It's WAR!

[EEVblog]

Check this out!:
http://www.warvideoblog.com/
Wow, dejavu!

Investigation time...

Dave.

[armandas]

From WHOIS:

Registrant:
   warvideoblog.com
   547 Skinner Hollow Road
   Haines, California 97833
   United States

   Domain Name: WARVIDEOBLOG.COM
      Created on: 16-Jul-08
      Expires on: 16-Jul-10
      Last Updated on: 10-Apr-09

   Administrative Contact:
      Bryant, Jerome K  
      warvideoblog.com
      547 Skinner Hollow Road
      Haines, California 97833
      United States
      +1.5418563392      Fax -- +1.5418563392

   Technical Contact:
      Bryant, Jerome K  
      warvideoblog.com
      547 Skinner Hollow Road
      Haines, California 97833
      United States
      +1.5418563392      Fax -- +1.5418563392

   Domain servers in listed order:
      NS33.DOMAINCONTROL.COM
      NS34.DOMAINCONTROL.COM

Uses (surprise surprise) GoDaddy services. My guess is Jerome's trying to increase site's popularity/pagerank. All he can get though, is a ban from Google and  hopefully godaddy as well (if Dave's willing to bring this to an end).

[EEVblog]

I've been told the address is a fake, but the email works.
The owner tried to set up an ad revenue service on the site, and it's they who smelled a rat and tipped me off.
I'm trying to find a technical/complaints/legal contact at GoDaddy to get it removed...

Dave.

[Ferroto]

http://www.warvideoblog.com/forum/index.php?topic=195.0

Appearently this forum is mirrored exactually look you can even read THIS post


Btw if anyone was going to That site the proper address is www.eevblog.com/ accept NO imitations  

*edit* wow when it mirrored my comment it replaced

Code: [Select]

www.e-e-e-v-b-l-o-g.c-o-m (without the -'s) with the URL

[EEVblog]

http://www.warvideoblog.com/forum/index.php?topic=195.0

Appearently this forum is mirrored exactually look you can even read THIS post


Btw if anyone was going to That site the proper address is www.eevblog.com/ accept NO imitations  

*edit* wow when it mirrored my comment it replaced

Code: [Select]

www.e-e-e-v-b-l-o-g.c-o-m (without the -'s) with the URL

WOW alright!
That's actually very impressive!!

Almost a shame, but this dude is going DOWN!

Dave.

[adam1213]

Check your the web server logs - you may find an easy way of blocking them (at least until they get around it)
- you might want to consider redirecting people going there to a page that manages to get around their url rewriting thing and redirects people to the actual site.

for example

Code: [Select]

<script type="text/javascript">
<!--
window.location = 'h'+'t'+'t'+'p'+':'+'w'+'w'+'w'+'.'+'e'+'e'+'v'+'b'+'l'+'o'+'g'+'.'+'c'+'o'+'m';
//-->
</script>though it probably wouldn't last long before they block it and you would still need some text for users without javascript

[charliex]

The address is fake too, that address is in oregon, not california. if i remember the bazillions of emails i get from nsi the details have to be accurate or they'll delist it. another attack vector

[migsantiago]

Dave, just a tip... post any weird URLs in this fashion:

Code: [Select]

http://www.warvideoblog.com/
By posting them in a normal way (clickable way) you're actually boosting up that URL at Google PageRank.

[Ferroto]

That website updates instantly within any content changing here, this indicates they likely have access to the database this site runs off. Change your DB password, and if the DB has the option, setup a 3 strikes and your out approach for password verification.

[Ferroto]

Check your the web server logs - you may find an easy way of blocking them (at least until they get around it)
- you might want to consider redirecting people going there to a page that manages to get around their url rewriting thing and redirects people to the actual site.

for example

Code: [Select]

<script type="text/javascript">
<!--
window.location = 'h'+'t'+'t'+'p'+':'+'w'+'w'+'w'+'.'+'e'+'e'+'v'+'b'+'l'+'o'+'g'+'.'+'c'+'o'+'m';
//-->
</script>though it probably wouldn't last long before they block it and you would still need some text for users without javascript

It could also throw people into an infinite loop of loading this site.

*edit* wait DO AN EEVBLOG ON IT 

[xani]

For 99.99999% its just simple proxy which gets page from eevblog.com, rewrites all urls to warblog com and sends it to client
something like "we get request so we download it from eevblog.com and then send it to client"
if u have access to log just block them

you could prob sue them for copyright ;]

[adam1213]

It could also throw people into an infinite loop of loading this site.

Didn't think about that one - though the attack on their site would be their fault (but it does waste usage for people that leave the page open too long)

- instead it could be
window.location = 'h'+'t'+'t'+'p'+':'+'w'+'w'+'w'+'.'+'e'+'e'+'v'+'b'+'l'+'o'+'g'+'.'+'c'+'o'+'m' + '?' + 'r' + '=' + '1';
and have server not redirect people if r is set (though soon they would just send r=1 for everything)

or just have a page with a message with the link to the real blog with some text that won't be rewritten and an image with the url.

[EEVblog]

HA! blocked him with one fell swoop of my Hosting IP blocker!

But I guess I'll have to re-enable it for a while so I can prove that he's stealing my stuff to ultimately get him shut down.

Dave.

[EEVblog]

Got him!
"This Account Has Been Suspended"
10 minutes after me sending the DMCA takedown notice to the web host!

That fight was just too easy, no fun at all!

Dave.

[ToddFun]

So whats up now?  The site seems ok now. I has content that matches its URL.  Maybe their account was hacked?  At any rate the URL is up but none of Dave's stuff is there.

[EEVblog]

So whats up now?  The site seems ok now. I has content that matches its URL.  Maybe their account was hacked?  At any rate the URL is up but none of Dave's stuff is there.

They weren't hacked, they were deliberately leeching off my material. They are back with someone else's material I'm sure, although I don't know who.

Dave.