BLACKLIST can of worms...

[GeorgeTH]

I guess you noticed my other thread about an image thief - little did I realize at the time how much I had been cheated by the same group of people using dozens of different domains! - almost two-thirds of all galleries picked up by my bot for re-directing to dialers belongs to the same bunch of people who in this one incident stole my content:

The following list doesn't cover all - there are more to come:
litesex.net
boyxmom.com
cum-river.com
10orgasm.com
18-yo.com
cum2face.com
cum2me.net
atomic-cunts.com
absolut-hardcore.net
lucky-girls.net
my-vagina.com
online-fuck.com
3fuck.net
3blowjob.com
cumocean.net
cum3.net
granyserias.net
global-hardcore.com
individual-sex.com
cool-fuck.net
...and almost forgot the one which started this:
hq-pics.net

Have a look through your blacklist - I bet you'll find some of the above in there, too!

'whois'
either
Name: Nicolas
Last Name: Trimm
Address: Jaqleen Paradis ave 142a
City: Paris
State: PA
Zip Code: 33109
Country: FR
Email: derek@zeos.net

or
Name: Kirk
Last Name: Levings
Address: PO Box 71
City: New York
State: NY
Zip Code: 10112
Country: US
Email: info@hihost4all.com

or in few cases a third name -
name servers I found so far:

Name Server 1: ns1.fastserv4u.com
Name Server 2: ns2.fastserv4u.com

Name Server 1: ns1.smuthostz.com
Name Server 2: ns2.smuthostz.com

Name Server 1: ns1.hihost4all.com
Name Server 2: ns2.hihost4all.com


put an end to these cheaters!

[GeorgeTH]

Here's one more domain used by these guys which I found today in my MOVIES section:

sexx-files.com

no for cheaters!

[GeorgeTH]

Can't believe it - today I found another four domains belonging to the same cheaters!

porn-series.net
blowjob-hardcore.net
1stteensex.net
girlscouple.net

No for these guys!

[GeorgeTH]

...yes - I'm a man on a mission, so here are 5 more URL belonging to the SAME cheaters as above:

69pornpix.com
newsexvids.com
maximalfuck.com
nuclearcunts.com
usa-teens.net

and one more nameserver belonging to these guys:
ns1.nicephotos4ya.com
ns2.nicephotos4ya.com

If I'm I can be stubborn...

[Ramster]

Anymore you find, let us know.

[GeorgeTH]

Originally posted by Ramster
Anymore you find, let us know.

I will, I will - but only 1 more today:

viphardpix.com


Yesterday I had to learn the hard way that these assholes are also the ones who are changing my browser and my registry! - for several days I had the problem of getting pop-ups as soon as I opened a page with sextracker counter. Finally cleaned my system yesterday (everything was fine!) until I opened one of their redirect pages - then it was back to that nuisance.

obj[0]=RegValue : SOFTWARE\Microsoft\Internet Explorer\Main
obj[11/3]=RegData : SOFTWARE\Microsoft\Internet Explorer\Styles (User Stylesheet = c:\windows\web\oslogo.bmp)
obj[12/3]=RegData : SOFTWARE\Microsoft\Internet Explorer\Styles (Use My Stylesheet = 1)

[GeorgeTH]

Latest update - here are a few more urls owned by these cheaters:

closevagina.com
bustybitchesfuck.com
sexy-mix.com
teenexposive.com
joesex.net

...and then I found these 2 domains re-directing to the same pop-ups and dialer:
simplysluts.net
realhornybabes.net

Now - the registration details are completely different, so
at this stage I can't say if these domains belong to the same group which set this thread off!

Gallagher Insurance
Brendan Gallagher (simplysluts@simplysluts.net)
(253) 473-3010
FAX- none
5610 75th St W
Tacoma, WA 98499
US

Allstate Insurance
Christian Vineyard (webmaster@realhornybabes.net)
(304) 242-0463
FAX- none
135 Waddles Run Rd
Wheeling, WV 26003
US

Nameservers for both:
NS1.YCISP.COM
NS2.YCISP.COM

Here are several domains I rejected because they show almost identical infos
but I must stress that at this point of time I have no proof of them cheating:
teenagers4u.com
cutieteenspics.net
bestteenspics.net
bettersexporn.com
nasty-slut.com

Enjoy your Sunday!

[GeorgeTH]

Here are 20 more domains - all registered to the original cheat Nicolas Trimm:

prettysex.net
xxxexpirience.com
magicanal.com
xxx-dirtyslut.com
xxxpicsnclips.com
webcam-fuck.com
bustybitchesfuck.com
hardcoredslaves.com
sweetteensporn.com
hardprostitutes.com
hottieshardcore.com
softasspumping.com
buttpluging.com
lotsofhotporn.com
69pornpix.com
uncensoredmpegs.com
pornmpgegz.com
gofindpornpix.com
thepornuwant.com
nicephotos4ya.com

some semi-decent names in this list - shame they're all registered to a cheat!

[GeorgeTH]

It doesn't end! The following are all domains registered to Kirk Levings (see above):

youseefirst.com
garagefuck.com
Teacherfucked.com
Pickme4night.com
Lognnight.com
Fuckingallnight.com
Haesex.com
Slaveteenie.com
Speeddiesex.com
Letsfuckhard.com
Wewant2fuck.com
Jenniesshow.com
Woodencock.com
Teasinggirl.com
Cockinside.com
Facialact.com
Deargirls.com
Chuckfuck.com
10sfuck.com
Exclusive-pics.com
Ultimate-pics.net
Europe-sex.net
Wwwteens.net
Fuckphoto.net
Umaxhardcore.com
Opencunts.net
Xevasex.com
Closevagina.com
Viphardpix.com
Jiglysex.com
Powertits.com
Teensanus.com
Sample-movies.com
Sexxvids.com
Mtvides.com
Grand-galleries.com
Only-series-vids.com

That must make it now close to 100!! And you wonder why it's hard to find available domain names? And we have a new name to the same scam: Eric Alson with following domains (as far as I have found - all registered early September = fresh!)

Matureact.net
Attentionmoms.net
Globalmom.net
Charmature.net
Maturepoze.net

Contact:
Name: Eric
Last Name: Alson
Address: po box 57
City: London . . . . . . we moved countries once again = LOL!
Zip Code: 23569
Country: GB
Company: null
Email: eric@hihost4all.com


I'll keep at it - no for TGP cheats!

[Bill]

Way to go George!

What are the ways in which you could make sure this list gets around? I know you are posting at other places, but can you get this info into the brownie shared blacklist, and other shared blacklists?

[GeorgeTH]

Originally posted by Bill
Way to go George!

What are the ways in which you could make sure this list gets around? I know you are posting at other places, but can you get this info into the brownie shared blacklist, and other shared blacklists?

Could you give me any contact URLs or things like that?

One BIG problem I see is that these guy(s) (I asume it's a group of people) change their domains as quickly as others change their underwear... And if you check the list closely you'll find that they seem to use some of their domains as their own nameservers (eg. nicephotos4ya.com was a submitted URL, but appears as nameserver for several other URLs).

I don't think my script (AGP) features blacklisting of IP blocks (all domains from yesterday were IP# 69.57.167.66 - 69.57.167.116), and I'm almost sure that once this knowledge is out that in future they will avoid using blocks of IP numbers.

It's a bloody tedious work to find them...

[GeorgeTH]

This is the first update for today - and another 30 or so before I even started my reviews for the day - these were all triggered by a post on gfy sorry for the cross link, but I figure we have to fight these bastards!

individual-sex.com
quality-hardcore.net
1stteensex.net
Absolut-hardcore.net
allteen-galleries.com
Best-teen-series.com
Boyxmom.com
Drinkandfuck.com
Myfirstorgasm.net
Lesbian-party.net
Girlscouple.net
Cooolteens.com
Cuntslips.com
Cum-river.com
Cum2face.com
Cupofcum.com
Incestray.net
Incestrule.com
Mikkiseries.com
Sistersalbum.com
older-the-better.com
Picsofbabes.com
Pics4surfers.com
Strong-penis.com
Sweetcunts.net
Yetafucker.com
Saqmydick.com
Sexiepages.com
Sexinpub.com
Surfmyporn.com
Teengalleries4u.com
Teens-angel.com
Teens-pix.com
Teen-xgalleries.com
Wetpussy-sex.com
X3-galleries.com
Xteeens.com
Xwebteen.com
vipplace.net
Teenspalace.net
Euro-teens.net
Teenie-pics.net
Ultrafuck.net

new nameserver:
Name Server 1: ns1.bigserverz.com
Name Server 2: ns2.bigserverz.com

...and another cheat (redirecting!) who was already on my 'watch list' - I just found proof that also related to these cheats:

favoritexxxpix.com
Bigboobsbabes.com
Cheatingwivespix.com
Findfreepornpics.com
Fuckingherboobs.com
Groupsexlovers.com
Hornyblondes4u.com
Hotslutshardcore.com
Jerkoffrightnow.com
Outdooractions.com
Privatepornpix.com
Sexyladiesgotfucked.com
Smutpages4u.com
Tenniehardacts.com
Teenspages4u.com
Teenwetcunt.com
Tittysweeties.com
Theylikejizz.com
Xblowjobz.com


Snider Herhard (dxt@gala.net)
2167543182
Shaizer Ave, 12A, room 301
London, UK 14652
DE

Name: Dieter
Last Name: Brooks
Address: USA 10231 PO BOX 1120
City: NY
State: NY
Zip Code: 10231
Country: US
Company: null
Email: derek@zeos.net . . . . email identical to Nicolas Trimm!!
: +01.1205556712

NS1.TEENWETCUNT.COM
NS2.TEENWETCUNT.COM

[Wazza]

George - doing 69.57.167. as an ip ban should kill off the entire block without harming any others

I know this works in agp sql

[Totem Rex]

George,

I'm living in France, I just wanted to say

'whois'
either
Name: Nicolas
Last Name: Trimm
Address: Jaqleen Paradis ave 142a
City: Paris
State: PA
Zip Code: 33109
Country: FR
Email: derek@zeos.net

is a phony address that does not exist at all. Zip 33109 is not Paris at all, it's south-west of France, the street does not even exist in Paris and "Jaqleen" is not spelled right. The way the address is writen shows the guy is not French (street numbers are never at the end here).

Hope it'll help a bit.

[Bill]

George, I'm not a TGP owner, so I don't know as much about the various shared blacklists as a bunch of other people here might.

I'd like to see a page here at GG&J that has links to all the various blacklists gathered together, so we could counterattack cheaters easily and quickly when we find them.

Also, I'm not sure which TGP owners who post here are using brownie, which has one of the best shared blacklist tools. Maybe nobody... mostly AGP users here. Anyway, to get somebody who uses brownie to add those domains/info to the shared blacklist might be fairly easy.

What other shared blacklists are around now? I think tgpowners.com (not sure I have name right) had one, but I haven't heard about it lately, might be defunct.

[GeorgeTH]

UPDATE Not many new domains to report which I can trace to the initial group of cheaters, but several other disturbing issues - so read on!

One domain I think I missed:

ultimate-pics.net

Then I found final confirmation that the URLs I listed above in cursive are in fact all cheating along similar lines: all use the same dialer pop-up hell and the re-directs are not discovered by a normal linkbot. I still haven't found proof if they belong to the same group of cheaters who initiated this thread. One thing they have in common are registrations to fantasy companies or institutions (I found one registered to a 'family law court', one to a 'child care facility', and a few more to 'insurances'):

teenages18.com
yourteenages.com
teeniedreams.net
smut-orgy.com
seetheporn.com
wifeinaction.com

NS1.XTRAFF.COM
NS2.XTRAFF.COM

After battling with it for almost two weeks I finally discovered a tool to remove the spyware trojan. If your webbrowser is redirected to global-finder.com or CoolWebSearch or any other search page (almost always with the account number 101 - so the link would be global-finder.com ?101) then this little piece of software gets rid of this (adaware and spybot doesn't!).

Another rather disturbing fact:
despite being in my AGP blacklist new submissions from these cheaters appear daily in my submissions!
So if you're using AGP don't be fooled into the wrong piece of mind that you have them covered with your blacklist. Either there's a bug in AGPs blacklist or these guys are using an autosubmitter which circumvents the blacklist checker! I have contacted JMB today about this (and wonder if they will do anything about it)...

Enjoy the rest of the weekend! G.

[Tommy]

I was just talking to this guys host yesterday

they are draging their feet
a few more emails would be nice

abuse@pwebtech.com <abuse@pwebtech.com>

put attn steve

[GeorgeTH]

It's getting harder to catch them and they're NOT giving up!

Parava.com, their domain registrar, doesn't give anymore information to 'whois' look-ups (I wonder how that's possible) - but still my suspicion keeps me alert:

we have a new 'identity':
Administrative Contact:
Name: Eric
Last Name: Alson
Address: po box 57
City: London
State: London
Zip Code: 23569
Country: GB
Company:
Email: eric@hihost4all.com
Telephone: +04.562849663
Fax:

new nameserver:
NS1.POWERSITEZ.COM
NS2.POWERSITEZ.COM

and a couple of new domains:
videojennie.com
teennamer.com

...and a few more cheaters (not related to the first group):

berkopf.com
analactions.net
rawpornmovies.com
sexmagic.org
sexinflow.com


The last two were so clever and re-directed before I had a chance to review - should send them into lessons with Nicolas Trimm or Snider Herhard...

No for cheaters

[GeorgeTH]

...just a short update - all found today, but I didn't find time to search for more:

2 to the new 'identity' Eric Alson:

nimofilms.com
hardcorefilms.net

and
sexx-files.com

New nameserver:

Name Server 1: ns5.parava.net
Name Server 2: ns6.parava.net

...which is identical to the 'whois' server of their registrar -
how fu@#ing big are these guys???

More cheats - not related:

ultimate-pics.net
exclusive-pics.com
porno-doctor.com
getmoreteens.com
xxxxart.com

Some nasty MALWARE spread by some of the above!

Have a good weekend!

[Tommy]

what does "agp" mean ????

[Cleo]

AGP = Auto Gallery Pro
http://jmbsoft.com/software/ags/

[Tommy]

hey cleo hows stuff

[Cleo]

Stuff is good Tommy.
Sales have really picked up which always helps stuff.

How's stuff with you?

[Tommy]

Things are good

I really have had my nose to the grindstone the last few weeks
which is always good

gallerys, gallerys, gallerys, gallerys, gallerys and more gallerys

[GeorgeTH]

A few more by 'Kirk Levings':
lesbi-ans.com
sex-eplorer.net &nbsp;&nbsp;&nbsp;&nbsp;<<< no: I didn't miss-spell it!
mynewporn.com

and some other cheats (re-directs or adding dialer):
xxx-teenie.com
galler6.com
77teens.com

That's it for today