GoFuckYourself.com - Adult Webmaster Forum

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)
-   Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)
-   -   Attention ALL GFY MEMBERS. We're being robbed (https://gfy.com/showthread.php?t=713306)

JD 03-09-2007 08:51 PM

Attention ALL GFY MEMBERS. We're being robbed
 
There is some serious shit going down on the net that is a most likely effecting all of us. I know I've been hit pretty hard...

reposted from another board (icq me for link)

Quote:

Over the past couple months (at least) there has been a very large spyware network growing among adult site surfers. During the past couple days there has been a large and noticeable increase in activity. What is happening is that the spyware/malware is replacing affiliate codes with the code of the spyware authors. This is nothing new however the number of people that are being affected now is much larger than normal.

This is reportedly affecting 4-5% of all adult site traffic atm, presumably affecting TGP/MGP traffic to a much more significant extent because that is the traffic base the spyware is likely being distributed from. As a matter of speculation, if it's averaging 4-5% overall, that might be more like 1-2% of SE traffic and 10-20% of TGP/MGP traffic. So webmasters relying heavily on SE traffic are less likely to have noticed a drop in ratios as compared to freesite traffic.

The processors and many paysites have been aware of this for some time but are not speaking about it publically. They do not have a solution for it. Perhaps out of fear of losing affiliate confidence, this has not been publicized. CCBill is according to my source aware of it and seems to be the sponsor hardest hit.

I've been told some programs are ignoring it completely, while others are cancelling the spyware accounts and keeping the extra sales themselves. Either way, the processors see the same # of signups, as do the programs. The only people getting screwed out of this are the affiliates.

They have some information as to who is behind this, it appears to be a crime ring based in the Ukraine with enough resources to either have the cooperation of a webhost or own their own hosting center. I have a list of IP's that have been known to provide the spyware but will not make this data public, it is entirely possible that the authors of the spyware are reading this very forum.

Another server in the same class B IP range as this one has been using trojans disguised as codecs to generate fake traffic since at least November 2006. Presumably when the trojan is installed, it generates 'fake' clicks on TGP's from real users pc's. If one can find out where this traffic is being sent to, you're likely to find the source of the malware distribution. It's probably someone with a fairly large and newer MGP, perhaps someone you're trading with.

The trojan is being distributed as a fake codec; people are being prompted to download a codec to play a video, and instead they wind up with this shit on their PC.

If you are aware of any site or gallery prompting for the download of suspicious codecs, please PM me.

As far as what you can do about it, other than keep an eye out for and report suspicious activity, probably not very much. This isn't a top priority for law enforcement because it isn't affecting consumers; also, being based in the Ukraine probably isn't helping matters. The most likely solution would seem to be something coming from the anti-virus makers, who as yet have not addressed this issue. Over 300 variants of this trojan had been found back in November, it is likely that more variants were already in existence or have been created since then.

If you have any questions feel free to post them. Also feel free to copy this post to any other forums you'd like, there seems to be something of a cover-up going on amongst those who've known about this, when IMO their greatest resource in tracking down those responsible is likely the freesite/tgp/mgp community who is being most affected by it.

Spunky 03-09-2007 08:54 PM

I've actually noticed this with a few trades for awhile now.needless to say I can them

JD 03-09-2007 08:59 PM

Quote:

Originally Posted by Spunky (Post 12049325)
I've actually noticed this with a few trades for awhile now.needless to say I can them

yeah i've seen it as well. mostly when I'm out trolling for new trades. It's total bullshit.

Someone in the original thread posted that the trojan is swapping refcodes on the join page so clicks will still show but not joins....

QuaWee 03-09-2007 09:01 PM

ugh, good post

porno jew 03-09-2007 09:02 PM

hate the player not the game.

TampaToker 03-09-2007 09:05 PM

Quote:

Originally Posted by porno jew (Post 12049353)
hate the player not the game.

What sites do you run again?

CyberHustler 03-09-2007 09:05 PM

damn....

pussyluver 03-09-2007 09:09 PM

A couple of concerns.

1) Traffic Brokers. How can we be sure the traffic bought is clean. What about the 1%-2% skim for free scripts. Is that clean also?

2) How do you know a trade is really clean. Galleries on a trade could contain the scumware. Trading partners could be turning the scum on and off to ellude detection?? In other words try to give it to ya once, ya go back and it isn't there. How many of us when we see something bad check it out to make sure where it is from before we trash someone esp a trade that is sending a fair amount of traffic.

RawAlex 03-09-2007 09:43 PM

There are programs out there specifically paying for this sort of shit. Some of their more "intelligent" affiliates spend their days out spamming non-adult boards with posts like "Britney Spears fucks dog, see the video", which links to a page with moaning and groaning audio but no image, and an attempted download of a "codec" to make the video visible.

It sucks beyond any understanding that shit like this could be considered a business model.

I now run "private" TGPs only, I don't cross link to anyone except myself, because it got to the point that about half of the active traders out there were either pushing kiddie porn or codec installs.

These people steal from the industry, they steal from the honest affiliates, and programs sadly keep paying these people because too many of them are whores for the bottom line, regardless of the methods used.

nation-x 03-09-2007 09:58 PM

Go Away! Batin!
https://youtube.com/watch?v=VFoBysk3Szg

Spunky 03-09-2007 10:04 PM

Quote:

Originally Posted by pussyluver (Post 12049379)
A couple of concerns.

2) How do you know a trade is really clean. Galleries on a trade could contain the scumware. Trading partners could be turning the scum on and off to ellude detection?? In other words try to give it to ya once, ya go back and it isn't there. How many of us when we see something bad check it out to make sure where it is from before we trash someone esp a trade that is sending a fair amount of traffic.

That's been happening for years though.You ban 10 and they come back with 20 the next day.Running the link check a few times a day helps and watch that proxy closely

Murderous 03-09-2007 10:29 PM

Very interesting indeed.

Jon Clark - BANNED FOR LIFE 03-09-2007 10:30 PM

But what can we really do about it....?

Theo 03-09-2007 10:56 PM

Quote:

Originally Posted by RawAlex (Post 12049464)
There are programs out there specifically paying for this sort of shit. Some of their more "intelligent" affiliates spend their days out spamming non-adult boards with posts like "Britney Spears fucks dog, see the video", which links to a page with moaning and groaning audio but no image, and an attempted download of a "codec" to make the video visible.

Alex, do you have any sample link ?

RawAlex 03-09-2007 10:58 PM

Jon, actually, I was considering firing up one of my older (and unused) PCs and allow it to get infected to see where the traffic going, and what effects these programs have on my "surfing experience".

If programs are accepting traffic from these sorts of schemes, they need to know that it isn't "acceptable". Like Zango, there is potential in the long run that programs that buy this sort of traffic risk getting into legal issues with their affiliates, especially if they are specifically working against their affiliates.

I actually have a feeling that 2007 will be the year that a major or semi-major adult affiliate program finds itself of the shit end of the legal stick as a result of this sort of thing.

Lanceman 03-09-2007 11:03 PM

I have also noticed this problem and I have made my own list of things the sperminator is not incorrect in his findings at all.He is not paranoid and or crazy and neither is anyone else for that matter.
What we can do about it is like Raw said (Private networking) also we can all just become or own sponsors(secondary producers)and totally eliminate these problems.Hell we also could become our own first hand producers as well I think this ladies and gents is the way to make some serious money and also meet some serious chicks!Take things step by step and reach the goal! Just think no more trading I personally think everything goes around in a circle ten years ago everything was a text site.One text site alone could pay your bills and content was pristine.Things changed and thumbs took over and the CJ sites came in then the CJ2 by then the saturation of the industry had skyrocketed.Now Im seeing more and more blogs and way better content type sites however this trojan crap is nuts.I personaly have ten sites infected with this shit!!!!!:thumbsup

JD 03-09-2007 11:04 PM

Quote:

Originally Posted by RawAlex (Post 12049668)
I actually have a feeling that 2007 will be the year that a major or semi-major adult affiliate program finds itself of the shit end of the legal stick as a result of this sort of thing.

jesus I hope so. Hopefully they'll be made an example of and other programs will completely stop allowing shit like this.

Oh and cut off Eastern Europe from the net :thumbsup

RawAlex 03-09-2007 11:05 PM

You can find info about codec spammers here:

http://defense.trendmicro.com/pr/tm/.../did/blog.aspx

96ukssob 03-09-2007 11:20 PM

ive heard about this for a little while. i dont think it would be a bad idea to try and find the spyware or the person/company producing it so you can report them to the sponsors.

i had some shit on my computer one time that always had an AFF popup when i opened up IE. grabbed the affiliate code and turned them in and got an email saying they have suspended the user

Jon Clark - BANNED FOR LIFE 03-09-2007 11:22 PM

Quote:

Originally Posted by RawAlex (Post 12049668)
I actually have a feeling that 2007 will be the year that a major or semi-major adult affiliate program finds itself of the shit end of the legal stick as a result of this sort of thing.

That would be real nice.... The big boys play in the fire while the small fish fry and it would be great if we as a whole put a stop to it...

LiveDose 03-09-2007 11:26 PM

Quote:

Originally Posted by RawAlex (Post 12049464)
There are programs out there specifically paying for this sort of shit. Some of their more "intelligent" affiliates spend their days out spamming non-adult boards with posts like "Britney Spears fucks dog, see the video", which links to a page with moaning and groaning audio but no image, and an attempted download of a "codec" to make the video visible.


That fuckin' sucks but it is brilliant...:Oh crap

RawAlex 03-09-2007 11:27 PM

Quote:

Originally Posted by Soul_Rebel (Post 12049660)
Alex, do you have any sample link ?

here.... watch out for all the other bullshit on this site (like attempting to add stuff to your favorites, etc)... YOU HAVE BEEN WARNED! I recommend firefox for this job!


http://www.kylemovies.com/

CLick on any of the movie links. Codec hell.

Theo 03-09-2007 11:37 PM

thanks, very misleading method, 19 out of 20 or more will fall for this

kektex 03-09-2007 11:39 PM

If anyone wants to get infected they could try to run a windows live cd (google search) and vmware..that way they could run a virtual machine,get infected and nothing can happen to your pc

llporter 03-09-2007 11:47 PM

yikers :Oh crap

he-fox 03-09-2007 11:47 PM

shit, these fuckers need to be stopped

jollyperv 03-09-2007 11:50 PM

This is some seriously scary shit, fucking pisses me off to no end.

Lanceman 03-09-2007 11:55 PM

Quote:

Originally Posted by he-fox (Post 12049806)
shit, these fuckers need to be stopped

DOWN WITH THE FUCKERS DOWN WITH THE SHIT TRADES!!!!!!!!!!!!!!

Trixxxia 03-10-2007 12:10 AM

Sperminator - I'm hitting you up now for the forum

JD 03-10-2007 12:44 AM

Quote:

Originally Posted by TopBucksTrixxxia (Post 12049858)
Sperminator - I'm hitting you up now for the forum

:thumbsup

Zester 03-10-2007 01:12 AM

do you see a reason why toplists won't be affected by this ?

Naja-ram 03-10-2007 01:17 AM

the problem with you guys is that you can't handle competition

Gaybucks 03-10-2007 01:27 AM

Honestly from my perspective as a sponsor, this looks like a sponsor problem.

I realize that a lot of the big straight programs may not give a rat's ass, but there are definitely some that will, and perhaps those of you with decent amounts of traffic can start a trend.

Encourage sponsors to publicly commit to terminating any affiliates they find that are sending joins that can be shown to originate from malware.

Then, affiliates start voting with their feet (or, more precisely, with their traffic.) Support the sponsors who will commit to supporting you. If a sponsor won't commit to immediately terminating traffic from malware, simply find another sponsor.

I don't claim expertise in the straight side of the business, but it can't be that different... the sponsors all want traffic, the affiliates have the traffic, and if the affiliates band together, they are an enormously powerful force.

USE the power you have. Honest sponsors will thank you.

The Walrus 03-10-2007 01:28 AM

Fake things have been around for a long time. This is fucking genious :1orglaugh (Bad for us). Someone came up with one "CLICK HERE TO DOWNLOAD FREE PORN" link and now it's news? This is like placing an image of an X'ed out jpeg (load failure) on your page or a series of them for that matter and popping up a windw stating that they need a special program to view the photos of Jessica Simpson fucking a well hung donkey in Juarez drunk.

Some morons will fall for it, some won't. That's life. The net is still like the Wild fucking West. Untill we all get together and Deputize someone, something, some entity or unionize in a sense, the thugs will continue to ride through town whenever they want, and rape our women steal our food from our kids and bend us over and do us dry & hard. Not to mention giving us honest, hard working webmasters a bad name. :2 cents:

The Walrus 03-10-2007 01:31 AM

Quote:

Originally Posted by Gaybucks (Post 12049990)
Encourage sponsors to publicly commit to terminating any affiliates they find that are sending joins that can be shown to originate from malware.

And unless you are seeing it physically happening, how do you propose that you enforce this? It sounds good as an affiliate rep or a program owner typed out on GFY (I have no clue who you are or what you do), but these are valid IPs popping up from hard working affiliates. The customers are qualified, and some will join.

These referring URLs will appear to come from searches, galleries, favorites or type-ins.

Can it be done?

The Real G 03-10-2007 01:56 AM

Thats some bullshit. Fuck assholes that try and cheat people.

JD 03-10-2007 02:11 AM

some how it doesn't surprise me that this thread isn't even at 50 posts yet....

Gaybucks 03-10-2007 02:12 AM

Quote:

Originally Posted by The Walrus (Post 12049997)
And unless you are seeing it physically happening, how do you propose that you enforce this?

Can it be done?

I'm one of the co-owners of Gaybucks.com, which runs several twink and fetish sites and uses NATS for affiliate tracking.

We fortunately have not found any evidence of this sort of behavior yet, but some of the things that we would look for (and do keep an eye for) would be

-- unusual traffic/join patterns (large number of joins coming from different places that don't fit the statistical pattern of other affiliates with a similar amount of traffic)

-- Atypical conversion rates

-- Affiliates that can't answer questions about where they are marketing our program

A good program manager is always keeping his or her eye out for potential fraud. Unfortunately, it's a fact of life in this business. This is one more "pain in the ass", but I'm sure that if some sharp programmers with a statistical background spent any time with this, it would not be difficult to write a small script to analyze the NATS logs and identify the affiliates that are sending (stealing) this sort of traffic.

Of course, the sponsor has to *care* about its affiliates in order to go through the effort of doing that.

SPACE GLIDER 03-10-2007 02:29 AM

this is depressing

Sexsitesurfer 03-10-2007 02:30 AM

Quote:

Originally Posted by SPeRMiNaToR (Post 12049688)
jesus I hope so. Hopefully they'll be made an example of and other programs will completely stop allowing shit like this.

Oh and cut off Eastern Europe from the net :thumbsup

And get rid of me? :Oh crap

I agree with the first part of your statement though.


All times are GMT -7. The time now is 04:57 PM.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
©2000-, AI Media Network Inc123