Who's chhits.com?? Cheater? "Traffic" broker?
 

I often catch galleries redirecting to chhits.com. Was wondering who it is.

Found 2 new ones tonight that only showed up once I used italian proxies.

boobastic.net
nastyfatbabes.com

The only info on GFY about chhits.com seems to be this post.

http://www.gofuckyourself.com/showth...ght=chhits.com

I'd post the redirect link except it goes to various sites as well as IP "sites" that appear to be trying to install something.

maybe specializing in the traffic from .ch

Actually one of those domains I also tied into this thread

http://www.gofuckyourself.com/showthread.php?t=572993

I'm wondering if it's the host themselves.. all those sites seem to be tied to powerpipe.com.

Back when I was starting out someone hooked me up with his "friend". It was some low cost hosting for a flat fee per month for galleries... It didn't take me long to discover that the hosting guy was redirecting my galleries.

http://www.google.com/search?q=%22Wi... =off&filter=0

There was a discussion on thehun as well about chhits.com

Damn.. Testing out where chhits redirects with the parameters I've got.. It goes to a "gallery" which redirects to another one. This one has an iframe which goes to an IP. That one redirects once or twice until it hits a page which does more iframes and stuff.. Based on the names of some things it looks like a bunch of exploits etc. One of the things it does is related to this:

http://securitytracker.com/alerts/2005/Aug/1014727.html

on exit for the gallery page, the code that's there loads one of these sites/pages. I wouldn't look at them unless you're sure you're protected. They might have something bad. Course I don't know who these are related to, I'm just saying what chhits does based on the parameters I have. With others it could be a whole new set of domains etc.

yoursatisfucktion.com
xmelons.com
amateurcutties.com
bitterporn.com
asiaxxl.com
lovelycock.com
feelnuts.com
30to50.com
shemaleslove.com
thumbparade.com
ebonyparade.com
maturerock.com
brilliant18.com
takeithere.com/index.html
pornstarxxl.com
nastytasty.com
daebony.com
wowmelons.com

64.71.131.111 brilliantteens.com

64.71.131.108 thumbparade.com
64.71.131.110 daebony.com
64.71.131.110 brilliant18.com
64.71.131.111 maturerock.com
64.71.131.111 nastytasty.com
64.71.131.112 bitterporn.com
64.71.131.112 takeithere.com/index.html
64.71.131.113 pornstarxxl.com
64.71.131.114 xmelons.com
64.71.131.114 amateurcutties.com
64.71.131.114 asiaxxl.com
64.71.131.114 lovelycock.com
64.71.131.115 shemaleslove.com
66.254.105.225 wowmelons.com
66.254.105.232 30to50.com
66.254.105.235 yoursatisfucktion.com
66.254.105.237 ebonyparade.com
66.254.105.238 feelnuts.com

72.9.224.194 chhits [dot] com
72.9.224.198 sexvideosbank [dot] com - DON'T GO THERE!!!

Both are hosted at GNAX.NET

Little more info.. The redirection only occurs if the referer is for my site (if they were submitted to my site). Faking the language doesn't redirect, it needs a proxy which means they're using GEO IP.

The page chhits redirects to also tries to load a video codec.. it probably has something bad in it. It's located on

69.50.160.60 v-codec [dot] com [email: dep@sexpicsporn [dot] com]

72.9.224.194 chhits [dot] com [email: willy@westpix [dot] net] (email domain doesn't seem to exist)

72.9.224.198 sexvideosbank [dot] com [email: dep @ sexpicsporn.com]

The redirection sequence will also sometimes go to

72.9.224.194 lust-movies.net [email: fom @ fhgstr.com]

69.50.171.150 fhgstr.com [eamil: info @ yourfreevids.com]

209.200.42.152 yourfreevids.com [email: tinnet @ regdoor.com]
yourfreevids.com nameserver is todaysfreevideo.com

209.200.42.150 todaysfreevideo.com [eamil: tinnet @ regdoor.com]

69.50.171.150 regdoor.com [email: mag @ sexpicsporn.com]

209.200.153.152 sexpicsporn.com parked at sedo info hidden by Domains by Proxy,


NetRange: 209.200.0.0 - 209.200.63.255 -> Webair Internet Development Inc

InterCage, Inc. INTERCAGE-NETWORK-GROUP (NET-69-50-160-0-1)
69.50.160.0 - 69.50.191.255
William Lu LUWILLIAM (NET-69-50-171-0-1)
69.50.171.0 - 69.50.171.255

:1orglaugh :1orglaugh :1orglaugh

A google search for Willian Lu brought up this page

http://www.whois.sc/spy-sheriff.com

69.50.170.82 spy-sheriff.com

InterCage, Inc. INTERCAGE-NETWORK-GROUP (NET-69-50-160-0-1)
69.50.160.0 - 69.50.191.255
William Lu STANDARDSHELLS (NET-69-50-170-0-1)
69.50.170.0 - 69.50.170.255

searching for spy sherrif brought out this

http://www.adwarereport.com/mt/archives/000253.html

Apparently the guy Emil Kacperski (owner of Intercage) is heavily associated with spyware, spammers etc.

http://www.thebishop.net/geodog/arch...e_helpers.html
http://www.theregister.co.uk/2003/06...yberspace_land
http://www.dslreports.com/forum/rema...22530~expand=1
http://blogs.zdnet.com/Spyware/?p=763