Thread: nude-area.net fake traffic

100+ hits per day, the "surfer" loads the TGP and "clicks" but strangely doesn't load any images...

Referer URL is slightly unusual and all loads show exactly the same one

Site is still sending "traffic" even after 2 weeks of not being enabled - zero has been returned

It's a hitbot. Plonk.

Oh thanks for telling us..

I agree, it is a bot. And.... still same trafficholder account "krs2011" as another bot sites.

another his site
hairy-area.net

Looks like the same guy. He seems to have expanded operations.

http://www.askdamagex.com/f14/hardco...m-again-48518/

I did some detective work and here are more domains which seem to be his. Some have already been listed.

teen-area.net
hardcore-area.net
celeb-area.net
bdsm-area.net
black-area.net
animexxxhot.com
cartoonxxxhot.com
catfighthot.com
cuckoldhot.com
asian-area.net
celeb-area.net
emo-area.net
nylon-area.net
porn-area.net
spanking-area.net
www. vpnproxygate.com (goes to femdom-area.net for me when i go here)
femdom-area.net

It looks like a pretty big cheating operation spanning many different hosts. Chances are there are many more. I didn't look very deep yet.

Some notes on evidence found follows.

---
animexxxhot.com

My Info
Domain animexxxhot.com
URL Hot XXX Anime
ICQ 645-052-751
Email support /\t animexxxhot.com
Name Srub
Title Hot XXX Anime

-------

cartoonxxxhot.com

My Info
Domain
cartoonxxxhot.com
URL
Hot XXX Cartoon
ICQ
645-052-751
Email support
/\t
cartoonxxxhot.com
Name SRub
Title Hot XXX
Cartoons

----

catfighthot.com/

My Info
Domain
catfighthot.com
URL
Catfight Hot
ICQ
645-052-751
Email support
/\t
catfighthot.com
Name Srub
Title Catfight
Hot

--------


My Info
Domain cuckoldhot.com
URL Cuckold Hot
ICQ 645-052-751
Email support /\t cuckoldhot.com
Name Srub
Title Cuckold Hot

-----------

Other Sites Hosted on this IP Address

animexxxhot.com
cuckoldhot.com
catfighthot.com

-----

pornfans.net (has krs2011 TH link.)

Here are the IP Neighbours for Asian-Area.net

asian-area.net
black-area.net
celeb-area.net
emo-area.net
nylon-area.net

-----------------


Here are the IP Neighbours for Spanking-Area.net

porn-area.net
spanking-area.net
www. vpnproxygate.com (goes to femdom-area.net for me when i go here)

-----

cumshot-area.net
hardcore-area.net
mature-area.net
nude-area.net
pissing-area.net
pornstar-area.net

I'm just about to run out the door so may have a look at this myself later, but are there any "signatures" that link the sites together? The trafficholder ID was mentioned above, maybe there's others like a similar naming of groups of links with the trade script, or custom CSS or javascript used on multiple sites, etc.

I'm mostly in the Asian niche but I know that Asian-Area dot net just appeared out of nowhere last month and suddenly was #1 in everyone's toplists.

Originally Posted by rowan

I'm just about to run out the door so may have a look at this myself later, but are there any "signatures" that link the sites together? The trafficholder ID was mentioned above, maybe there's others like a similar naming of groups of links with the trade script, or custom CSS or javascript used on multiple sites, etc.

I'll probably do some more research later as well. I don't like being cheated and tend to take it personally. When looking for his sites I found a lot of others which might have been his going back many years. I was looking at some of the old content on them to see what I could find.

One thing which bothers me is that he seems to usually use the same ICQ name "Srub" (at least for me) and his domain registration pattern of *-area.net names meant it would be easy to instantly detect all of his sites once he was caught. Surely he had to know that. Seems like a pretty dumb thing to do. What's this guy thinking?

boobs-area.net

Webmaster IPs he used to signup for trades :

64.20.35.186
69.10.42.50

Here are more from his Juicyads account. Some could be duplicates.

xxx-spot.com
cartoon-3x.com
searchfuck.com
young-area.net
hardcore-3x.com
cuckold-place.net
mature-area.net
panties-area.net
moms-area.net
retro-area.net
voyeur-area.net
anal-area.net
bizarre-cartoon.com
shemale-area.net
hardcore-forever.com
catfighthot.com
xtremehard.net
cartoon-erotic.net
hardcore-forever.com
eroticcore.net
gays-area.net
cartoon-forever.com
hardcore-x3.com
tattoo-forever.net
latina-area.net
gay-spot.net
cartoon-area.com
nude-area.net
cartoon-spot.com
young-area.net
retro-area.net

handjob-area.net

More seemingly from the same person:

men-area.net
foot-area.net
sex-area.net
xxx-area.net (also listed as an attack site in Firefox)
girl-area.net
latex-area.net

This guy has his claws in a ton of my trader's sites and they all seem to be on auto-pilot.
I guess I'll be deleting some trades.

I searched for "-area.net" in my list of domains/hostnames and came up with this.

Firstly, these are definitely related, as they're all on the same IP as the known sites:

Code:

69.65.10.86   NET-69-65-0-0-2 (Ecomdevel, LLC   USA)
Server: Apache/1.3.42 (Unix) PHP/5.2.9 with Suhosin-Patch
  anal-area.net
  asian-area.net
  bbw-area.net
  bdsm-area.net
  black-area.net
  boobs-area.net
  celeb-area.net
  cumshot-area.net
  emo-area.net
  gays-area.net
  hairy-area.net
  lesbo-area.net
  mature-area.net
  nude-area.net
  nylon-area.net
  pissing-area.net
  pornstar-area.net
  retro-area.net
  shemale-area.net
  teen-area.net
  voyeur-area.net

Other domains which I think are related:

Code:

69.65.10.99   NET-69-65-0-0-2 (Ecomdevel, LLC   USA)
Server: Apache/1.3.42 (Unix) PHP/5.2.9 with Suhosin-Patch
  animexxxhot.com
  cartoonxxxhot.com
  catfighthot.com
  cuckoldhot.com

95.211.8.143 (Leaseweb   NL)
Server: Apache/1.3.42 (Unix) PHP/5.2.17 with Suhosin-Patch
  young-area.net
  latina-area.net

213.174.129.174 (Advanced Hosters  UK)  (HISTORY ENTRY - SITES ARE NO LONGER ON THIS IP)
Server: Apache/2.2.15 (Unix) PHP/5.2.13  (MAY BE A DIFFERENT CUSTOMER ON THIS IP NOW)
  3d.hardcore-place.com
  adult-session.com
  cartoon-area.com
  cartoon.hardcore-area.net
  cartoon.hardcore-place.com
  comics.hardcore-place.com
  cuckold-place.net
  cuckold-stories.biz
  cuckold.hardcore-area.net
  cuckold.hardcore-place.com
  erotic-catfight.com
  game-forever.net
  hardcore-area.net
  hardcore-place.com
  hentai.hardcore-place.com
  tattoo-forever.net

Here are some other *-area.net domain names. I've removed those that are obviously not adult, but left the "maybe adult" and "likely adult" names. I do NOT have any evidence tying these to the cheater network, it's just a list of *-area.net domains that could be adult sites. Maybe one will jump out as a new but suspicious trade.

Code:

   3d-area.net
   a-area.net
   alt-area.net
   anime-area.net
   apart-area.net
   art-area.net
   d-area.net
   dark-area.net
   digi-area.net
   e-area.net
   erotic-area.net
   f-area.net
   g-area.net
   gay-area.net
   go-area.net
   gold-area.net
   h-area.net
   hot-area.net
   i-area.net
   j-area.net
   k-area.net
   m-area.net
   member-area.net
   members-area.net
   mobile-area.net
   models-area.net
   p-area.net
   perfect-area.net
   pixel-area.net
   porn-area.net
   private-area.net
   s-area.net
   u-area.net
   vips-area.net
   x-area.net

I whittled this down manually from a list of 900+ domains so hopefully someone appreciates this.

Originally Posted by allniche

More seemingly from the same person:

men-area.net
foot-area.net
sex-area.net
xxx-area.net (also listed as an attack site in Firefox)
girl-area.net
latex-area.net

My db doesn't know about these domains yet. They're all on 95.211.8.143 which I mentioned above.