|
hitbot cheater - for any tpg owners w/ TM3
Saw this guy auto-signup at my shemale tgp in my logs:
72.36.206.98 - - [27/Jan/2008:21:41:35 -0600] "GET /cgi-bin/tm3/signup?backlink=http://hornyteenusa.com&title=HornyTeenUsa&nick=
horny&icq=227-477-723&email=webmaster@hornyteenusa.com&name=Hunk&scriptoth=tm3&submit=Signup+for+a+Trade HTTP/1.0" 200 2854 "http://goldrater.com/modules.php?name=Your_Account" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
then immediately sends lots of fake traffic to get on the toplist
129.22.148.183 - - [27/Jan/2008:23:00:22 -0600] "GET / HTTP/1.1" 200 59372 "http://hornyteenusa.com/" "Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1)"
so a quick check: wget http: // hornyteenusa.com returns the code
<html>
<head>
<script> if(parent.window.opener) parent.window.opener.location="http://www.buy404s.com/404.html?account=fregat&track=main2"; se
lf.focus(); </script>
</head>
<body>
<script language='javascript' type="text/javascript">
// dvd vdeo xxx
var1=843;
var2=var1;
if(var1==var2) document.location="http://pornpussyworld.com/";
</script>
</body>
</html>
where pornpussyworld looks like a babe tgp selling hits to Traffic Holder http: // www. trafficholder.com/aff.php?wolf and is listed on cheaterhell.com
pornpussyworld.com Listed redirect to exploits, hitbots, cheater network 2007-12-11
If either hornyteenusa or pornpussyworld look familiar to you, take a second look.
|