hitbot cheater - for any tpg owners w/ TM3

HowlingWulf · 2008-01-28, 10:16 AM

Saw this guy auto-signup at my shemale tgp in my logs:

72.36.206.98 - - [27/Jan/2008:21:41:35 -0600] "GET /cgi-bin/tm3/signup?backlink=http://hornyteenusa.com&title=HornyTeenUsa&nick=
horny&icq=227-477-723&email=webmaster@hornyteenusa.com&name=Hunk&scriptoth=tm3&submit=Signup+for+a+Trade HTTP/1.0" 200 2854 "http://goldrater.com/modules.php?name=Your_Account" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

then immediately sends lots of fake traffic to get on the toplist

129.22.148.183 - - [27/Jan/2008:23:00:22 -0600] "GET / HTTP/1.1" 200 59372 "http://hornyteenusa.com/" "Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1)"

so a quick check: wget http: // hornyteenusa.com returns the code

<html>
<head>
<script> if(parent.window.opener) parent.window.opener.location="http://www.buy404s.com/404.html?account=fregat&track=main2"; se
lf.focus(); </script>
</head>
<body>

<script language='javascript' type="text/javascript">
// dvd vdeo xxx
var1=843;
var2=var1;
if(var1==var2) document.location="http://pornpussyworld.com/";
</script>
</body>
</html>

where pornpussyworld looks like a babe tgp selling hits to Traffic Holder http: // www. trafficholder.com/aff.php?wolf and is listed on cheaterhell.com
pornpussyworld.com Listed redirect to exploits, hitbots, cheater network 2007-12-11

If either hornyteenusa or pornpussyworld look familiar to you, take a second look.

Ravo · 2008-01-28, 02:52 PM

Thanks for the heads up HowlingWulf. I have terminated this guy from our buy404s program.

I've also checked to see if he's in any other of our programs; he's not.

2008-01-28, 10:16 AM	#1
HowlingWulf Me fail English? That's unpossible! Join Date: Dec 2003 Location: FL Posts: 1,381	hitbot cheater - for any tpg owners w/ TM3 Saw this guy auto-signup at my shemale tgp in my logs: 72.36.206.98 - - [27/Jan/2008:21:41:35 -0600] "GET /cgi-bin/tm3/signup?backlink=http://hornyteenusa.com&title=HornyTeenUsa&nick= horny&icq=227-477-723&email=webmaster@hornyteenusa.com&name=Hunk&scriptoth=tm3&submit=Signup+for+a+Trade HTTP/1.0" 200 2854 "http://goldrater.com/modules.php?name=Your_Account" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" then immediately sends lots of fake traffic to get on the toplist 129.22.148.183 - - [27/Jan/2008:23:00:22 -0600] "GET / HTTP/1.1" 200 59372 "http://hornyteenusa.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" so a quick check: wget http: // hornyteenusa.com returns the code <html> <head> <script> if(parent.window.opener) parent.window.opener.location="http://www.buy404s.com/404.html?account=fregat&track=main2"; se lf.focus(); </script> </head> <body> <script language='javascript' type="text/javascript"> // dvd vdeo xxx var1=843; var2=var1; if(var1==var2) document.location="http://pornpussyworld.com/"; </script> </body> </html> where pornpussyworld looks like a babe tgp selling hits to Traffic Holder http: // www. trafficholder.com/aff.php?wolf and is listed on cheaterhell.com pornpussyworld.com Listed redirect to exploits, hitbots, cheater network 2007-12-11 If either hornyteenusa or pornpussyworld look familiar to you, take a second look. __________________ WordPress Porn directory theme => Maddos Create a Porn Tube => Video Pornster

2008-01-28, 02:52 PM	#2
Ravo If something goes wrong at the plant, blame the guy who can't speak English Join Date: Feb 2005 Posts: 32	Thanks for the heads up HowlingWulf. I have terminated this guy from our buy404s program. I've also checked to see if he's in any other of our programs; he's not. __________________ You think Pay Per Click Is Dead? NO WAY! 4 "no conversion" programs at FPCTraffic