GoFuckYourself.com - Adult Webmaster Forum

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)
-   Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)
-   -   Attention ALL GFY MEMBERS. We're being robbed (https://gfy.com/showthread.php?t=713306)

JD 03-09-2007 08:51 PM

Attention ALL GFY MEMBERS. We're being robbed
 
There is some serious shit going down on the net that is a most likely effecting all of us. I know I've been hit pretty hard...

reposted from another board (icq me for link)

Quote:

Over the past couple months (at least) there has been a very large spyware network growing among adult site surfers. During the past couple days there has been a large and noticeable increase in activity. What is happening is that the spyware/malware is replacing affiliate codes with the code of the spyware authors. This is nothing new however the number of people that are being affected now is much larger than normal.

This is reportedly affecting 4-5% of all adult site traffic atm, presumably affecting TGP/MGP traffic to a much more significant extent because that is the traffic base the spyware is likely being distributed from. As a matter of speculation, if it's averaging 4-5% overall, that might be more like 1-2% of SE traffic and 10-20% of TGP/MGP traffic. So webmasters relying heavily on SE traffic are less likely to have noticed a drop in ratios as compared to freesite traffic.

The processors and many paysites have been aware of this for some time but are not speaking about it publically. They do not have a solution for it. Perhaps out of fear of losing affiliate confidence, this has not been publicized. CCBill is according to my source aware of it and seems to be the sponsor hardest hit.

I've been told some programs are ignoring it completely, while others are cancelling the spyware accounts and keeping the extra sales themselves. Either way, the processors see the same # of signups, as do the programs. The only people getting screwed out of this are the affiliates.

They have some information as to who is behind this, it appears to be a crime ring based in the Ukraine with enough resources to either have the cooperation of a webhost or own their own hosting center. I have a list of IP's that have been known to provide the spyware but will not make this data public, it is entirely possible that the authors of the spyware are reading this very forum.

Another server in the same class B IP range as this one has been using trojans disguised as codecs to generate fake traffic since at least November 2006. Presumably when the trojan is installed, it generates 'fake' clicks on TGP's from real users pc's. If one can find out where this traffic is being sent to, you're likely to find the source of the malware distribution. It's probably someone with a fairly large and newer MGP, perhaps someone you're trading with.

The trojan is being distributed as a fake codec; people are being prompted to download a codec to play a video, and instead they wind up with this shit on their PC.

If you are aware of any site or gallery prompting for the download of suspicious codecs, please PM me.

As far as what you can do about it, other than keep an eye out for and report suspicious activity, probably not very much. This isn't a top priority for law enforcement because it isn't affecting consumers; also, being based in the Ukraine probably isn't helping matters. The most likely solution would seem to be something coming from the anti-virus makers, who as yet have not addressed this issue. Over 300 variants of this trojan had been found back in November, it is likely that more variants were already in existence or have been created since then.

If you have any questions feel free to post them. Also feel free to copy this post to any other forums you'd like, there seems to be something of a cover-up going on amongst those who've known about this, when IMO their greatest resource in tracking down those responsible is likely the freesite/tgp/mgp community who is being most affected by it.

Spunky 03-09-2007 08:54 PM

I've actually noticed this with a few trades for awhile now.needless to say I can them

JD 03-09-2007 08:59 PM

Quote:

Originally Posted by Spunky (Post 12049325)
I've actually noticed this with a few trades for awhile now.needless to say I can them

yeah i've seen it as well. mostly when I'm out trolling for new trades. It's total bullshit.

Someone in the original thread posted that the trojan is swapping refcodes on the join page so clicks will still show but not joins....

QuaWee 03-09-2007 09:01 PM

ugh, good post

porno jew 03-09-2007 09:02 PM

hate the player not the game.

TampaToker 03-09-2007 09:05 PM

Quote:

Originally Posted by porno jew (Post 12049353)
hate the player not the game.

What sites do you run again?

CyberHustler 03-09-2007 09:05 PM

damn....

pussyluver 03-09-2007 09:09 PM

A couple of concerns.

1) Traffic Brokers. How can we be sure the traffic bought is clean. What about the 1%-2% skim for free scripts. Is that clean also?

2) How do you know a trade is really clean. Galleries on a trade could contain the scumware. Trading partners could be turning the scum on and off to ellude detection?? In other words try to give it to ya once, ya go back and it isn't there. How many of us when we see something bad check it out to make sure where it is from before we trash someone esp a trade that is sending a fair amount of traffic.

RawAlex 03-09-2007 09:43 PM

There are programs out there specifically paying for this sort of shit. Some of their more "intelligent" affiliates spend their days out spamming non-adult boards with posts like "Britney Spears fucks dog, see the video", which links to a page with moaning and groaning audio but no image, and an attempted download of a "codec" to make the video visible.

It sucks beyond any understanding that shit like this could be considered a business model.

I now run "private" TGPs only, I don't cross link to anyone except myself, because it got to the point that about half of the active traders out there were either pushing kiddie porn or codec installs.

These people steal from the industry, they steal from the honest affiliates, and programs sadly keep paying these people because too many of them are whores for the bottom line, regardless of the methods used.

nation-x 03-09-2007 09:58 PM

Go Away! Batin!
https://youtube.com/watch?v=VFoBysk3Szg

Spunky 03-09-2007 10:04 PM

Quote:

Originally Posted by pussyluver (Post 12049379)
A couple of concerns.

2) How do you know a trade is really clean. Galleries on a trade could contain the scumware. Trading partners could be turning the scum on and off to ellude detection?? In other words try to give it to ya once, ya go back and it isn't there. How many of us when we see something bad check it out to make sure where it is from before we trash someone esp a trade that is sending a fair amount of traffic.

That's been happening for years though.You ban 10 and they come back with 20 the next day.Running the link check a few times a day helps and watch that proxy closely

Murderous 03-09-2007 10:29 PM

Very interesting indeed.

Jon Clark - BANNED FOR LIFE 03-09-2007 10:30 PM

But what can we really do about it....?

Theo 03-09-2007 10:56 PM

Quote:

Originally Posted by RawAlex (Post 12049464)
There are programs out there specifically paying for this sort of shit. Some of their more "intelligent" affiliates spend their days out spamming non-adult boards with posts like "Britney Spears fucks dog, see the video", which links to a page with moaning and groaning audio but no image, and an attempted download of a "codec" to make the video visible.

Alex, do you have any sample link ?

RawAlex 03-09-2007 10:58 PM

Jon, actually, I was considering firing up one of my older (and unused) PCs and allow it to get infected to see where the traffic going, and what effects these programs have on my "surfing experience".

If programs are accepting traffic from these sorts of schemes, they need to know that it isn't "acceptable". Like Zango, there is potential in the long run that programs that buy this sort of traffic risk getting into legal issues with their affiliates, especially if they are specifically working against their affiliates.

I actually have a feeling that 2007 will be the year that a major or semi-major adult affiliate program finds itself of the shit end of the legal stick as a result of this sort of thing.

Lanceman 03-09-2007 11:03 PM

I have also noticed this problem and I have made my own list of things the sperminator is not incorrect in his findings at all.He is not paranoid and or crazy and neither is anyone else for that matter.
What we can do about it is like Raw said (Private networking) also we can all just become or own sponsors(secondary producers)and totally eliminate these problems.Hell we also could become our own first hand producers as well I think this ladies and gents is the way to make some serious money and also meet some serious chicks!Take things step by step and reach the goal! Just think no more trading I personally think everything goes around in a circle ten years ago everything was a text site.One text site alone could pay your bills and content was pristine.Things changed and thumbs took over and the CJ sites came in then the CJ2 by then the saturation of the industry had skyrocketed.Now Im seeing more and more blogs and way better content type sites however this trojan crap is nuts.I personaly have ten sites infected with this shit!!!!!:thumbsup

JD 03-09-2007 11:04 PM

Quote:

Originally Posted by RawAlex (Post 12049668)
I actually have a feeling that 2007 will be the year that a major or semi-major adult affiliate program finds itself of the shit end of the legal stick as a result of this sort of thing.

jesus I hope so. Hopefully they'll be made an example of and other programs will completely stop allowing shit like this.

Oh and cut off Eastern Europe from the net :thumbsup

RawAlex 03-09-2007 11:05 PM

You can find info about codec spammers here:

http://defense.trendmicro.com/pr/tm/.../did/blog.aspx

96ukssob 03-09-2007 11:20 PM

ive heard about this for a little while. i dont think it would be a bad idea to try and find the spyware or the person/company producing it so you can report them to the sponsors.

i had some shit on my computer one time that always had an AFF popup when i opened up IE. grabbed the affiliate code and turned them in and got an email saying they have suspended the user

Jon Clark - BANNED FOR LIFE 03-09-2007 11:22 PM

Quote:

Originally Posted by RawAlex (Post 12049668)
I actually have a feeling that 2007 will be the year that a major or semi-major adult affiliate program finds itself of the shit end of the legal stick as a result of this sort of thing.

That would be real nice.... The big boys play in the fire while the small fish fry and it would be great if we as a whole put a stop to it...

LiveDose 03-09-2007 11:26 PM

Quote:

Originally Posted by RawAlex (Post 12049464)
There are programs out there specifically paying for this sort of shit. Some of their more "intelligent" affiliates spend their days out spamming non-adult boards with posts like "Britney Spears fucks dog, see the video", which links to a page with moaning and groaning audio but no image, and an attempted download of a "codec" to make the video visible.


That fuckin' sucks but it is brilliant...:Oh crap

RawAlex 03-09-2007 11:27 PM

Quote:

Originally Posted by Soul_Rebel (Post 12049660)
Alex, do you have any sample link ?

here.... watch out for all the other bullshit on this site (like attempting to add stuff to your favorites, etc)... YOU HAVE BEEN WARNED! I recommend firefox for this job!


http://www.kylemovies.com/

CLick on any of the movie links. Codec hell.

Theo 03-09-2007 11:37 PM

thanks, very misleading method, 19 out of 20 or more will fall for this

kektex 03-09-2007 11:39 PM

If anyone wants to get infected they could try to run a windows live cd (google search) and vmware..that way they could run a virtual machine,get infected and nothing can happen to your pc

llporter 03-09-2007 11:47 PM

yikers :Oh crap

he-fox 03-09-2007 11:47 PM

shit, these fuckers need to be stopped

jollyperv 03-09-2007 11:50 PM

This is some seriously scary shit, fucking pisses me off to no end.

Lanceman 03-09-2007 11:55 PM

Quote:

Originally Posted by he-fox (Post 12049806)
shit, these fuckers need to be stopped

DOWN WITH THE FUCKERS DOWN WITH THE SHIT TRADES!!!!!!!!!!!!!!

Trixxxia 03-10-2007 12:10 AM

Sperminator - I'm hitting you up now for the forum

JD 03-10-2007 12:44 AM

Quote:

Originally Posted by TopBucksTrixxxia (Post 12049858)
Sperminator - I'm hitting you up now for the forum

:thumbsup

Zester 03-10-2007 01:12 AM

do you see a reason why toplists won't be affected by this ?

Naja-ram 03-10-2007 01:17 AM

the problem with you guys is that you can't handle competition

Gaybucks 03-10-2007 01:27 AM

Honestly from my perspective as a sponsor, this looks like a sponsor problem.

I realize that a lot of the big straight programs may not give a rat's ass, but there are definitely some that will, and perhaps those of you with decent amounts of traffic can start a trend.

Encourage sponsors to publicly commit to terminating any affiliates they find that are sending joins that can be shown to originate from malware.

Then, affiliates start voting with their feet (or, more precisely, with their traffic.) Support the sponsors who will commit to supporting you. If a sponsor won't commit to immediately terminating traffic from malware, simply find another sponsor.

I don't claim expertise in the straight side of the business, but it can't be that different... the sponsors all want traffic, the affiliates have the traffic, and if the affiliates band together, they are an enormously powerful force.

USE the power you have. Honest sponsors will thank you.

The Walrus 03-10-2007 01:28 AM

Fake things have been around for a long time. This is fucking genious :1orglaugh (Bad for us). Someone came up with one "CLICK HERE TO DOWNLOAD FREE PORN" link and now it's news? This is like placing an image of an X'ed out jpeg (load failure) on your page or a series of them for that matter and popping up a windw stating that they need a special program to view the photos of Jessica Simpson fucking a well hung donkey in Juarez drunk.

Some morons will fall for it, some won't. That's life. The net is still like the Wild fucking West. Untill we all get together and Deputize someone, something, some entity or unionize in a sense, the thugs will continue to ride through town whenever they want, and rape our women steal our food from our kids and bend us over and do us dry & hard. Not to mention giving us honest, hard working webmasters a bad name. :2 cents:

The Walrus 03-10-2007 01:31 AM

Quote:

Originally Posted by Gaybucks (Post 12049990)
Encourage sponsors to publicly commit to terminating any affiliates they find that are sending joins that can be shown to originate from malware.

And unless you are seeing it physically happening, how do you propose that you enforce this? It sounds good as an affiliate rep or a program owner typed out on GFY (I have no clue who you are or what you do), but these are valid IPs popping up from hard working affiliates. The customers are qualified, and some will join.

These referring URLs will appear to come from searches, galleries, favorites or type-ins.

Can it be done?

The Real G 03-10-2007 01:56 AM

Thats some bullshit. Fuck assholes that try and cheat people.

JD 03-10-2007 02:11 AM

some how it doesn't surprise me that this thread isn't even at 50 posts yet....

Gaybucks 03-10-2007 02:12 AM

Quote:

Originally Posted by The Walrus (Post 12049997)
And unless you are seeing it physically happening, how do you propose that you enforce this?

Can it be done?

I'm one of the co-owners of Gaybucks.com, which runs several twink and fetish sites and uses NATS for affiliate tracking.

We fortunately have not found any evidence of this sort of behavior yet, but some of the things that we would look for (and do keep an eye for) would be

-- unusual traffic/join patterns (large number of joins coming from different places that don't fit the statistical pattern of other affiliates with a similar amount of traffic)

-- Atypical conversion rates

-- Affiliates that can't answer questions about where they are marketing our program

A good program manager is always keeping his or her eye out for potential fraud. Unfortunately, it's a fact of life in this business. This is one more "pain in the ass", but I'm sure that if some sharp programmers with a statistical background spent any time with this, it would not be difficult to write a small script to analyze the NATS logs and identify the affiliates that are sending (stealing) this sort of traffic.

Of course, the sponsor has to *care* about its affiliates in order to go through the effort of doing that.

SPACE GLIDER 03-10-2007 02:29 AM

this is depressing

Sexsitesurfer 03-10-2007 02:30 AM

Quote:

Originally Posted by SPeRMiNaToR (Post 12049688)
jesus I hope so. Hopefully they'll be made an example of and other programs will completely stop allowing shit like this.

Oh and cut off Eastern Europe from the net :thumbsup

And get rid of me? :Oh crap

I agree with the first part of your statement though.

pornonada 03-10-2007 02:38 AM

Quote:

Originally Posted by Naja-ram (Post 12049974)
the problem with you guys is that you can't handle competition

with such a comment someone can come to the only logical conclusion that your sig is about yourself!

Adultnet 03-10-2007 02:40 AM

this are some really decent numbers.

The Walrus 03-10-2007 02:43 AM

Quote:

Originally Posted by Gaybucks (Post 12050083)
I'm one of the co-owners of Gaybucks.com, which runs several twink and fetish sites and uses NATS for affiliate tracking.

We fortunately have not found any evidence of this sort of behavior yet, but some of the things that we would look for (and do keep an eye for) would be

-- unusual traffic/join patterns (large number of joins coming from different places that don't fit the statistical pattern of other affiliates with a similar amount of traffic)

-- Atypical conversion rates

-- Affiliates that can't answer questions about where they are marketing our program

A good program manager is always keeping his or her eye out for potential fraud. Unfortunately, it's a fact of life in this business. This is one more "pain in the ass", but I'm sure that if some sharp programmers with a statistical background spent any time with this, it would not be difficult to write a small script to analyze the NATS logs and identify the affiliates that are sending (stealing) this sort of traffic.

Of course, the sponsor has to *care* about its affiliates in order to go through the effort of doing that.


Excellent answer, and I will be hitting you up on Monday to discuss a few things if that is ok with you (business wise).

For the nosey people (LOL) you seem to have a good business accumen, which unfortunately in this day in age is far & few between and very rare (let alone in this industry).

However you wrote, and I quote:
Quote:

unusual traffic/join patterns (large number of joins coming from different places that don't fit the statistical pattern of other affiliates with a similar amount of traffic)
Who is to say that isn't a PPC campaign set to run only during certain time frames because statistically those are the best join times for Brand X's niche from my many years of tinkering?

Many spyware joins are legitimate class "A" customers with valid credit cards and lube in hand. Carded joins will always get nabbed (most of the time, if you are on your toes) but this spyware shit has just generated an easy stream of traffic for those that are shady enough to install it, and/or pay for it's advertising programs.

The day an age of Ivan Kutch-a-kokoff writing his own trojan, popping up a series of FPAs or galleries from his $19.95 cellar dwelling, hogh school kid maintained server, in order to grab our sales are gone. These guys are smart mother fuckers, and now it has become popup, PPC, pay per pop big business. Like I said (not sure if it was in this thread or another along the same lines), but these ass munch's are fucking genious and anyone here that say otherwise is only lying to themselves.

There is a reason that Ferrari driving fellas such as Lars, Sagi and the lot of them used them. It may have been a bad PR move because they were caught and I honestly do not think that they understood completely the ramifications of their actions (may that have understoood the technique of trafic generation from Zango or not), but this shit is large. When I say large, I mean HUGE!

I happen to own a small chain of PC repair shops here in the tri-county area, and I deal with this every fucking day. Granted I have become a Zango expert, but between Zango and the supposed Spyware scanners (Spy Sheriff, etc) that auto install and tell you that you MUST buy their product to disinfect your PC, well lets just say I have plenty of food on the table for the family. It's a catch-22. As much as I hate them for doing what they do, they keep me busy during the day and make me quite a bit of money all the while attempting to eradicating them.

I have several customers that pay me to reformat their computers MONTHLY because they can't stay away from the porno. :1orglaugh

scottybuzz 03-10-2007 02:48 AM

Quote:

Originally Posted by SPeRMiNaToR (Post 12050081)
some how it doesn't surprise me that this thread isn't even at 50 posts yet....

isnt this zango all over again. if it has shot up to %5 over the past few days, wouldnt there be news articles?

madawgz 03-10-2007 02:48 AM

ah so maybe thats the reason my sales have gone downhill...:(

RawAlex 03-10-2007 02:50 AM

Walrus, with all respect that comes with this sort of discussion, you have to remember tha tthere is one and only one motivating factor at work here:

Money.

The stock exchanges recently shut down 35 stocks that were targets or perhaps even profiting from pump and dump spam mails:

http://www.chinapost.com.tw/news/arc...310/104269.htm

(yes, btw, I find it really funny that the best place to find an AP wire story was the China post, but that would be for another thread).

Programs have to start being more selective about where they accept traffic from, and they have to put as much effort into checking out affiliates as they put into putting beer in their hands. The average program could really be improved by adding 1 or 2 people on staff to check accounts on a regular (ie daily) basis, reviewing thousands of refering pages and checking to see where stuff comes from.

In my surfing tonight, I also found another great scam: A PPC search engine that is accepting CJ traffic, filtered through a single page that looks like a TGP by itself. People are likely paying pretty big money for clicks, and the reality is that they are paying for shit traffic. Yet none of these programs would pay me 10 cents a click for click thru traffic. It doesn't make sense.

Scams like the codecs are stealing money from honest affiliates, and too often the programs are tolerant because the profit from it. They don't realize that the joins would come anyway.

tradermcduck 03-10-2007 02:57 AM

Quote:

Originally Posted by SPeRMiNaToR (Post 12050081)
some how it doesn't surprise me that this thread isn't even at 50 posts yet....

:(

let's bump this thread...

@ Sperminator - I am posting this on a well known mgp webmaster board

Snake Doctor 03-10-2007 02:58 AM

Sponsors have to be in a real pickle over this one.
If they terminate the accounts they suspect are spyware, then instead of the spyware replacing the affiliates code on the joinpage, the spyware people will just replace your join page with another programs join page, or replace it with a site of their own.
So if they do nothing they keep the traffic, but their affiliates get fucked.
If they terminate the accounts, they lose the traffic, and the affiliates still get fucked.

TGP and MGP owners need to post links to cleaner programs on their front pages and educate their surfers about this shit. That's the only real way to slow this down IMO.

wyldworx 03-10-2007 03:04 AM

Quote:

Originally Posted by porno jew (Post 12049353)
hate the player not the game.

you are no player dog, I would crush you. I can't stand your neverending negative banter. You would have to be the biggest disgrace to jews yet. Fuck off!!!!:winkwink:

RawAlex 03-10-2007 03:04 AM

lenny, the spyware programs work best when they are invisible (or barely visible). They play games like changing linking codes, redirecting on join pages, etc. It's all in a day's work.

If they start directly taking traffic away to other sites at a noticable level (ie, conversion drop off really bad... wait, that is already happening) then the programs will have to start looking into WHY.

If the affiliates get poor conversions but the program is doing well, that should be a tip off the the programs that they are victims of spyware.

You also have to remember that codec installers are often not interested in that specific surfer, but rather to use his network connected PC to spam others. There are many ways to play the game, not all of them as direct as you might think (like keylogging passwords for bank accounts, perhaps?)


All times are GMT -7. The time now is 01:57 PM.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
©2000-, AI Media Network Inc123