Results 1 to 14 of 14
  1. #1
    pgaming's Avatar
    pgaming is offline Public Member
    Join Date
    July 2005
    Posts
    2,854
    Thanks
    414
    Thanked 215 Times in 164 Posts

    Exclamation Look out for this fellow

    The person in charge of this domain serjwizard.info/ has just completed scraping thousands of sites. I put a sniffer on this fellow two months ago. My suspicions were correct I believe it trying to install mirror sites.

    Just a heads up I found many who may be affected by this person. It just finished scraping my news page everything.

    Serjwizard.info Online gambling newsxxxxx.com last test was performed on September 27, 2007. ... xxxxx.com strongly urges players avoidance of these two casinos. ...
    xxxxserjwizard.info/pages/7777772e6f6e6c696e6567616d626c696e67372e636f6d2f6f 6e6c696e655f67616d626c696e675f6e6... - 21k - Cached - Similar pages

    The page is currently blank but if you look at source code all my content is there. But if you look here http://64.233.167.104/search?q=cache...&hl=en&strip=1

    Ogpaper I found this http://64.233.167.104/search?q=cache...&hl=en&strip=1

    Please take screen shots or at least verify you have seen this by responding. This is well known scraper who I have been complaining about for quite sometime. He has finally let his guard down big time. I only have a few moments to capture the data needed so please be my witness.

    greek39
    Last edited by pgaming; 6 December 2007 at 12:11 pm.

  2. The Following User Says Thank You to pgaming For This Useful Post:


  3. #2
    ck8795 is offline Private Member
    Join Date
    March 2007
    Location
    Canada
    Posts
    1,005
    Thanks
    3
    Thanked 5 Times in 3 Posts

    Default

    Just thought I would tell ya you are amazing at what you do greek...just a little appreciation for looking out for everyone like always

  4. #3
    pgaming's Avatar
    pgaming is offline Public Member
    Join Date
    July 2005
    Posts
    2,854
    Thanks
    414
    Thanked 215 Times in 164 Posts

    Default

    Somebody tell Dominique her site is affected as well.

    http://72.14.253.104/search?q=cache:...&hl=en&strip=1

    Here is some additional info just the basics

    ping test
    Ping 81.176.236.12
    [www.serjwizard.info]
    Round trip time to 81.176.236.12: 156 ms
    Round trip time to 81.176.236.12: 156 ms
    Round trip time to 81.176.236.12: 156 ms
    Round trip time to 81.176.236.12: 158 ms
    Round trip time to 81.176.236.12: 157 ms
    Round trip time to 81.176.236.12: 156 ms
    Round trip time to 81.176.236.12: 156 ms
    Round trip time to 81.176.236.12: 156 ms
    Round trip time to 81.176.236.12: 158 ms
    Round trip time to 81.176.236.12: 157 ms

    Average time over 10 pings: 156.6 ms--------valid
    traceroute
    81.176.236.12 is from Russian Federation(RU) in region Europe

    TraceRoute to 81.176.236.12 [www.serjwizard.info]
    Hop (ms) (ms) (ms) IP Address Host name
    1 0 0 0 66.98.244.1 gphou-66-98-244-1.ev1servers.net
    2 0 0 0 66.98.241.16 gphou-66-98-241-16.ev1servers.net
    3 0 0 0 66.98.240.7 gphou-66-98-240-7.ev1servers.net
    4 1 1 1 216.200.251.161 ge-6-0-1.mpr2.iah1.us.above.net
    5 1 1 1 64.125.26.14 so-0-0-0.mpr4.iah1.us.above.net
    6 14 14 14 64.125.29.61 so-1-0-0.mpr1.atl6.us.above.net
    7 14 14 14 64.125.27.50 so-0-0-0.mpr2.atl6.us.above.net
    8 36 27 27 64.125.28.229 so-2-1-0.mpr1.dca2.us.above.net
    9 100 100 100 64.125.31.185 so-1-1-0.mpr1.lhr2.uk.above.net
    10 99 99 99 195.66.224.90 lnd-bgw0-ge0-1-0-102.rt-comm.ru
    11 159 161 161 217.106.7.218 msk-dsr1-ae0-804.rt-comm.ru
    12 161 161 159 217.106.7.218 msk-dsr1-ae0-804.rt-comm.ru
    13 156 156 156 81.176.236.12 ----------valid direct delivery
    network
    81.176.236.12 is from Russian Federation(RU) in region Europe

    NsLookup
    name class type data time to live
    serjwizard.info IN NS ns.openhosting.ru 85958s (23h 52m 38s)
    serjwizard.info IN NS ns2.openhosting.ru 85958s (23h 52m 38s) --------valid



    To find out if your site is affected google your title and the scrapers domain.

    example: Online poker source "serjwizard.info" there are other methods but i found this to be the easiest. Select cache text version.

    Thank you kaus I have been after the fellow for a while now. I think I have the data needed to make a pretty strong case against one or more affiliate programs plus some other stuff. What will happen next this person will 404 or sell the domain. If this person decides to default to Google landing page then i will know exactly who it is.

    The person in question appears to be operating out of the U.K but I can't be certain. From what my bud said the "packet" left from there. Most of the whois data is bogus.

    The major email spammer

    DNS Lookup For Stk-consult.info

    ;; Answer received from 216.145.1.3 (131 bytes)
    ;;
    ;; HEADER SECTION
    ;; id = 56664
    ;; qr = 1 opcode = QUERY aa = 0 tc = 0 rd = 1
    ;; ra = 1 ad = 0 cd = 0 rcode = NOERROR
    ;; qdcount = 1 ancount = 1 nscount = 2 arcount = 2

    ;; QUESTION SECTION (1 record)
    ;; stk-consult.info. IN A

    ;; ANSWER SECTION (1 record)
    stk-consult.info. 10800 IN A 81.176.236.12

    ;; AUTHORITY SECTION (2 records)
    stk-consult.info. 10800 IN NS ns.openhosting.ru.
    stk-consult.info. 10800 IN NS ns2.openhosting.ru.

    ;; ADDITIONAL SECTION (2 records)
    ns.openhosting.ru. 4303 IN A 81.176.236.10
    ns2.openhosting.ru. 4303 IN A 81.176.237.10

    source: http://www.bobbear.co.uk/stkconsult.html good find come and tell us your story please.



    greek39
    Last edited by pgaming; 2 November 2007 at 2:36 am. Reason: adding to post

  5. The Following User Says Thank You to pgaming For This Useful Post:

    Dominique (7 November 2007)

  6. #4
    Join Date
    March 2006
    Location
    Costa Rica
    Posts
    2,092
    Thanks
    140
    Thanked 171 Times in 119 Posts

    Default

    Quote Originally Posted by kaus View Post
    Just thought I would tell ya you are amazing at what you do greek...just a little appreciation for looking out for everyone like always
    I second that! You've got skills Greek! After your last post I had to go look up what a "sniffer" was. I'd love to see these leaches go down. 99% of the webmasters would fume about content theft, and then most likely not do too much about it. Seriously, there's not that much main-stream information out there about content protection, defense, and of coarse offense. I suspect that I'll be investing my time in this area as time goes on.

    Thanks again, for the heads up.

  7. #5
    elgoog's Avatar
    elgoog is offline Private Member
    Join Date
    December 2006
    Location
    Europe
    Posts
    795
    Thanks
    526
    Thanked 294 Times in 193 Posts

  8. The Following 2 Users Say Thank You to elgoog For This Useful Post:

    Dominique (7 November 2007)

  9. #6
    Dominique's Avatar
    Dominique is offline Private Member
    Join Date
    March 2002
    Location
    The Boonies
    Posts
    4,777
    Thanks
    452
    Thanked 724 Times in 299 Posts

    Default

    Hi guys, and thanks to Greek and the people who pointed me here!

    I am going to poke around a bit too.... this guy definitely needs to be put out of business.

  10. #7
    pgaming's Avatar
    pgaming is offline Public Member
    Join Date
    July 2005
    Posts
    2,854
    Thanks
    414
    Thanked 215 Times in 164 Posts

    Post

    Thanks everyone this has been a long term project since December 2006. This person has caused severe damage in many different areas. If anyone is wondering why their serps dropping or pages are being delisted this could be the reason why.

    This fellow is also the primary email spammer we all tend to complain about. I have all the needed info to really go after this fellow legally. In the meantime some may find this this link useful.

    http://216.109.125.130/search/cache?...icp=1&.intl=us

    The IP that set of my alarm last night was 81.176.236.2 5pages 5hits 107.08 KB 01 Nov 2007 - 23:28

    Anyway thanks again I have some work ahead of me.

    greek39

  11. #8
    Dominique's Avatar
    Dominique is offline Private Member
    Join Date
    March 2002
    Location
    The Boonies
    Posts
    4,777
    Thanks
    452
    Thanked 724 Times in 299 Posts

    Default

    If this is a proxy hijack situation, here is some good info:

    http://www.seofaststart.com/blog/google-proxy-hacking

    Not sure that this is what we are looking at, but the info is good to know.

    At G&C we have discovered numerous fake google bots and are currently working on a script that foils them.

  12. #9
    pgaming's Avatar
    pgaming is offline Public Member
    Join Date
    July 2005
    Posts
    2,854
    Thanks
    414
    Thanked 215 Times in 164 Posts

    Default

    Not sure if this is case. But what I do know me and another fellow finally caught this bugger in the process. Anyway I am exhausted been up all night and it’s the weekend.

    Dominique if you could please give Lou my best wishes. I hope he is feeling better. Lou is the one who use to tell me for sanity sake take the weekends off. Since then I have taken that advice 80% of the time. Believe me it is really good advice.

    Thanks everyone have a great weekend.

    greek39

  13. The Following 4 Users Say Thank You to pgaming For This Useful Post:

    AmCan (3 November 2007), bb1web (2 November 2007), Ziggy (2 November 2007)

  14. #10
    pgaming's Avatar
    pgaming is offline Public Member
    Join Date
    July 2005
    Posts
    2,854
    Thanks
    414
    Thanked 215 Times in 164 Posts

    Post

    Quote Originally Posted by Dominique View Post
    If this is a proxy hijack situation, here is some good info:

    http://www.seofaststart.com/blog/google-proxy-hacking

    Not sure that this is what we are looking at, but the info is good to know.

    At G&C we have discovered numerous fake google bots and are currently working on a script that foils them.
    I pretty certain this is not the case. It appears to be a Java crumb hack linked to person who calls itself karmix. This person may or not be of Russian origin.

    I also believe it has a vested interest in online gambling plus whatever else makes money. Anyway I started this thread for several reasons: for the public record and to inform board members. Whether or not you choose to believe it I leave up to you. Threat scale I would give 6 out 10. I would however deny these IP's 81.176.236.12. and 81.176.236.2 Although I realize this maybe a temporary fix it may help a bit.

    The rest I best keep to myself.

    thanks

    greek39
    Last edited by pgaming; 5 November 2007 at 12:39 pm. Reason: adding to post

  15. #11
    Dominique's Avatar
    Dominique is offline Private Member
    Join Date
    March 2002
    Location
    The Boonies
    Posts
    4,777
    Thanks
    452
    Thanked 724 Times in 299 Posts

    Default

    Hey, miracle of miracles, google responded to my spam complaint regarding this via the google webmaster tools message center.

    I poked around at this for a while and decided the best way to tackle him was through google, everything was too convoluted for me to make sense of what exactly he was doing or who he was. That made it hard to go after him in other ways.

    Google's message was simple:

    We've received your spam report for xxhttp://www.serjwizard.info/pages/7777772e67616d626c696e676f6e6c696e656d6167617a696e 652e636f6d2f656e646f7273656d656e74732e706870.html
    Since this is the first acknowledgement I received after filing hundreds of spam reports, I think maybe we caught something they wanted to see.

    I have seen reactions to filed reports many times before as the offender disappeared from the index, but this is the very first time I received a note about it.

    I find it encouraging, they are paying attention.

  16. The Following 2 Users Say Thank You to Dominique For This Useful Post:

    AussieDave (8 November 2007)

  17. #12
    pgaming's Avatar
    pgaming is offline Public Member
    Join Date
    July 2005
    Posts
    2,854
    Thanks
    414
    Thanked 215 Times in 164 Posts

    Thumbs up

    Thank you Dominique I submitted a few as well. This particular fellow is all over the place so narrowing it down would be difficult. But I think what we caught was the beginning stages of something new.

    Some people often complain Google’s reluctance to take any action against these cyber terrorists. But believe me it is Google’s best interest to do so. Time after time they have said they take these matters seriously.

    So thank you Dominique for taking some proactive measures seldom seen by others.

    greek39

  18. The Following User Says Thank You to pgaming For This Useful Post:

    Dominique (7 November 2007)

  19. #13
    Dominique's Avatar
    Dominique is offline Private Member
    Join Date
    March 2002
    Location
    The Boonies
    Posts
    4,777
    Thanks
    452
    Thanked 724 Times in 299 Posts

    Default

    Thanks for pointing it out, greek.

    Now that google acknowledged the problem, I think googlers will be able to figure out what all he is up to and then foil him properly.

    If it's a new concept in spamming, I am sure they are happy to study it and adjust their algo to nip it in the bud.

  20. #14
    AussieDave's Avatar
    AussieDave is offline Public Member
    Join Date
    November 2005
    Location
    from the land downunder
    Posts
    3,864
    Blog Entries
    1
    Thanks
    1,534
    Thanked 1,739 Times in 992 Posts

    Default

    Kudos Dom,

    For taking this to the source. I know I get a little discouraged sometimes (sure others do too) when addressing this stuff constantly. However, this clearly demonstrates that someone at Google is paying attention, which IMHO makes the hard slog worth it.


    Cheers



    Dave
    ---
    Do the right thing, even when no one is looking. It's called integrity.
    ---

    igaming affiliates rights - fairness for all iGaming affiliates

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •