Quick update to my last email:
----- Original Message -----
From:
webmaster@adultcustomgoods.com
To:
ipadmin@sagonet.com ;
abuse@unitedcolo.com ;
abuse@esthost.com
Sent: Monday, November 01, 2004 2:40 PM
Subject: Fw: abuse at your isp
Dear sirs,
Dear Sirs:
Please take the time to review the two atached emails as it related to abuse at Est Host and United Colo. Malicious code is running from your server, on pages from pixexcellent. pixexcellent hijacked google listings for my domain, adultcustomgoods.com. We appreciate your help to stop the malicious activity from your servers. I am the owner of adultcustomgoods.com and appreciate you taking the time to pursue this wrong doing. Many kind regards.
they are redirecting the hijacked traffic to:
<SCRIPT language=JScript><!--
window.location="http://66.111.48.129/?s=5&c=0";
--></script>
http://www.dirty-old-woman.com/free.html
http://incest.best-sex-galleries.com/index.shtml?1
http://gpisoft.spb.ru/
66.111.48.129 = [ unknown.sagonet.net ]
OrgName: United Colocation Group Inc.
OrgID: UCG-14
Address: 200 Paul Ave. Suite 500
City: San Francisco
StateProv: CA
PostalCode: 94124
Country: US
NetRange: 66.111.32.0 - 66.111.63.255
CIDR: 66.111.32.0/19
NetName: ASN-UNCGI-EXC-01
NetHandle: NET-66-111-32-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.UNITEDCOLO.NET
NameServer: NS2.UNITEDCOLO.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2002-08-06
Updated: 2003-03-24
AbuseHandle: ABUSE185-ARIN
AbuseName: Abuse
AbusePhone: 1-888-993-9339
AbuseEmail:
abuse@unitedcolo.com
NOCHandle: INFO-ARIN
NOCName: Info
NOCPhone: 1-888-993-9339
NOCEmail:
info@unitedcolo.com
TechHandle: SYSAD4-ARIN
TechName: Sysadmin-UCG
TechPhone: 1-888-993-9339
TechEmail:
sysadmin@unitedcolo.com
OrgTechHandle: ZS203-ARIN
OrgTechName: Sago Networks
OrgTechPhone: 1-866-510-4000
OrgTechEmail:
ipadmin@sagonet.com
CustName: Alexei Bouravtsv
Address: Nagatinskaya quay 42-2-79
City: Moscow
StateProv: 8. Customer Postal Code: 11
PostalCode:
Country: RU
RegDate: 2004-07-16
Updated: 2004-07-16
NetRange: 66.111.48.120 - 66.111.48.129
CIDR: 66.111.48.120/29 66.111.48.128/31
NetName: SAGO-66-111-48-120
NetHandle: NET-66-111-48-120-1
Parent: NET-66-111-32-0-1
NetType: Reassigned
Comment: NOCWorx SWIP Interface v1.5 -
http://interworx.info
RegDate: 2004-07-16
Updated: 2004-07-16
AbuseHandle: ABUSE185-ARIN
AbuseName: Abuse
AbusePhone: 1-888-993-9339
AbuseEmail:
abuse@unitedcolo.com
NOCHandle: INFO-ARIN
NOCName: Info
NOCPhone: 1-888-993-9339
NOCEmail:
info@unitedcolo.com
TechHandle: SYSAD4-ARIN
TechName: Sysadmin-UCG
TechPhone: 1-888-993-9339
TechEmail:
sysadmin@unitedcolo.com
OrgTechHandle: ZS203-ARIN
OrgTechName: Sago Networks
OrgTechPhone: 1-866-510-4000
OrgTechEmail:
ipadmin@sagonet.com
----- Original Message -----
From:
webmaster@adultcustomgoods.com
To:
sales@esthost.com ;
abuse@esthost.com
Sent: Saturday, October 30, 2004 3:30 PM
Subject: abuse at your isp
Dear Est Host,
These pages are stolen and the user has no copyrights to the html design. pixeccellent.net has no license for the use of code, content, or namesake.
Please remove all pages with Adultcustomgoods.com or adultcustomgoods from your server, known pages:
http://www.pixexcellent.net/wife/nude56/girllls0.html
http://www.pixexcellent.net/wife/nude51/girlxl4.html
I do not want the name of my site on their server, sending surfers to popup hell and virus riddled pages, not to mention automatic installation of toolbars and resizing the browser. This site has no affiliation with adultcustomgoods/adultcustomgoods.com, they do not promote my site, they have no revenue sharing or affiliate status with us. This html is stolen and is redir to aweful programs and virus
This is an example of the original legal page:
http://bizzo-tgp.com/hosted/mmiv5/acg101/rs_index.html
Bizzo-tgp.com and my company have an estblished business relaitonship. Pixexcellent.net stole code from Bizzo-tgp.com and is using the name sake of my site AdultCustomGoods.com to gain hits from search engines and hijack traffic. Not only that but I am going to be blacklisted with my site name on every page title. I know you are a reputably company, so I know you will take the steps to hekp me remove the stolen pages from your server. Thanks and regards.
http://www.pixexcellent.net = [ 207.234.154.156 ]
Registration Service Provided By: ESTHOST
Contact:
sales@esthost.com
Abuse Desk Email Address:
sales@esthost.com
Domain Name: PIXEXCELLENT.NET
Registrant:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Creation Date: 17-Jul-2004
Expiration Date: 17-Jul-2005
Domain servers in listed order:
ns1.starsthumbs.net
ns2.starsthumbs.net
Administrative Contact:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Technical Contact:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Billing Contact:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Status: ACTIVE
The data in this whois database is provided to you for information
purposes only that is to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is" and do not guarantee its accuracy. By submitting a
whois query you agree that you will use this data only for lawful
purposes and that under no circumstances will you use this data to:
(1) enable high volume automated electronic processes that stress or
load this whois database system providing you this information; or
(2) allow enable or otherwise support the transmission of mass
unsolicited commercial advertising or solicitations via direct mail
electronic mail or by telephone. The compilation repackaging
dissemination or other use of this data is expressly prohibited without
prior written consent from us. The registrar of record is
DirectI. We reserve the right to modify
these terms at any time. By submitting this query you agree to abide
by these terms.
Server Used: [ whois.directi.com ]
www.starsthumbs.net = [ 207.234.154.155 ] Registration Service Provided By: ESTHOST
Contact:
sales@esthost.com
Abuse Desk Email Address:
sales@esthost.com
Domain Name: STARSTHUMBS.NET
Registrant:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Creation Date: 17-Jul-2004
Expiration Date: 17-Jul-2005
Domain servers in listed order:
ns1.starsthumbs.net
ns2.starsthumbs.net
Administrative Contact:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Technical Contact:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Billing Contact:
Not applicable
Jochen Breunsbach
root@ratamahatta.com
Hahnenstrasse 15
Koeln
null 50674
DE
Tel. 49.2219440310
Status: ACTIVE
The data in this whois database is provided to you for information
purposes only that is to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is" and do not guarantee its accuracy. By submitting a
whois query you agree that you will use this data only for lawful
purposes and that under no circumstances will you use this data to:
(1) enable high volume automated electronic processes that stress or
load this whois database system providing you this information; or
(2) allow enable or otherwise support the transmission of mass
unsolicited commercial advertising or solicitations via direct mail
electronic mail or by telephone. The compilation repackaging
dissemination or other use of this data is expressly prohibited without
prior written consent from us. The registrar of record is
DirectI. We reserve the right to modify
these terms at any time. By submitting this query you agree to abide
by these terms.
Peace, Candy
http://www.adultcustomgoods.com/
http://www.wannashagg.com/