Author Topic: It's WAR!  (Read 7491 times)

0 Members and 1 Guest are viewing this topic.

Online EEVblog

  • Administrator
  • *****
  • Posts: 32364
  • Country: au
    • EEVblog
It's WAR!
« on: February 04, 2010, 08:09:42 pm »
Check this out!:
http://www.warvideoblog.com/
Wow, dejavu!

Investigation time...

Dave.
 

Offline armandas

  • Frequent Contributor
  • **
  • Posts: 336
  • Country: jp
    • My projects
Re: It's WAR!
« Reply #1 on: February 04, 2010, 08:28:21 pm »
From WHOIS:
Quote
Registrant:
   warvideoblog.com
   547 Skinner Hollow Road
   Haines, California 97833
   United States

   Domain Name: WARVIDEOBLOG.COM
      Created on: 16-Jul-08
      Expires on: 16-Jul-10
      Last Updated on: 10-Apr-09

   Administrative Contact:
      Bryant, Jerome K  
      warvideoblog.com
      547 Skinner Hollow Road
      Haines, California 97833
      United States
      +1.5418563392      Fax -- +1.5418563392

   Technical Contact:
      Bryant, Jerome K  
      warvideoblog.com
      547 Skinner Hollow Road
      Haines, California 97833
      United States
      +1.5418563392      Fax -- +1.5418563392

   Domain servers in listed order:
      NS33.DOMAINCONTROL.COM
      NS34.DOMAINCONTROL.COM

Uses (surprise surprise) GoDaddy services. My guess is Jerome's trying to increase site's popularity/pagerank. All he can get though, is a ban from Google and  hopefully godaddy as well (if Dave's willing to bring this to an end).
« Last Edit: February 04, 2010, 08:30:16 pm by armandas »
 

Online EEVblog

  • Administrator
  • *****
  • Posts: 32364
  • Country: au
    • EEVblog
Re: It's WAR!
« Reply #2 on: February 04, 2010, 09:06:29 pm »
I've been told the address is a fake, but the email works.
The owner tried to set up an ad revenue service on the site, and it's they who smelled a rat and tipped me off.
I'm trying to find a technical/complaints/legal contact at GoDaddy to get it removed...

Dave.
 

Offline Ferroto

  • Frequent Contributor
  • **
  • Posts: 289
  • Country: ca
Re: It's WAR!
« Reply #3 on: February 05, 2010, 12:05:38 am »
http://www.warvideoblog.com/forum/index.php?topic=195.0

Appearently this forum is mirrored exactually look you can even read THIS post


Btw if anyone was going to That site the proper address is www.eevblog.com/ accept NO imitations  ;)

*edit* wow when it mirrored my comment it replaced
Code: [Select]
www.e-e-e-v-b-l-o-g.c-o-m (without the -'s) with the URL
« Last Edit: February 05, 2010, 12:10:43 am by Ferroto »
 

Online EEVblog

  • Administrator
  • *****
  • Posts: 32364
  • Country: au
    • EEVblog
Re: It's WAR!
« Reply #4 on: February 05, 2010, 12:53:09 am »
http://www.warvideoblog.com/forum/index.php?topic=195.0

Appearently this forum is mirrored exactually look you can even read THIS post


Btw if anyone was going to That site the proper address is www.eevblog.com/ accept NO imitations  ;)

*edit* wow when it mirrored my comment it replaced
Code: [Select]
www.e-e-e-v-b-l-o-g.c-o-m (without the -'s) with the URL

WOW alright!
That's actually very impressive!!

Almost a shame, but this dude is going DOWN!

Dave.
 

Offline adam1213

  • Regular Contributor
  • *
  • Posts: 119
  • Country: au
Re: It's WAR!
« Reply #5 on: February 05, 2010, 12:58:59 am »
Check your the web server logs - you may find an easy way of blocking them (at least until they get around it)
- you might want to consider redirecting people going there to a page that manages to get around their url rewriting thing and redirects people to the actual site.

for example
Code: [Select]
<script type="text/javascript">
<!--
window.location = 'h'+'t'+'t'+'p'+':'+'w'+'w'+'w'+'.'+'e'+'e'+'v'+'b'+'l'+'o'+'g'+'.'+'c'+'o'+'m';
//-->
</script>
though it probably wouldn't last long before they block it and you would still need some text for users without javascript
« Last Edit: February 05, 2010, 01:05:24 am by adam1213 »
 

Offline charliex

  • Frequent Contributor
  • **
  • Posts: 332
  • Country: 00
  • Car Hacker
Re: It's WAR!
« Reply #6 on: February 05, 2010, 01:02:26 am »
The address is fake too, that address is in oregon, not california. if i remember the bazillions of emails i get from nsi the details have to be accurate or they'll delist it. another attack vector
 

Offline migsantiago

  • Frequent Contributor
  • **
  • Posts: 381
  • Country: 00
    • MigSantiago's Web Site
Re: It's WAR!
« Reply #7 on: February 05, 2010, 01:04:31 am »
Dave, just a tip... post any weird URLs in this fashion:

Code: [Select]
http://www.warvideoblog.com/
By posting them in a normal way (clickable way) you're actually boosting up that URL at Google PageRank.
 

Offline Ferroto

  • Frequent Contributor
  • **
  • Posts: 289
  • Country: ca
Re: It's WAR!
« Reply #8 on: February 05, 2010, 01:11:05 am »
That website updates instantly within any content changing here, this indicates they likely have access to the database this site runs off. Change your DB password, and if the DB has the option, setup a 3 strikes and your out approach for password verification.
 

Offline Ferroto

  • Frequent Contributor
  • **
  • Posts: 289
  • Country: ca
Re: It's WAR!
« Reply #9 on: February 05, 2010, 01:19:26 am »
Check your the web server logs - you may find an easy way of blocking them (at least until they get around it)
- you might want to consider redirecting people going there to a page that manages to get around their url rewriting thing and redirects people to the actual site.

for example
Code: [Select]
<script type="text/javascript">
<!--
window.location = 'h'+'t'+'t'+'p'+':'+'w'+'w'+'w'+'.'+'e'+'e'+'v'+'b'+'l'+'o'+'g'+'.'+'c'+'o'+'m';
//-->
</script>
though it probably wouldn't last long before they block it and you would still need some text for users without javascript

It could also throw people into an infinite loop of loading this site.

*edit* wait DO AN EEVBLOG ON IT  8)
« Last Edit: February 05, 2010, 01:25:16 am by Ferroto »
 

Offline xani

  • Frequent Contributor
  • **
  • Posts: 386
Re: It's WAR!
« Reply #10 on: February 05, 2010, 01:22:51 am »
For 99.99999% its just simple proxy which gets page from eevblog.com, rewrites all urls to warblog com and sends it to client
something like "we get request so we download it from eevblog.com and then send it to client"
if u have access to log just block them

you could prob sue them for copyright ;]
 

Offline adam1213

  • Regular Contributor
  • *
  • Posts: 119
  • Country: au
Re: It's WAR!
« Reply #11 on: February 05, 2010, 01:25:15 am »
It could also throw people into an infinite loop of loading this site.

Didn't think about that one - though the attack on their site would be their fault (but it does waste usage for people that leave the page open too long)

- instead it could be
window.location = 'h'+'t'+'t'+'p'+':'+'w'+'w'+'w'+'.'+'e'+'e'+'v'+'b'+'l'+'o'+'g'+'.'+'c'+'o'+'m' + '?' + 'r' + '=' + '1';
and have server not redirect people if r is set (though soon they would just send r=1 for everything)

or just have a page with a message with the link to the real blog with some text that won't be rewritten and an image with the url.
 

Online EEVblog

  • Administrator
  • *****
  • Posts: 32364
  • Country: au
    • EEVblog
Re: It's WAR!
« Reply #12 on: February 05, 2010, 01:26:07 am »
HA! blocked him with one fell swoop of my Hosting IP blocker!

But I guess I'll have to re-enable it for a while so I can prove that he's stealing my stuff to ultimately get him shut down.

Dave.
 

Online EEVblog

  • Administrator
  • *****
  • Posts: 32364
  • Country: au
    • EEVblog
Re: It's WAR!
« Reply #13 on: February 05, 2010, 02:43:14 am »
Got him!
"This Account Has Been Suspended"
10 minutes after me sending the DMCA takedown notice to the web host!

That fight was just too easy, no fun at all!

Dave.
 

Offline ToddFun

  • Contributor
  • Posts: 24
    • ToddFun.com
Re: It's WAR!
« Reply #14 on: March 25, 2010, 05:07:44 am »
So whats up now?  The site seems ok now. I has content that matches its URL.  Maybe their account was hacked?  At any rate the URL is up but none of Dave's stuff is there.
 

Online EEVblog

  • Administrator
  • *****
  • Posts: 32364
  • Country: au
    • EEVblog
Re: It's WAR!
« Reply #15 on: March 27, 2010, 10:57:41 am »
So whats up now?  The site seems ok now. I has content that matches its URL.  Maybe their account was hacked?  At any rate the URL is up but none of Dave's stuff is there.

They weren't hacked, they were deliberately leeching off my material. They are back with someone else's material I'm sure, although I don't know who.

Dave.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf