http://vietvuive.com - Lowlife scumbag

[FuckingBastard]

On the date 2009-01-04 i register a bunch of new domains including bbwlivesex.com.
Today i check out my stats and i realize a bunch of vietnamese IPs coming from nowhere.I was digging more and i saw all IPs coming from http://vietvuive.com/ !!! Goddamit!!!This lowlife fucker steal all my content,all my pics,all my images,all my template design, all my affiliate codes (!!) and put on his domain.He spam my content from his site.You may check as well to see the same content!!!!!The whois of vietvuive.com :

Server Data
Server Type: Apache/2.0.52 (CentOS)
IP Address: 72.167.113.181 Whois | Reverse-IP | Ping | DNS Lookup | Traceroute
IP Location United States - United States - Godaddy.com Inc
Response Code: 200
SSL Cert: ip-72-167-113-181.ip.secureserver.net expires in 5 days.
Domain Status: Registered And Active Website
DomainTools Exclusive
Registrar History: 1 registrar with 1 drop.
NS History: 13 changes on 8 unique name servers over 4 years.
IP History: 11 changes on 9 unique name servers over 4 years.
Whois History: 29 records have been archived since 2005-02-16.
Reverse IP: 25 other sites hosted on this server.
Monitor Domain: [Monitor this domain] Set Free Alerts on vietvuive.com

His domain is register to :
ICANN Registrar: SPOT DOMAIN LLC DBA DOMAINSITE.COM
Created: 2006-06-11
Expires: 2010-06-11
Updated: 2008-10-04
I already report the fucker to his hosting: godaddy , on DOMAINSITE.COM and few other boards.What is the next move before to receive the reply from them ?

[pc]

How he can steal your affiliate codes?
Did he also steal your email that you signup with for you sponsor?
Change all you passwords on this host and change all you passwords on your registrar.
Besides that change all FTP info also set .htaccess for antihotlinking.

[FuckingBastard]

Originally Posted by pclit

How he can steal your affiliate codes?
Did he also steal your email that you signup with for you sponsor?
Change all you passwords on this host and change all you passwords on your registrar.
Besides that change all FTP info also set .htaccess for antihotlinking.

i made a little change to the first post and i refresh the scumbag page ,and yes, he hotlinking my blog. I check now to find the code antihotlinking.
Thanks mate

[FuckingBastard]

08 Jan, Thu 1215
09 Jan, Fri 2835
10 Jan, Sat 3188
11 Jan, Sun 3142
12 Jan, Mon 3453
13 Jan, Tue 246

The fucker burn 15% from my bandwitch
I put this code into my htaccess ,but seem to appear on his page all page without images.In fact the code don`t block the php from wordpress
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?bbwlivesex.com [NC]
RewriteRule \.(jpg|jpeg|png|gif|php|cgi)$ - [NC,F,L]

On my dedicated server i have 20 folders where are hosted 20 domains.It is a smart idea to use antihotlinking in each folder or i can use a command (what apache command ?!) on the root? It will be 20 htaccess on my apache and server will load in fucking 10 sec

[Useless]

Looks like a ripped copy of your site. Your .htaccess does appear to stopping the hotlinking of the images. Be happy that all of our affiliate ids are intact.

[FuckingBastard]

Originally Posted by Useless Warrior

Looks like a ripped copy of your site. Your .htaccess does appear to stopping the hotlinking of the images. Be happy that all of our affiliate ids are intact.

I fix the code with htaccess and i stop ONLY hotlinking of the images, i ban the fucker site and block access from vn .
I already add at end of the line : php,cgi,pl, but it seem to not work for scripts
RewriteRule \.(jpg|jpeg|png|gif|php|cgi|pl)$ - [NC,F,L]
Hope to find soon

[MadCat]

He's not hotlinking your site pages mate, he made a copy of all the pages (you can do so easily with many a tool), and is hotlinking the images.

[FuckingBastard]

Originally Posted by MadCat

He's not hotlinking your site pages mate, he made a copy of all the pages (you can do so easily with many a tool), and is hotlinking the images.

I guess it`s imposible to do that.I change a little bit from my first blog post , i confirm it and i refresh my page.After that i check the cocksucker page and the little change was appeared as well on his blog So i guess he only hotlinking ?!

[Useless]

Originally Posted by FuckingBastard

I guess it`s imposible to do that.I change a little bit from my first blog post , i confirm it and i refresh my page.After that i check the cocksucker page and the little change was appeared as well on his blog So i guess he only hotlinking ?!

Rename your RSS feed and see what happens. Add a post after renaming the feed and check again. My guess is that it remains a ripped copy, which explains the banner ads and affiliate links, but he's also using her RSS feed for content. It's just a guess. He seems to have full posts, but your feed truncates them, so I'm not certain.

[FuckingBastard]

Originally Posted by Useless Warrior

Rename your RSS feed and see what happens. Add a post after renaming the feed and check again. My guess is that it remains a ripped copy, which explains the banner ads and affiliate links, but he's also using her RSS feed for content. It's just a guess. He seems to have full posts, but your feed truncates them, so I'm not certain.

I download the plugin from wordpress full-text-feed, and yes, you are right.It work The new post are hidding with a feature to feeds.I block the hole ip classes from vietnam,block the surfers from,but i still received hits from google.vn.Should i ban google.vn ?

[Useless]

I still see your posts, including your newest post, on the other site. Whether or not anyone from Viet Nam can see it, I don't know. With .htaccess, you're blocking them from your site, not his -- but they're still viewing your content on his site. He's pulling a live copy of your blog, which I assume he's doing with your RSS or Atom feed. Did you try renaming the feeds to see what happens?

Try making a change on your BBW blog to something that wouldn't be carried by the feed, such as a banner or anything in the sidebar and see if that change appears on the bad site.

[FuckingBastard]

i tried to change the rss feed name but i didn`t find where...i digg on wordpress and find some great tutorials about how to stop the rss feed at all HERE1 and HERE2 and detele the feed as well from my blog.
I change to settings from ALL feeds
For each article in a feed, show : Summary
......... and nothing change.

[pc]

Now both sites are dead ?

[Useless]

Originally Posted by pclit

Now both sites are dead ?

It looks like FB took drastic steps to handle the issue. The thieving site isn't really down, it's merely a copy of FB's site.

I'd love to know what that other site is using to mirror FB's site. Perhaps it's as simple as a DNS trick?

[MadCat]

Originally Posted by Useless Warrior

It looks like FB took drastic steps to handle the issue. The thieving site isn't really down, it's merely a copy of FB's site.

I'd love to know what that other site is using to mirror FB's site. Perhaps it's as simple as a DNS trick?

wget -m http://yoursite.com/

All I need to make a full mirror

[Useless]

Originally Posted by MadCat

wget -m http://yoursite.com/

All I need to make a full mirror

Good to know. (Note to self: don't piss off MadCat.) They seem to have an automated sumtin' sumtin' installed though. They always appear to have an updated copy of FB's site which, in this case, isn't doing them any favors.

[FuckingBastard]

Originally Posted by pclit

Now both sites are dead ?

Well , i fucking read 3 days about all , including few post on wordpress message board and i didn`t found nothing to stop the lamer.So i decided to take down for a period the blog and stop wasting my bandwitch.
Pretty lame `cause i didn`t fix the problem yet.I`m still lurking everywhere.I`m glade that are a new blog, and not have any trade and link ex with anyone

[FuckingBastard]

Originally Posted by Useless Warrior

It looks like FB took drastic steps to handle the issue. The thieving site isn't really down, it's merely a copy of FB's site.

I'd love to know what that other site is using to mirror FB's site. Perhaps it's as simple as a DNS trick?

I still reading and hope to find something about this shit

[FuckingBastard]

Originally Posted by MadCat

wget -m http://yoursite.com/

All I need to make a full mirror

And how can be stop things like this?

[whitey]

Originally Posted by FuckingBastard

And how can be stop things like this?

I am heading out for a meeting very quickly so I don't have time to give you a detailed response now, but there are any variety of automated server based codes that this nimrod could be using. It could be as simple as a wget command set with cron or something more complex.

If it is not through http (or apache), htaccess codes are a meaningless defense as they are functions enabled at the httpd level by apache.

The first thing I suggest is a server level firewall - I use apf. If you know what that is and have shell access, go to the apf deny hosts (or the config file, I don't recall which off the top of my head) file and block his c-class. If you don't know what I am talking about, read on...

So, before I go into detail on all of your options, I will assume you don't know anything about server firewall installations. Answering the following questions will enable me to give you some detailed help.

1. Are you on a dedicated, vps or shared hosting service?

2. If you are on a dedicated service, is it managed or unmanaged?

3. Do you have shell access to your server?

If you are on shared hosting or managed dedicated service, tell the tech support guys to block his entire c-class with the server firewall.

If you are on your own dedicated or vps service or the tech guys are clueless about your request (in which case you should consider switching hosting services), let me know answers to the above and I will provide you with some detailed instructions on how to stop this buffoon - later today or tomorrow as I have a full evening schedule.

Regardless of what kind of service you have, there are things you want to do. Just make sure you have shell access to the server.

Regards

[FuckingBastard]

Thank you whitey for your reply.
I use a virtual dedicated server ,unmanaged one.And yes, i have SSH access as well.
I dont think that smart ass tech support will help me out, i already have few problems (uptime 5-6 hours dailly block, around 3 days) with my server , and never help me.That fuckers only reply me with some copy and paste shitty info.
However, seem that godaddy don`t care about my report and did nothing yet.I still hope.

[whitey]

FB:

Ok, since you are on an unmanaged server, I am going to assume that you have not installed a firewall. I am going to suggest that you use apf because it is open source and it works.

There is an excellent tutorial on installation of apf here..

http://www.webhostgear.com/index.php?art/id:61

If you have trouble getting the page to load (Brett updated that site recently with new software and it is loading slowly), I am going to take the liberty of copying it for you below due to the urgency of the issue you are experiencing (btw, logon to your ssh as root or the root substitute if you set one up).
---------------------------------

What is APF (Advanced Policy Firewall)? APF Firewall
APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux. APF is developed and maintained by R-fx Networks: http://www.rfxnetworks.com/apf.php

This guide will show you how to install and configure APF firewall, one of the better known Linux firewalls available.10

Limit SSH connections to one IP with APF in this advanced tutorial

Requirements:
- Root SSH access to your server

Lets begin!
Login to your server through SSH and su to the root user.

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz



Article provided by WebHostGear.com


3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.

Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/

Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,2082,2083,2086,2087,2095,2096,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

6. Lets configure the firewall: pico /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn't a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

We like to use DShield.org's "block" list of top networks that have exhibited
suspicious activity.
FIND: USE_DS="0"
CHANGE TO: USE_DS="1"

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43,2089"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"


Ensim Servers
We have found the following can be used on Ensim Servers - although we have not tried these ourselves as I don't run Ensim boxes.

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,19638"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

Save the changes: Ctrl+X then Y


8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|--start ......................... load firewall policies
-r|--restart ....................... flush & load firewall
-f|--flush|--stop .................. flush firewall
-l|--list .......................... list chain rules
-st|--status ....................... firewall status
-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall


9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM="1"
CHANGE TO: DEVM="0"


10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

pico /etc/apf/ad/conf.antidos

There are various things you might want to fiddle with but I'll get the ones that will alert you by email.

# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME="Your Company"
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT="0"
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR="your@email.com"
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log

Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123


12. New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:

chkconfig --level 2345 apf on

To remove it from autostart, run this:

chkconfig --del apf


13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I'll show you 2 of the easier methods.

A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -d 185.14.157.123 TESTING

pico /etc/apf/deny_hosts.rules

Shows the following:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules

You can then just add a new line and enter the IP you wish to block. Before this becomes active though you'll need to reload the APF ruleset.

/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)

I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

/etc/apf/apf -r

B) If the IP isn't already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123


Thanks to R-fx networks for developing and maintaining APF Firewall. Written by Steven Leggett of WebHostGear.com

-----------------------------------------

Now, FB, a couple of notes to make this easier..

Using Steven's suggested ingress and egress ports generally works fine so do not stress about it. Note that he only provides those, however, for Cpanel and Ensim WHM applications. If you use Plesk, you will may either have to experiement or search the web (or the forums at the planet "forums.theplanet.com") for suggested ingress and egress port settings. If you do not have a WHM (cpanel, ensim or Plesk) console installed, change server suppliers as Apache 2's use of else/if commands makes it enormously difficult to operate completely old school/naked and you want to be a pornographer and not a tech guy.

Make certain to activate the autostart on reboot as apf will turn off each time your server goes down - even if for a minute.

Make certain you add your own ip c-class to the allow_hosts.rules

Make certain to test the firewall and your access to the server root prior to activating the firewall permanently (see #9 above). I made the mistake of not testing once and got locked out of a server.

I use a nano text editor in which case change the "pico" commands to nano (or "vi" if you are old school)

If you have problems or need additional information, PM me and I will help you.

[whitey]

FB:

Once you have installed apf, you now want to deny the bastard from getting your site.

There is an excellent tutorial on this at..

http://www.webhostgear.com/209.html

If the page does not load for you, I have copied the contents below...

_------------------------

Have a user that keeps hammering your FTP or trying to login over and over and over again that you just want to ban and never see again? We'll show a quick and dirty method to ban an IP address from the server.

We commonly receive questions like:
"I would like to ban that ip address to prevent the access to the server.

how can i ban that Ip address from the server?"

Simple!

1) Login to the server as and su - to root.

2) If you are running iptables, you can enter:

iptables -A INPUT -s <IP> -j DROP

3) If you have APF firewall installed

apf -d <ip>

4) When you reboot this IP ban will be removed, meaning the IP will no longer be banned anymore.
If you have APF you can get around this by opening the deny hosts file.

pico /etc/apf/deny_hosts.rules

Scroll to the bottom and paste in the IP address.
Ctrl+X then Y to save the changes and exit.

5) Restart APF
/etc/apf/apf -r


---------------------------

A personal note:

Just putting the ip in the apf deny_hosts.rules should work. If not, you can do 2 and 3 as well.

I would ban a range of ips around this bastards ip (i.e. xxx.xxx.xxx/24 starting a few ips before his).

If this does not work, let me know as there are other, more dastardly, ways to stop this. This should, however, accomplish your objectives.

For unmanaged dedicated servers, I really recommend two places: The Planet (theplanet.com). Quite a few hosts use their datacenter and servers, and there is a reason for that. If you are using someone like Superb that offers $59 per month Celeron servers, look at the deals at the Planet which are recirculated servers; they will work until you are generating more cash and they normally defualt to a 100mbs pipe. Most really low end unmanaged suppliers put you on a 10 mbs pipe. The Planet will not offer support if you bother them alot, but the guys will help in a pinch. They also offer different levels of server support (I pay them to do custom kernels for me). Even if they will not help (if you are on an unmanaged server), they normally will give you some direction to find the solution (link, key issue to search for).

The other place I have servers is at liquidweb.com. More expensive, but their version of an unmanaged server is everyone else's version of managed and their team is exceptional.

At the planet, you can get a decent server with 750 to 1000 gigs of transfer per month for $100; liquidweb is about $175 with 750 gigs. Both offer unmetered pipes at industry low prices and both have exceptional tier one redundancy.

If you are in Europe and sans credit card, both will work with you on pay-pal plans I believe. Both serve large customer bases outside the US (the planet boasts that 50% of their customers are non-US based) and are accustomed to working with payment issues.

BTW, I have neither financial or any other interest in either of the server providers I recommended. Just trying to help out.

Let me know if this all works or not, and good luck with this bastard.

[InfoGuy]

FB, I would delete the link in your first post to your thief. There's no point boosting their search engine rankings by giving them an inbound link. Adding insult to injury, if they have more quality inbound links than you, the search engines could view them as the authority site and you as the mirror site, resulting in a penalty to your site.

[pc]

Don't click on their site. There is some kind of virus that is trying to access PC.
BTW I don't think they mirroring your site anymore.