Tuesday, July 11, 2006

Rightscripts are Leakey

Some UK script kiddie Leakey Yung has a website called Rightscripts where he sells a bunch of bullshit scripts like Extract Website, just what we need, along with some SEO tools with live demos you probably don't want aimed at your site.

Their server is:

rightscripts.com (64.202.163.153)
If they try to run the demo from their server it shows as a different IP:
64.202.165.132
wc02.inet.mesa1.secureserver.net
"" [blank user agent]
This mess runs on GoDaddy servers:
OrgName: Go Daddy Software, Inc.
NetRange: 64.202.160.0 - 64.202.191.255
I've seen them appear to use 2 IPs for a proxy also from GoDaddy twice on my site:
64.202.165.201
"Rightscripts"
Proxy VIA=1.0 wc04.inet.mesa1.secureserver.net:3128 (squid/2.5.STABLE12) FORWARD=64.202.163.153

64.202.165.131
"Rightscripts"
Proxy VIA=1.0 wc01.inet.mesa1.secureserver.net:3128 (squid/2.5.STABLE12) FORWARD=64.202.163.153
Then of course, there appears to be some asshole that actually bought this script that aimed it at my site:
65.254.32.58
[sandiego.hostingforme.com]
"Rightscripts"
Of course "hostingforme" is a bullshit shell page that says nothing, another shocker, owned by some idiot scraper from India.
hostingforme.com (72.9.235.194)

Domain Name: HOSTINGFORME.COM
Registrant:
Ankur Motreja
399, 5th cross,
Gokulam III stage
Mysore, Karnataka 570002
India
Reinforces why I blocked GoDaddy's hosting farm in the first place and lock out all these idiot scripts by default.

3 comments:

Ankur Motreja said...

I happen to be that "some idiot scraper from India" that you talk about.
Kindly get your facts straight before accusing anyone.

I owned the web hosting company GlobeDomain.com which I sold some time back.
hostingforme.com was hosted on the main server IP address.
So, if any of the 100-300 customers on the server use the malicious script, it will show up as originating from the same IP address.

If you are facing any problems, I would suggest you contact the support staff at GlobeDomain and report an abuse.
If that doesn't work, check the whois data for their server IP address and report an abuse there.
By the way, check the email address in the whois records of hostingforme.com - it is on globedomain.com

IncrediBILL said...

Ah, so you just hosted scrapers, well that's MUCH BETTER now isn't it?

I simply dropped your former hosting company into my blocked list so it's not a problem I'm facing any longer.

Ankur Motreja said...

Do you really believe its possible for a webhost to be 100% sure that all their clients are not spammers or using scripts like this one ? Remember, this is not the only script of its kind for sale out there.
How many can a webhost check for on their servers ?

When I was running GlobeDomain, every abuse report was given high priority and the account concerned suspended if it was found to be causing the problem.
Any decent webhost will provide you this level of support, even though you are not a customer, since these people burn server CPU cycles and bandwidth, causing other users on the server problems.
So, webhosts are usually keen to weed them out - unless it is run by a bunch of kids, and there are some of those.
The new owners are a very reputed company named AcuNett and I'm sure they will be just as responsive to abuse reports, if not more responsive.

The bottom line, if you report the problem, it will usually be solved.
If you don't report it, it won't be solved.