AOL Hitbot? - GoFuckYourself.com

GFED · 11-21-2002, 09:58 AM

I want more input on this... I've pointed a few people from ICQ to this thread and they all think it is a cheater... I need to know for sure because I found out who it is, and it would surprise many people...

http://bbs.adultwebmasterinfo.com/sh...threadid=36463

Jon · 11-21-2002, 10:05 AM

either you found an awesome trade, or its a hitbot.

what you should do now is test to see if the traffic thats clicking clicks through to a second page.. if they all stop at the first one, you damn well know somethings up. also, did any of them convert? if you dont know then perhaps you should set up a page just for this trade, and monitor it through a sponsor who has real time first page click reporting. thats my advice to check for a hitbotter.

GFED · 11-21-2002, 10:28 AM

Great advice bro... the thing is I deleted the trade a while ago... but just recently found out who it was... it's been bothering me ever since I found out... I don't want to call him a cheater without knowing for sure... He also had a fake toplist with a powered by UCJ on the page... I've ICQed Tim asking if there was ever a version registered to the domain... That will give me a little more security whether this guy is a cheater or not...

I would like to hear everyone's else's comments whether they think it's a hitbot or not... and why are they all AOL proxies... I will not release his name until I'm 100% convinced... right now I'm at 99.99%...

GFED · 11-21-2002, 11:08 AM

oki... I've found out that 99% of you can be hitbotted to hell and not even know it... this is very sad...

GFED · 11-21-2002, 11:37 AM

also take a look at the 205.xxx.xxx.xxx ips... there are only 2 of them coming in from that trade... but about a hundred going out from that trade... how is that possible?

GFED · 11-21-2002, 12:26 PM

JamesK · 11-21-2002, 12:52 PM

looks like a hitbot to me.

Bobby · 11-21-2002, 12:57 PM

GFED if you don't see the ip in your incoming it's a hitbot who try to increase their prod

pr0 · 11-21-2002, 12:59 PM

All signs point to yes

Wiredoctor · 11-21-2002, 01:14 PM

GFED,,,, you must tell us who it is?? he could be scamming others, and need to be brought public. Even if your wrong who cares, so you have to say sorry...... but if your right, you will have stopped a scammer to all of us?...

GFED · 11-21-2002, 01:15 PM

Thanks bros... keep the comments coming... so far out of all the dozens of people I've talked to on ICQ only one of them think it's not a cheater, one thinks I'm a paranoid fuck but doesn't even know how to view a log, a few aren't positive but agree the stats look weird, a lot agree that it's a cheater, but most are just confused by the numbers...

GFED · 11-21-2002, 01:18 PM

Quote:

Originally posted by Wiredoctor
GFED,,,, you must tell us who it is?? he could be scamming others, and need to be brought public. Even if your wrong who cares, so you have to say sorry...... but if your right, you will have stopped a scammer to all of us?...

I will let everyone know the name after I get a response from Tim... this guy had a fake toplist (that didn't go through the script) with Powered By UCJ at the bottom... I asked Tim if there has ever been a UCJ registered to this domain... I also asked him to take a look at the post... I do not want to announce any names without more comments and proof... I know I'm gonna get fucked as soon as I announce it... so I just want more views on it...

Trax · 11-21-2002, 01:27 PM

who cares if the ucj version is registered or not
if it is registered to him that does not mean he doesnt cheat

GFED · 11-21-2002, 01:28 PM

Quote:

Originally posted by Trax
who cares if the ucj version is registered or not
if it is registered to him that does not mean he doesnt cheat

true... so what is your opinion from looking at the logs?

Gman.357 · 11-21-2002, 01:44 PM

Quote:

Originally posted by GFED
also take a look at the 205.xxx.xxx.xxx ips... there are only 2 of them coming in from that trade... but about a hundred going out from that trade... how is that possible?

It could be feasible that 2 pple produced 100 clicks. That's only 50 each. If it's good targeted traffic, it's possible. Check to see what links they clicked. For instance, if the majority of the clicks were on your toplist, it's a cheater.

I've personally never heard of a hitbot that uses all aol proxies. Something for you to consider.

RMG · 11-21-2002, 01:51 PM

If all incomming traffic is aol.proxy its a sure bet its hitbot.

2c

guschi2k · 11-21-2002, 01:53 PM

.....i kicked a trade like that a few weeks ago......
...sure, everybody would be happy to have a trade with 1000% prod ;-) but if it looks to good to be true it usually is a cheater/hitbotter

i would also be very interested who it is...!!!

Trax · 11-21-2002, 01:59 PM

Quote:

Originally posted by GFED

true... so what is your opinion from looking at the logs?

wanna know
tell us who you are talking about and then let him argue
might not be his fault..maybe someone is hitbotting you with referer to harm you

Turboface · 11-21-2002, 02:44 PM

I'm just recovering from a hitbot attack myself. I woke up one day and saw these 4 sites had signed up through the script, for a trade. These trades seemed like godsends. They were almost too good to be true - and they were.

In UCJ-C 4.3 and above (I believe) have the proxy detection feature. I noticed a high number of proxies (in and out) related to the new trades. I blacklisted them, but not in time to cripple the rest of my real trades.

I'm recovering now slowly, but surely.

GFED · 11-21-2002, 03:48 PM

anyone else?

421Fill · 11-21-2002, 04:02 PM

dude, why do you keep flipping us off??? lol

XXXManager · 11-21-2002, 04:26 PM

Since the data is not mine I can only comment on the data and not on the accused. Also - since I have limited time analyzing the data I am assuming that comments brought here are based on accurate enough analysis.

1. A site faking a top-list is dishonest. That is close enough to cheating. (I did not establish this fact as truth since I have no access to the original site)
2. A site using illegal copy of a script is a cheater towards the script owner (Since no word from Tim is out it?s only a general not). If someone is cheating/stealing from someone its safe to assume he/she has little conscience barriers cheating you.
3. Haveing incoming traffic from the trader from 2 IPs of 255.*.*.* but productive clicks from the same trader from 100 IPs of 255.*.*.* is very illogical. I don?t know what trading system you use, but if you trust it to be accurate and correct then you should come to the conclusion the trader is a cheater. Productive clicks can only come from same IPs that was sent by the trader ? that?s the whole idea of productivity measurement. If that anomaly is what you indeed encounter it means that the trader emulated a hit on your site which is regarded as productive click while faking a cookie indicating the ?visitor? was sent through the trading system from him.
It also points to the following fact: The trader is most likely ? technically speaking ? dumb. This is due to one of the following reason: he forgot to pass those 100 IPs through the trading script to get them registered as sent hits. (well... you live and learn

)
4. Unlike what NiteChatDotTV said, IF the traffic is proxy traffic, it won?t necessarily help to put the traffic through a simple leading page test since enough bots out there ?know? to follow levels down.
BUT?
5. If most of your traffic is from AOL, I would suspect such a trader anyway. Last I checked AOL proxies were closed to non-AOL users (serving as gateway proxies internally). If that is the case and most traffic is AOL it is very likely that this is not proxy botting but IP spoofing botting. Differences are too long to count here.
Suffice to say, that may explain why the productive clicks were not registered as incoming hits (since they have to be first emulated through the IN procedure of the trading script, and it?s a pain in the ass to waste time on being so organized). What can be done in spoof botting is basically saving the cookie once for one IP and using it to emulate prod clicks with random spoofed IPs. You can see now why the 100 255.*.*.* IPs were not registered as IN traffic!/?
6. The general rule of ?If it?s too good to be true ? it probably is? may be right in TGP/CJ trading. But don?t be too quick to use it.

Summing it all down:
* Very high proxy incoming traffic
* Productive clicks from non-registered IN IPs
* Very high AOL traffic (either as IN or PROD)
* A site that fakes a UCJ top-list and/or uses an illegal copy of a trading script
If all points above are facts ? It is way past the ?good-enough-for-me? scale for cheater-proven trade.

GFED · 11-21-2002, 05:06 PM

Oki, the UCJ was registered... but as Trax said it really doesn't mean anything...

I know what it looks like when a trade is being hitbotted from someone else... and I know what a file leech looks like... This is definately neither... This looks like someone spoofing AOL proxies... I'm posting the name now to see what he has to say... I could be totally wrong... and I hope I am... but anyone that has been trading for a while and has experience with catching cheaters can read these numbers...

Like I said before... this trade is from 3 months ago... I was suspicious of the trade because the toplist was faked, and my Site Name on the toplist didn't even go to my URL. When I clicked around on the gallery links, I never even went to my site...

Well here is the domain... http://tunafishbitch.com
I went to it just to see if the site was still up one day and its a message board owned by the one and only 12clicks...

Oki... so let's hear it...

XXXManager · 11-21-2002, 05:13 PM

Pass me the popcorn folks

tree · 11-21-2002, 05:15 PM

b00yA

pr0 · 11-21-2002, 05:43 PM

Are you calling 12clicks a message board hitbotter?

GFED · 11-21-2002, 05:52 PM

Quote:

Originally posted by pr0
Are you calling 12clicks a message board hitbotter?

There was a TGP there before... I went to the domain recently to see if it was still up and it's a BBS now... I spoke to 12clicks on ICQ and he told me that Gary ran the TGP for him...

Za Ha · 11-21-2002, 10:11 PM

And people accuse me of cheating...

Easy · 11-22-2002, 12:58 AM

weird that the TGP is gone now

11-21-2002, 09:58 AM	#1
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	AOL Hitbot? I want more input on this... I've pointed a few people from ICQ to this thread and they all think it is a cheater... I need to know for sure because I found out who it is, and it would surprise many people... http://bbs.adultwebmasterinfo.com/sh...threadid=36463 __________________ https://www.flow.page/savethechildren

11-21-2002, 10:05 AM	#2
Jon Confirmed User Industry Role: Join Date: Jun 2002 Location: New York City Posts: 2,578	either you found an awesome trade, or its a hitbot. what you should do now is test to see if the traffic thats clicking clicks through to a second page.. if they all stop at the first one, you damn well know somethings up. also, did any of them convert? if you dont know then perhaps you should set up a page just for this trade, and monitor it through a sponsor who has real time first page click reporting. thats my advice to check for a hitbotter. __________________ WickedFire.com - Stay here. We don't need more of you. Not unless you have money, then, fine...

11-21-2002, 10:28 AM	#3
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	Great advice bro... the thing is I deleted the trade a while ago... but just recently found out who it was... it's been bothering me ever since I found out... I don't want to call him a cheater without knowing for sure... He also had a fake toplist with a powered by UCJ on the page... I've ICQed Tim asking if there was ever a version registered to the domain... That will give me a little more security whether this guy is a cheater or not... I would like to hear everyone's else's comments whether they think it's a hitbot or not... and why are they all AOL proxies... I will not release his name until I'm 100% convinced... right now I'm at 99.99%... __________________ https://www.flow.page/savethechildren

11-21-2002, 11:08 AM	#4
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	oki... I've found out that 99% of you can be hitbotted to hell and not even know it... this is very sad... __________________ https://www.flow.page/savethechildren

11-21-2002, 11:37 AM	#5
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	also take a look at the 205.xxx.xxx.xxx ips... there are only 2 of them coming in from that trade... but about a hundred going out from that trade... how is that possible? __________________ https://www.flow.page/savethechildren

11-21-2002, 12:26 PM	#6
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	. __________________ https://www.flow.page/savethechildren

11-21-2002, 12:52 PM	#7
JamesK hi Industry Role: Join Date: Jun 2002 Posts: 16,731	looks like a hitbot to me. __________________ M3Server - NATS Hosting

11-21-2002, 12:57 PM	#8
Bobby Registered User Join Date: Aug 2001 Location: Canada Posts: 99	GFED if you don't see the ip in your incoming it's a hitbot who try to increase their prod __________________ Yahoo

11-21-2002, 12:59 PM	#9
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088	All signs point to yes

11-21-2002, 01:14 PM	#10
Wiredoctor Confirmed User Join Date: Dec 2001 Location: The Great USA Posts: 1,632	GFED,,,, you must tell us who it is?? he could be scamming others, and need to be brought public. Even if your wrong who cares, so you have to say sorry...... but if your right, you will have stopped a scammer to all of us?... __________________ Search For Everything In One Easy Portal Big Juicy Nipples.com

11-21-2002, 01:15 PM	#11
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	Thanks bros... keep the comments coming... so far out of all the dozens of people I've talked to on ICQ only one of them think it's not a cheater, one thinks I'm a paranoid fuck but doesn't even know how to view a log, a few aren't positive but agree the stats look weird, a lot agree that it's a cheater, but most are just confused by the numbers... __________________ https://www.flow.page/savethechildren

11-21-2002, 01:27 PM	#13
Trax [----------------------] Join Date: Aug 2001 Posts: 14,486	who cares if the ucj version is registered or not if it is registered to him that does not mean he doesnt cheat

11-21-2002, 01:51 PM	#16
RMG Confirmed User Join Date: Apr 2002 Posts: 542	If all incomming traffic is aol.proxy its a sure bet its hitbot. 2c

11-21-2002, 01:53 PM	#17
guschi2k Confirmed User Join Date: Aug 2002 Location: ...blablablabla... Posts: 489	.....i kicked a trade like that a few weeks ago...... ...sure, everybody would be happy to have a trade with 1000% prod ;-) but if it looks to good to be true it usually is a cheater/hitbotter i would also be very interested who it is...!!! __________________ $$$ PimpRoll converts like a mofu, don't miss out on this shit $$$

11-21-2002, 02:44 PM	#19
Turboface Back in Black Industry Role: Join Date: Mar 2002 Posts: 9,976	I'm just recovering from a hitbot attack myself. I woke up one day and saw these 4 sites had signed up through the script, for a trade. These trades seemed like godsends. They were almost too good to be true - and they were. In UCJ-C 4.3 and above (I believe) have the proxy detection feature. I noticed a high number of proxies (in and out) related to the new trades. I blacklisted them, but not in time to cripple the rest of my real trades. I'm recovering now slowly, but surely. __________________ Search Engine Optimization Services for Adult Sites

11-21-2002, 03:48 PM	#20
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	anyone else? __________________ https://www.flow.page/savethechildren

11-21-2002, 04:02 PM	#21
421Fill Super Mario Industry Role: Join Date: Nov 2001 Location: Swenson's Avatar Posts: 19,418	dude, why do you keep flipping us off??? lol __________________ RELEASE THE EPSTEIN FILES!!!

11-21-2002, 04:26 PM	#22
XXXManager So Fucking Banned Join Date: Mar 2002 Location: Far out in the uncharted backwaters of the unfashionable end of the Western Spiral arm of the Galaxy Posts: 893	Since the data is not mine I can only comment on the data and not on the accused. Also - since I have limited time analyzing the data I am assuming that comments brought here are based on accurate enough analysis. 1. A site faking a top-list is dishonest. That is close enough to cheating. (I did not establish this fact as truth since I have no access to the original site) 2. A site using illegal copy of a script is a cheater towards the script owner (Since no word from Tim is out it?s only a general not). If someone is cheating/stealing from someone its safe to assume he/she has little conscience barriers cheating you. 3. Haveing incoming traffic from the trader from 2 IPs of 255...* but productive clicks from the same trader from 100 IPs of 255...* is very illogical. I don?t know what trading system you use, but if you trust it to be accurate and correct then you should come to the conclusion the trader is a cheater. Productive clicks can only come from same IPs that was sent by the trader ? that?s the whole idea of productivity measurement. If that anomaly is what you indeed encounter it means that the trader emulated a hit on your site which is regarded as productive click while faking a cookie indicating the ?visitor? was sent through the trading system from him. It also points to the following fact: The trader is most likely ? technically speaking ? dumb. This is due to one of the following reason: he forgot to pass those 100 IPs through the trading script to get them registered as sent hits. (well... you live and learn ) 4. Unlike what NiteChatDotTV said, IF the traffic is proxy traffic, it won?t necessarily help to put the traffic through a simple leading page test since enough bots out there ?know? to follow levels down. BUT? 5. If most of your traffic is from AOL, I would suspect such a trader anyway. Last I checked AOL proxies were closed to non-AOL users (serving as gateway proxies internally). If that is the case and most traffic is AOL it is very likely that this is not proxy botting but IP spoofing botting. Differences are too long to count here. Suffice to say, that may explain why the productive clicks were not registered as incoming hits (since they have to be first emulated through the IN procedure of the trading script, and it?s a pain in the ass to waste time on being so organized). What can be done in spoof botting is basically saving the cookie once for one IP and using it to emulate prod clicks with random spoofed IPs. You can see now why the 100 255...* IPs were not registered as IN traffic!/? 6. The general rule of ?If it?s too good to be true ? it probably is? may be right in TGP/CJ trading. But don?t be too quick to use it. Summing it all down: * Very high proxy incoming traffic * Productive clicks from non-registered IN IPs * Very high AOL traffic (either as IN or PROD) * A site that fakes a UCJ top-list and/or uses an illegal copy of a trading script If all points above are facts ? It is way past the ?good-enough-for-me? scale for cheater-proven trade. Last edited by XXXManager; 11-21-2002 at 04:28 PM..

11-21-2002, 05:06 PM	#23
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	Oki, the UCJ was registered... but as Trax said it really doesn't mean anything... I know what it looks like when a trade is being hitbotted from someone else... and I know what a file leech looks like... This is definately neither... This looks like someone spoofing AOL proxies... I'm posting the name now to see what he has to say... I could be totally wrong... and I hope I am... but anyone that has been trading for a while and has experience with catching cheaters can read these numbers... Like I said before... this trade is from 3 months ago... I was suspicious of the trade because the toplist was faked, and my Site Name on the toplist didn't even go to my URL. When I clicked around on the gallery links, I never even went to my site... Well here is the domain... http://tunafishbitch.com I went to it just to see if the site was still up one day and its a message board owned by the one and only 12clicks... Oki... so let's hear it... __________________ https://www.flow.page/savethechildren

11-21-2002, 05:13 PM	#24
XXXManager So Fucking Banned Join Date: Mar 2002 Location: Far out in the uncharted backwaters of the unfashionable end of the Western Spiral arm of the Galaxy Posts: 893	Pass me the popcorn folks

11-21-2002, 05:15 PM	#25
tree Confirmed User Join Date: Nov 2001 Posts: 1,601	b00yA

11-21-2002, 05:43 PM	#26
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088	Are you calling 12clicks a message board hitbotter?

11-21-2002, 10:11 PM	#28
Za Ha Confirmed User Join Date: Oct 2001 Location: Still lost Posts: 5,112	And people accuse me of cheating...

11-22-2002, 12:58 AM	#29
Easy Registered User Join Date: Feb 2002 Location: Backyard Posts: 79	weird that the TGP is gone now