filter all of the traffic for you and only give you non DDoS traffic. This is pretty much the only way. Even if you have a firewall some providers uplinks will not let the traffic through making your firewall useless. If you tell them prolexic is filtering it for you then you shouldn't have a problem. They'll turn it back on.

As for hacking your boxes I'm not sure what to say other than make sure you utilize hosts.allow / hosts.deny and only allow access from IP's that are yours. This will help a bit. If its the web software he's getting in through then you have another problem

strongdong · 02-25-2008, 02:58 PM

just talked to the fucker on the phone 01141762517903 zurich switzerland, i think?

The Judge · 02-25-2008, 03:57 PM

most likely voip, he is probably in russia

Quote:

Originally Posted by strongdong

just talked to the fucker on the phone 01141762517903 zurich switzerland, i think?

bashbug · 02-25-2008, 04:33 PM

try netstat -a to show active connections

strongdong · 02-25-2008, 06:36 PM

Quote:

Originally Posted by The Judge

most likely voip, he is probably in russia

why russia? His accent was not russian (I can spot a russian accent).

GrouchyAdmin · 02-25-2008, 06:41 PM

Part of the issue is the network you're on; you can begin to throttle connections and block them from the system with IPF and iptables; but when there's a bot net turned towards you, it's easiest to just filter from a big fucking Cisco sitting in front of your machine.

strongdong · 02-25-2008, 07:29 PM

I asked him on the phone, 'why are you such a scumbag?' his answer, 'ask my mother' .....

The Judge · 02-25-2008, 07:33 PM

KGB accent reduction training. In what language were you talking to him?

Quote:

Originally Posted by strongdong

why russia? His accent was not russian (I can spot a russian accent).

strongdong · 02-25-2008, 09:07 PM

Quote:

Originally Posted by The Judge

KGB accent reduction training. In what language were you talking to him?

Talked to him in English

TidalWave · 02-25-2008, 09:13 PM

http://www.ddosprotection.com/

they can filter your traffic remotely then forward only legit traffic, but you still stay hosted where you are at now

The Judge · 02-25-2008, 09:56 PM

Not that it matters in this case but wouldn't that kill SERPs?

Quote:

Originally Posted by TidalWave

http://www.ddosprotection.com/

they can filter your traffic remotely then forward only legit traffic, but you still stay hosted where you are at now

TidalWave · 02-25-2008, 10:00 PM

No idea, i would assume flat out being down would do more damage

brandonstills · 02-26-2008, 12:27 AM

What you're still using DOS? 3000 unique IP's is a lot though. I've been on the end of some brute force cracking attacks but never that many IP's.

strongdong · 02-26-2008, 10:48 AM

this fucker is back at it again today, sites are down...going on day 3 of the attacks now

chelo - adultcopywriters · 02-26-2008, 04:49 PM

fuck, these guys need to be imprisoned mate, you deserved this bump!
Good luck getting your hands on this fucker!

02-24-2008, 11:28 PM	#2
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,295	dayummm grouchyadmin, u awake? __________________ Crypto HODLr Crypto mining Angel investor

02-24-2008, 11:46 PM	#4
jpoker Confirmed User Join Date: Feb 2003 Location: Vancouver Posts: 362	bump bump bump __________________ http://www.bigboobdreams.com Big Juicy Healthy Boobs

02-25-2008, 12:21 AM	#5
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,295	bump for revenge __________________ Crypto HODLr Crypto mining Angel investor

02-25-2008, 12:35 AM	#6
darksoul Confirmed User Join Date: Apr 2002 Location: /root/ Posts: 4,997	157717888 __________________ 1337 5y54\|)m1n: 157717888 BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN Cambooth

02-24-2008, 11:34 PM	#3
Brent 3dSexCash Octopus Anime Industry Role: Join Date: Sep 2007 Location: Chicago Posts: 1,064	lol hit me up and I can help you out

02-25-2008, 01:17 AM	#7
jscott jscizzle Industry Role: Join Date: Feb 2001 Location: Taipei Posts: 25,343	Jizzstars is hitting up SpermShack too, supposedly got some hacks on that site __________________ “If you think tough men are dangerous, wait until you see what weak men are capable of.” —Jordan B. Peterson Listen to Pomp tell why is Bitcoin important

02-25-2008, 03:37 AM	#8
mrkrabs Confirmed User Join Date: Mar 2007 Location: Somewhere between heaven and hell Posts: 567	bump for youu __________________

02-25-2008, 03:40 AM	#9
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,428	This is why we need ABC trading for knee caps...

02-25-2008, 04:49 AM	#11
The Judge Confirmed User Join Date: Jan 2006 Location: Mobile, AL Posts: 1,647	tell him you want to pay in person __________________

02-25-2008, 09:08 AM	#14
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	I am still being attacked by this idiot...he has attempted more extortions during the night, this time he has demanded traffic

02-25-2008, 09:16 AM	#16
ladida Confirmed User Join Date: Nov 2005 Posts: 2,172	Does anyone actually pay extortion like this? If you don't have a $5 account, get on your host to sort that shit. If you run a larger operation then a tgp or something, hire someone to clean your server of the shit. __________________ agentGFY at gmail.com

02-25-2008, 10:01 AM	#20
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	he attacking 3 servers

02-25-2008, 10:04 AM	#22
d-null . . . Industry Role: Join Date: Apr 2007 Location: NY Posts: 13,724	How much do these guys charge for an attack?

02-25-2008, 10:17 AM	#23
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	Ig (9:10 AM) : so now, i start to call the police SteveA (9:10 AM) : go go Ig (9:10 AM) : ok :-( SteveA (9:11 AM) : but wont except to come online earlier then 2 weeks SteveA (9:11 AM) : expect...

02-25-2008, 10:19 AM	#24
CyberHustler Masterbaiter Industry Role: Join Date: Feb 2006 Posts: 28,144	Man... Thats fucked. __________________ “If you can convince the lowest white man he’s better than the best colored man, he won’t notice you’re picking his pocket. Hell, give him somebody to look down on, and he’ll empty his pockets for you.”

02-25-2008, 10:21 AM	#25
rockbear Confirmed User Join Date: Jul 2003 Posts: 806	Who hosting you? they can't help you?

02-25-2008, 10:22 AM	#26
Roald SecretFriends.com Industry Role: Join Date: May 2001 Location: IMC Headquarters Posts: 27,903	I asume your host is on it too? Fuck man, this is seriously fucked __________________ WE ARE BUYING PAY SITES! CONTACT ME ClubSweethearts \| ManUpFilms \| SinfulXXX \| HOT * AdultPrime * HOT Paying webmasters since 1996! Contact: r.riepen @ sansylgroup.com \| telegram: roaldr

02-25-2008, 10:50 AM	#27
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	so far, they have now blocked 13,000 IPs

02-25-2008, 10:53 AM	#28
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	biggest attack alphared has ever seen

02-25-2008, 11:12 AM	#29
Evil E Confirmed User Join Date: Apr 2005 Location: Lazyness is a lifestyle Posts: 3,201	Damn that sucks. Sounds like a botnet attack. Did you get his ip off ICQ so you could send it to your host/proper authorities for investigation?

02-25-2008, 12:25 PM	#31
Evil E Confirmed User Join Date: Apr 2005 Location: Lazyness is a lifestyle Posts: 3,201	Normally you can find it just within the ICQ infos. If not there is software to check it out, or you could check with a netstat.

02-25-2008, 12:35 PM	#32
Fucksakes Shit... Fuck! What the Hell? Industry Role: Join Date: Dec 2003 Posts: 7,567	coming from the guy with the most honest history as a webmaster, sucks doesnt it?

02-25-2008, 01:08 PM	#33
The Judge Confirmed User Join Date: Jan 2006 Location: Mobile, AL Posts: 1,647	It sounds like you sold the guy a PA and he didn't make his money back so now he's paying back __________________

02-25-2008, 02:08 PM	#34
dav3 Confirmed User Industry Role: Join Date: May 2007 Posts: 7,348	Here's what you should do. Plan A: 1. Arrange to make payment 2. Shit in a box and mail it to him Plan B: 1. Arrange to make payment 2. Show up at his house with a few friends 3. Break his fingers __________________ Webmasters :: Juicy Ads :: ACWM :: Crak Revenue :: Money Tree

02-25-2008, 02:27 PM	#35
Pirates>ninja Registered User Join Date: Oct 2007 Posts: 60	that sucks no fun to have people take your gold and treasure

02-25-2008, 02:42 PM	#36
fryer Confirmed User Join Date: Oct 2005 Location: California Posts: 395	There is a very simple way to deal with this. Here is the breakdown. If he is justing DoS'ing then it can be blocked. Your host probably won't do it for you as its too many IP's and their uplink provider will probably just shut you off. SO Goto prolexic.com and they can filter all of the traffic for you and only give you non DDoS traffic. This is pretty much the only way. Even if you have a firewall some providers uplinks will not let the traffic through making your firewall useless. If you tell them prolexic is filtering it for you then you shouldn't have a problem. They'll turn it back on. As for hacking your boxes I'm not sure what to say other than make sure you utilize hosts.allow / hosts.deny and only allow access from IP's that are yours. This will help a bit. If its the web software he's getting in through then you have another problem __________________ fryer WebCamClub/TextNDate Product Manager icq: 576955851

02-25-2008, 02:58 PM	#37
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	just talked to the fucker on the phone 01141762517903 zurich switzerland, i think?

02-25-2008, 04:33 PM	#39
bashbug Confirmed User Join Date: Oct 2005 Location: Boston Posts: 929	try netstat -a to show active connections

02-25-2008, 06:41 PM	#41
GrouchyAdmin Now choke yourself! Industry Role: Join Date: Apr 2006 Posts: 12,085	Part of the issue is the network you're on; you can begin to throttle connections and block them from the system with IPF and iptables; but when there's a bot net turned towards you, it's easiest to just filter from a big fucking Cisco sitting in front of your machine. __________________ AIM: GrouchyGfy

02-25-2008, 07:29 PM	#42
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	I asked him on the phone, 'why are you such a scumbag?' his answer, 'ask my mother' .....

02-25-2008, 09:13 PM	#45
TidalWave Confirmed User Industry Role: Join Date: Sep 2007 Location: Los Angeles Posts: 2,706	http://www.ddosprotection.com/ they can filter your traffic remotely then forward only legit traffic, but you still stay hosted where you are at now __________________ www.SwiftNode.com

02-25-2008, 10:00 PM	#47
TidalWave Confirmed User Industry Role: Join Date: Sep 2007 Location: Los Angeles Posts: 2,706	No idea, i would assume flat out being down would do more damage __________________ www.SwiftNode.com

02-26-2008, 12:27 AM	#48
brandonstills Confirmed User Join Date: Dec 2007 Location: Chatsworth, CA Posts: 1,964	What you're still using DOS? 3000 unique IP's is a lot though. I've been on the end of some brute force cracking attacks but never that many IP's. __________________ Brandon Stills Industry and programming veteran [email protected] \| skype: brandonstills \| ICQ #495-171-318

02-26-2008, 10:48 AM	#49
strongdong Confirmed User Join Date: Sep 2003 Posts: 191	this fucker is back at it again today, sites are down...going on day 3 of the attacks now