Look out for this fellow

The person in charge of this domain serjwizard.info/ has just completed scraping thousands of sites. I put a sniffer on this fellow two months ago. My suspicions were correct I believe it trying to install mirror sites.

Just a heads up I found many who may be affected by this person. It just finished scraping my news page everything.

Serjwizard.info Online gambling newsxxxxx.com last test was performed on September 27, 2007. ... xxxxx.com strongly urges players avoidance of these two casinos. ...
xxxxserjwizard.info/pages/7777772e6f6e6c696e6567616d626c696e67372e636f6d2f6f 6e6c696e655f67616d626c696e675f6e6... - 21k - Cached - Similar pages

The page is currently blank but if you look at source code all my content is there. But if you look here http://64.233.167.104/search?q=cache...&hl=en&strip=1

Ogpaper I found this http://64.233.167.104/search?q=cache...&hl=en&strip=1

Please take screen shots or at least verify you have seen this by responding. This is well known scraper who I have been complaining about for quite sometime. He has finally let his guard down big time. I only have a few moments to capture the data needed so please be my witness.

greek39

Just thought I would tell ya you are amazing at what you do greek...just a little appreciation for looking out for everyone like always:clap::clap::clap:

Somebody tell Dominique her site is affected as well.

http://72.14.253.104/search?q=cache:...&hl=en&strip=1

Here is some additional info just the basics

ping test
Ping 81.176.236.12
[www.serjwizard.info]
Round trip time to 81.176.236.12: 156 ms
Round trip time to 81.176.236.12: 156 ms
Round trip time to 81.176.236.12: 156 ms
Round trip time to 81.176.236.12: 158 ms
Round trip time to 81.176.236.12: 157 ms
Round trip time to 81.176.236.12: 156 ms
Round trip time to 81.176.236.12: 156 ms
Round trip time to 81.176.236.12: 156 ms
Round trip time to 81.176.236.12: 158 ms
Round trip time to 81.176.236.12: 157 ms

Average time over 10 pings: 156.6 ms--------valid
traceroute
81.176.236.12 is from Russian Federation(RU) in region Europe

TraceRoute to 81.176.236.12 [www.serjwizard.info]
Hop (ms) (ms) (ms) IP Address Host name
1 0 0 0 66.98.244.1 gphou-66-98-244-1.ev1servers.net
2 0 0 0 66.98.241.16 gphou-66-98-241-16.ev1servers.net
3 0 0 0 66.98.240.7 gphou-66-98-240-7.ev1servers.net
4 1 1 1 216.200.251.161 ge-6-0-1.mpr2.iah1.us.above.net
5 1 1 1 64.125.26.14 so-0-0-0.mpr4.iah1.us.above.net
6 14 14 14 64.125.29.61 so-1-0-0.mpr1.atl6.us.above.net
7 14 14 14 64.125.27.50 so-0-0-0.mpr2.atl6.us.above.net
8 36 27 27 64.125.28.229 so-2-1-0.mpr1.dca2.us.above.net
9 100 100 100 64.125.31.185 so-1-1-0.mpr1.lhr2.uk.above.net
10 99 99 99 195.66.224.90 lnd-bgw0-ge0-1-0-102.rt-comm.ru
11 159 161 161 217.106.7.218 msk-dsr1-ae0-804.rt-comm.ru
12 161 161 159 217.106.7.218 msk-dsr1-ae0-804.rt-comm.ru
13 156 156 156 81.176.236.12 ----------valid direct delivery
network
81.176.236.12 is from Russian Federation(RU) in region Europe

NsLookup
name class type data time to live
serjwizard.info IN NS ns.openhosting.ru 85958s (23h 52m 38s)
serjwizard.info IN NS ns2.openhosting.ru 85958s (23h 52m 38s) --------valid



To find out if your site is affected google your title and the scrapers domain.

example: Online poker source "serjwizard.info" there are other methods but i found this to be the easiest. Select cache text version.

Thank you kaus I have been after the fellow for a while now. I think I have the data needed to make a pretty strong case against one or more affiliate programs plus some other stuff. What will happen next this person will 404 or sell the domain. If this person decides to default to Google landing page then i will know exactly who it is.

The person in question appears to be operating out of the U.K but I can't be certain. From what my bud said the "packet" left from there. Most of the whois data is bogus.

The major email spammer

DNS Lookup For Stk-consult.info

;; Answer received from 216.145.1.3 (131 bytes)
;;
;; HEADER SECTION
;; id = 56664
;; qr = 1 opcode = QUERY aa = 0 tc = 0 rd = 1
;; ra = 1 ad = 0 cd = 0 rcode = NOERROR
;; qdcount = 1 ancount = 1 nscount = 2 arcount = 2

;; QUESTION SECTION (1 record)
;; stk-consult.info. IN A

;; ANSWER SECTION (1 record)
stk-consult.info. 10800 IN A 81.176.236.12

;; AUTHORITY SECTION (2 records)
stk-consult.info. 10800 IN NS ns.openhosting.ru.
stk-consult.info. 10800 IN NS ns2.openhosting.ru.

;; ADDITIONAL SECTION (2 records)
ns.openhosting.ru. 4303 IN A 81.176.236.10
ns2.openhosting.ru. 4303 IN A 81.176.237.10

source: http://www.bobbear.co.uk/stkconsult.html good find come and tell us your story please.



greek39

Quote:

---

Originally Posted by kaus

Just thought I would tell ya you are amazing at what you do greek...just a little appreciation for looking out for everyone like always:clap::clap::clap:

---

I second that! You've got skills Greek! After your last post I had to go look up what a "sniffer" was. I'd love to see these leaches go down. 99% of the webmasters would fume about content theft, and then most likely not do too much about it. Seriously, there's not that much main-stream information out there about content protection, defense, and of coarse offense. I suspect that I'll be investing my time in this area as time goes on.

Thanks again, for the heads up.:clap:

pm-ed Dom

Hi guys, and thanks to Greek and the people who pointed me here! :clap:

I am going to poke around a bit too.... this guy definitely needs to be put out of business.

Thanks everyone this has been a long term project since December 2006. This person has caused severe damage in many different areas. If anyone is wondering why their serps dropping or pages are being delisted this could be the reason why.

This fellow is also the primary email spammer we all tend to complain about. I have all the needed info to really go after this fellow legally. In the meantime some may find this this link useful.

http://216.109.125.130/search/cache?...icp=1&.intl=us

The IP that set of my alarm last night was 81.176.236.2 5pages 5hits 107.08 KB 01 Nov 2007 - 23:28

Anyway thanks again I have some work ahead of me.

greek39

If this is a proxy hijack situation, here is some good info:

http://www.seofaststart.com/blog/google-proxy-hacking

Not sure that this is what we are looking at, but the info is good to know.

At G&C we have discovered numerous fake google bots and are currently working on a script that foils them.

Not sure if this is case. But what I do know me and another fellow finally caught this bugger in the process. Anyway I am exhausted been up all night and it’s the weekend.

Dominique if you could please give Lou my best wishes. I hope he is feeling better. Lou is the one who use to tell me for sanity sake take the weekends off. Since then I have taken that advice 80% of the time. Believe me it is really good advice.

Thanks everyone have a great weekend.

greek39

Quote:

---

Originally Posted by Dominique

If this is a proxy hijack situation, here is some good info:

http://www.seofaststart.com/blog/google-proxy-hacking

Not sure that this is what we are looking at, but the info is good to know.

At G&C we have discovered numerous fake google bots and are currently working on a script that foils them.

---

I pretty certain this is not the case. It appears to be a Java crumb hack linked to person who calls itself karmix. This person may or not be of Russian origin.

I also believe it has a vested interest in online gambling plus whatever else makes money. Anyway I started this thread for several reasons: for the public record and to inform board members. Whether or not you choose to believe it I leave up to you. Threat scale I would give 6 out 10. I would however deny these IP's 81.176.236.12. and 81.176.236.2 Although I realize this maybe a temporary fix it may help a bit.

The rest I best keep to myself.

thanks

greek39

Hey, miracle of miracles, google responded to my spam complaint regarding this via the google webmaster tools message center.

I poked around at this for a while and decided the best way to tackle him was through google, everything was too convoluted for me to make sense of what exactly he was doing or who he was. That made it hard to go after him in other ways.

Google's message was simple:

Quote:

---

We've received your spam report for xxhttp://www.serjwizard.info/pages/7777772e67616d626c696e676f6e6c696e656d6167617a696e 652e636f6d2f656e646f7273656d656e74732e706870.html

---

Since this is the first acknowledgement I received after filing hundreds of spam reports, I think maybe we caught something they wanted to see.

I have seen reactions to filed reports many times before as the offender disappeared from the index, but this is the very first time I received a note about it.

I find it encouraging, they are paying attention. :)

Thank you Dominique I submitted a few as well. This particular fellow is all over the place so narrowing it down would be difficult. But I think what we caught was the beginning stages of something new.

Some people often complain Google’s reluctance to take any action against these cyber terrorists. But believe me it is Google’s best interest to do so. Time after time they have said they take these matters seriously.

So thank you Dominique for taking some proactive measures seldom seen by others.
:clap:
greek39

Thanks for pointing it out, greek.

Now that google acknowledged the problem, I think googlers will be able to figure out what all he is up to and then foil him properly.

If it's a new concept in spamming, I am sure they are happy to study it and adjust their algo to nip it in the bud.

Kudos Dom,

For taking this to the source. I know I get a little discouraged sometimes (sure others do too) when addressing this stuff constantly. However, this clearly demonstrates that someone at Google is paying attention, which IMHO makes the hard slog worth it.


Cheers

:clap:

Dave