A shitload of trojan installing galleries and TONS of their affiliate codes
 

I posted this in the tail end of another thread, thought it might be something worthy of it's own thread though:

WARNING - do NOT install any of these codecs - do NOT visit without good anti-virus protection

This TGP http://adultau.com/?id=1110&t=4 is linking this gallery http://coolbestporn.com/robin/330225868/1/?id=1110

which upon clicking one of the videos loads the page http://coolbestporn.com/robin/330225...53bXY=&id=1110 kasperky is warning of "Trojan.Win32.DNSChanger.ir" trying to auto-install
the affiliate link on that gallery is http://collegepartytime.com/ref/1004000/ so maybe the blockboostercash guys can identify him.

Here's another doing the same with a TCG gallery: http://porn-room.net/obedience/1619577015/1/?id=1110
affiliate link from that gallery: http://www.castingcouchteens.com/?wm...tbond&cf=&sub=

Same for http://teenporntop.com/harman/1312166799/1/?id=1110
affiliate link: http://www.tamedteens.com/go/596263/22/9/n/

http://porntimeguide.com/alphinias/1...021/1/?id=1110
affiliate link: http://armyofass.maniacpass.com/?id=rikki&pt=p

http://pornhelp.net/pheney/1107727492/1/?id=1110
affiliate link: http://teen-stop.com/?id=crossales

http://xxxadultgold.com/bo/616802479/1/?id=1110
affiliate link: http://secure.hardcoreteeniesex.com/...0:HCTS,0,0,0,/

There's a TON more. The http://adultau.com/?id=1110&t=4 appears to be getting all traffic clicked from http://www.free-nude-photo.org/ which signed up for a trade on my site using IP 64.22.82.232 @ 15:22 EST on 3/21/07 (in case anybody really feels like tracking down this fool).

I haven't reported these yet to the proper sponsors, just too damn late at night for me to screw with atm :P so if anybody feels like messaging the sponsors before I do tomorrow go right ahead...

caught one of our domains in this one .. already started to look into the details of the guys account. Just need to find a machine that I can risk wrecking with spyware to see it in action.

if you can screenshot the one for HardCoreTeenieSex that would be awesome.

free-nude-photo.org
IP Location -> INTERCAGE
Registrar -> ESTDOMAINS

I've blacklisted every gallery/trade domain on my sites that is either registered at ESTDOMAINS, or Hosted at ATRIVO, INTERCAGE or INHOSTERS. That solved a lot of troubles, just do a board-search or use google to get more info about them.

Just add i.e. http://whois.domaintools.com/ to your bookmarks and check every domain you're doing business with, you'd be amazed how many cheaters are somehow attached to these 4 Hosts/Registrars.

Been seeing alot of this lately :disgust