Forum Home
Press F1
 
Thread ID: 74047 2006-11-09 07:54:00 How to dob in a hacker/virus spreader? the_bogan (9949) Press F1
Post ID Timestamp Content User
497781 2006-11-09 07:54:00 I'm a moderator on a forum, where this person has been showing his websites as places where when you click on them, you immediately get done by various viruses/key loggers.

I had to re-install my operating system, and in the duration, forgot my password. I'm unable to re-set it. But that's beside the point. Is there anyone I can dob this person into that they get done?
the_bogan (9949)
497782 2006-11-09 08:15:00 Kick his rear end off the forum. If you cannot do this, then get the Administrator to block him and his IP.

You can also see who is hosting his website and who the domain name is registered to and lodge a complaint with them. You can use whois (http://www.whois.net/) for this.
Jen (38)
497783 2006-11-09 08:30:00 Contact his web host and complain about illegal activities. They'll drop him like a hot potato. TGoddard (7263)
497784 2006-11-09 08:33:00 Kick his rear end off the forum. If you cannot do this, then get the Administrator to block him and his IP.

You can also see who is hosting his website and who the domain name is registered to and lodge a complaint with them. You can use whois (http://www.whois.net/) for this.

Thanks for the advice. Unfortunately, This is the same guy registering multiple times. Also, when looking at the originators, the only common link seems to be @homelancers.com, which seems to be a blog place under construction. The others were just blatent porn sites which they were asked not to talk about.
the_bogan (9949)
497785 2006-11-09 09:21:00 If you have his IP address, then you may find which ISP he uses, and then contact the ISP see if you can find out who that IP address was released to at that time. However, he may have used proxy servers, which make your tracing much harder. developer (4447)
497786 2006-11-09 12:11:00 I find these days with so many different registrar's...
betterwhois.com (http://www.betterwhois.com)
does in fact get better results LOL

Anyhoo - just wanted to say, you may have partly answered your own question with the reference to homelancers... I'd guess this is where he was working from and may have even had the exploit scripts there as well, with the site links he posted redirecting there. Thats just speculation on my part, but this domain has been completely locked - so there has been problems.
I doubt any of the contact details of Mr "Bobrov" are real either.

HOMELANCERS.COM

Registrar: REGISTERFLY.COM, INC
Status: LOCKED
Status: clientTransferProhibited
Status: clientUpdateProhibited
Status: clientDeleteProhibited
bevy121 (117)
497787 2006-11-09 19:52:00 Alternatively, block posts from new members for 24 hours temporarily KiwiTT_NZ (233)
497788 2006-11-09 19:55:00 If the DNS details are incorrect then the domain can be pulled. You have an obligation to keep your DNS details up to date and accurate. TGoddard (7263)
497789 2006-11-09 22:18:00 ... forgot my password. I'm unable to re-set it. But that's beside the point...

I helped a friend to reset their XP password (even the administrator password) using a bootable CD (I think it was linux based) which shows you all the users on a XP installation and allows you to change/reset the password for any of them. Unfortunately that was a long time ago and I can't remember the name of it. Someone else may know.
pico (4752)
497790 2006-11-10 09:40:00 If the DNS details are incorrect then the domain can be pulled. You have an obligation to keep your DNS details up to date and accurate.

yes, thats probably why it is locked .... un-transferable, un-updateable and unusable
bevy121 (117)
1