Greenguy's Board - View Single Post

moonangel · 2006-02-26, 10:45 PM

This is Moon Angel. After reading all the "carnage" that occurred on this message board I decided to jump in and defend myself and explain exactly why I decided to deactivate Half Deck's affiliate account with us.

First of all, I told Half Deck it was an Austrian IP that hacked my site, using an account purchased via an Australian IP. I made a slight mistake, it wasn't an Austrian IP, it was actually a Czech IP. The user in question, "stevee" first logged on in 2-11-2006:

February 11th 2006 05:32:02 AM|211.26.186.17|stevee|Login Successful Session=3XRryFgd9RwwlPzjMNSyygxGaVZWYl
PK||

211.26.186.17 is indeed an australian IP. However, a few days after his "purchase", this user decided to make hack attempts against my site as follows:

February 13th 2006 03:46:08 AM|195.47.32.27|stevee|Illegal Characters in Request (/fruity/new3/ma/anya/../.
./../../../.htaccess)|
moonauth.02-14-06:February 13th 2006 03:46:08 AM|195.47.32.27|stevee|Illegal Characters in Request (/fruity/new3/ma/anya/../.
./../../../.htaccess)|
moonauth.02-14-06:February 13th 2006 03:46:08 AM|195.47.32.27|stevee|Illegal Characters in Request (/fruity/new3/ma/anya/../.
./../../../.htaccess)|

I'm not sure about any of you guys, but I take it as a severe insult when someone is attempting to break into my site.

Anyhow, I commonly group the Austrians and Czechs together in one subnet verification pool since they're so close in geographic proximity, my bad.

I have been running Moon Angel for over 10 years now (go ahead and do a whois on moonangel.com for the Record creation date ) and my affiliate site for nearly a year now, and rarely in the history of my site have I seen a hack attempt of this magnitude against my members gallery scripting. Since it was the first order that came through with half deck, and very little traffic was exchanged, I decided it would be in our best interest to deactivate his affiliate account to avoid the introduction of any future "hacked" accounts.

Anyhow, I think my last message to Half Deck pretty much sums it all up:

We reserve the right to terminate partnership at anytime as our policy states. You have not made any money for us nor have we made any money for you, so I think its fair that you just move on to another affiliate. This was a worst-case scenario of an extremely malicious (and rare) hacker, and if your site is somehow attracting these types of individuals, i'd rather not be linked nor partner with your site.

Sincerely,
Moon Angel

2006-02-26, 10:45 PM	#14
moonangel Internet! Is that thing still around? Join Date: Feb 2006 Posts: 5	Moon Angel This is Moon Angel. After reading all the "carnage" that occurred on this message board I decided to jump in and defend myself and explain exactly why I decided to deactivate Half Deck's affiliate account with us. First of all, I told Half Deck it was an Austrian IP that hacked my site, using an account purchased via an Australian IP. I made a slight mistake, it wasn't an Austrian IP, it was actually a Czech IP. The user in question, "stevee" first logged on in 2-11-2006: February 11th 2006 05:32:02 AM\|211.26.186.17\|stevee\|Login Successful Session=3XRryFgd9RwwlPzjMNSyygxGaVZWYl PK\|\| 211.26.186.17 is indeed an australian IP. However, a few days after his "purchase", this user decided to make hack attempts against my site as follows: February 13th 2006 03:46:08 AM\|195.47.32.27\|stevee\|Illegal Characters in Request (/fruity/new3/ma/anya/../. ./../../../.htaccess)\| moonauth.02-14-06:February 13th 2006 03:46:08 AM\|195.47.32.27\|stevee\|Illegal Characters in Request (/fruity/new3/ma/anya/../. ./../../../.htaccess)\| moonauth.02-14-06:February 13th 2006 03:46:08 AM\|195.47.32.27\|stevee\|Illegal Characters in Request (/fruity/new3/ma/anya/../. ./../../../.htaccess)\| I'm not sure about any of you guys, but I take it as a severe insult when someone is attempting to break into my site. Anyhow, I commonly group the Austrians and Czechs together in one subnet verification pool since they're so close in geographic proximity, my bad. I have been running Moon Angel for over 10 years now (go ahead and do a whois on moonangel.com for the Record creation date ) and my affiliate site for nearly a year now, and rarely in the history of my site have I seen a hack attempt of this magnitude against my members gallery scripting. Since it was the first order that came through with half deck, and very little traffic was exchanged, I decided it would be in our best interest to deactivate his affiliate account to avoid the introduction of any future "hacked" accounts. Anyhow, I think my last message to Half Deck pretty much sums it all up: We reserve the right to terminate partnership at anytime as our policy states. You have not made any money for us nor have we made any money for you, so I think its fair that you just move on to another affiliate. This was a worst-case scenario of an extremely malicious (and rare) hacker, and if your site is somehow attracting these types of individuals, i'd rather not be linked nor partner with your site. Sincerely, Moon Angel