Don't be stupid.

[Ezak Clone]

I can't wait to get to tech school so I can understand this stuff

[Gregorio]

Yeah remind me not to mess with these smart guys.

[Zigma]

C:\Documents and Settings\aurikan>nslookup logserver77.no-ip.org
*** Can't find server name for address 192.168.0.1: Non-existent domain
*** Default servers are not available
Server: UnKnown
Address: 192.168.0.1

Non-authoritative answer:
Name: logserver77.no-ip.org
Address: 64.222.233.156


C:\Documents and Settings\aurikan>tracert 64.222.233.156

Tracing route to pool-64-222-233-156.port.east.verizon.net [64.222.233.156]
over a maximum of 30 hops:

[snip]
9 26 ms 13 ms 20 ms tbr1011401.sffca.ip.att.net [12.123.12.122]
10 15 ms 14 ms 22 ms ggr2-p300.sffca.ip.att.net [12.123.13.190]
11 12 ms 34 ms 18 ms att-gw.ashburn.eli.net [192.205.32.74]
12 20 ms 19 ms 20 ms 0.so-2-0-0.XL2.SCL2.ALTER.NET [152.63.57.102]
13 87 ms 89 ms 85 ms 0.so-5-0-0.XL2.BOS4.ALTER.NET [152.63.16.126]
14 84 ms 87 ms 84 ms POS7-0.GW5.BOS4.ALTER.NET [152.63.25.57]
15 89 ms 87 ms 118 ms gnilink-gw.customer.alter.net [208.192.180.234]

16 88 ms 90 ms 84 ms so-0-3-0-0.BB-RTR1.BOS.verizon-gni.net [130.81.1
7.168]
17 119 ms 96 ms 103 ms 130.81.20.89
18 103 ms 105 ms 119 ms A3-0-0-1710.DSL-RTR1.PORT.verizon-gni.net [130.8
1.10.242]
19 116 ms 125 ms * pool-64-222-233-156.port.east.verizon.net [64.22
2.233.156]
20 134 ms 132 ms 121 ms pool-64-222-233-156.port.east.verizon.net [64.22
2.233.156]

Trace complete.

That's the FTP server.

bingo but it's upload onry :L

scanning that IP, it says it's coming from reston, VA.

The FF Account folder is HUGE, took me a while to get into it (and i'm on a 30mbps)

More info on the IP you gave:

OrgName: Verizon Internet Services Inc.
OrgID: VRIS
Address: 1880 Campus Commons Dr
City: Reston
StateProv: VA
PostalCode: 20191
Country: US
NetRange: 64.222.0.0 - 64.223.255.255
CIDR: 64.222.0.0/15
NetName: VZGNI-PUB-5
NetHandle: NET-64-222-0-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.BELLATLANTIC.NET
NameServer: NS2.BELLATLANTIC.NET
NameServer: NS2.VERIZON.NET
NameServer: NS4.VERIZON.NET
Comment:
RegDate:
Updated: 2005-04-21
OrgAbuseHandle: VISAB-ARIN
OrgAbuseName: VIS Abuse
OrgAbusePhone: +1-214-513-6711
OrgAbuseEmail: mailto:[email protected]
OrgTechHandle: ZV20-ARIN
OrgTechName: Verizon Internet Services
OrgTechPhone: +1-703-295-4583
OrgTechEmail: mailto:[email protected]
# ARIN WHOIS database, last updated 2006-06-20 19:10

keep in mind though it's a range from 64.222.0.0 - 64.223.255.255


We gotta get this guy

[Genosync]

Reston's not horribly far from me if someone's gotta go somewhere in person.

[Sekkite]

well i removed the EXE file and the keys from the regedit... now all i have to do is get my POL account back.. which i cant do til service center is back up at 12 PM EST... where i can report it hacked and get it rolled back to what it was yesterday... hopefully i can get it done.. anyone know where i can find a password generater.. one that would work really good for POL?

I find it easy to remember a password by just using the first letter of every word in a phrase with changing a few things, like @ for at, and capitalizing a few letters.


And props to Dezzimal and everyone else on this thread. Really good to know that the asshole is gonna get whats coming to him.

[Tyr]

I myself am about 20mins from Reston, if there's anything I can do to help this case, PM me please.


EDIT: didn't want to take another post, just wanted to praise anyone / everyone, especially Dezzimal, Zigma, and Taj for working on this.

[Paulisdead]

meh some people do it the "Legal" way other people find out where he lives and beat the fucking shit outta him.... i would prefer kicking his ass.... whats jail gonna do to him nothing..


A ass beating, might change his life

Jail will destroy his future and teach him a valuable lesson. Today he is messing with FFXI accounts and keyloggers but in 3 years time it might be something more important.

An ass beating will last for ten minutes and hurt for a few days. It could also get the ass beater into a lot of trouble that's just not worth it, Dont throw away your futures with GBH or ABH for that.

Time in prison will teach this little prick that there are consequences to using key loggers and accessing peoples accounts and taking away what some people have worked so hard for. Everyday his geek ass is going to be eyed up by Mr big and he is going to have to pray its only the eyes in Mr Big's head that look at his ass and not the third eye

[Senoska]

some1 call the poh-lice

[Koudelka]

Damn i live about 10mins from reston >.>

[Saphirea]

In reston theres 2 giant co-locations, I know about them due to the fact that my past two companies both ran our servers through them for our web and exchange traffic.

The IP address seem to be in the same block of this I'm guessing Convergence is the place, located off of route 50 and 28 North from Manassas.

Getting into them is quite hard because they have a pretty decent layered physical security.

Any chance of say using JtR to change the CHMOD on the FTP box? Giving a 777 access level?

[MisterBob]

Verizon eh? I might be able to do something then ;)

No garuntees though

[Dank]

Hey, everyone that was working on this....Dezzimal, Zigma and Taj, good work. Somebody should make a 24 poster with their FFXI character models on it.

[othellojr]

Though I have no fucking clue about computers, and all of whats going on here, I think is pretty cool that you guys are able to track this person down and maybe (hopefully) you will get him/her; as has been stated already, it sucks to get hacked and finally to catch someone doing it seems pretty cool, just wish I knew wtf you guys are talking about too

[inkredible]

Hmm.. I might try to pull out my old Netscantools and port scanners when I get home from work. I wonder if this guy would happen to have any other open ports other than FTP?? Also may want to keep in mind that if his IP is owned by Verizon.. Gotta play it safe when any one access it. Sure what hes doing is immoral but by loading his software on your pc its "giving" him the access. He didnt do anything illegal to gain accounts.

[Epidemic]

Hmm.. I might try to pull out my old Netscantools and port scanners when I get home from work. I wonder if this guy would happen to have any other open ports other than FTP??

Your sig hurts my eyes.

[MisterBob]

Hmm.. I might try to pull out my old Netscantools and port scanners when I get home from work. I wonder if this guy would happen to have any other open ports other than FTP?? Also may want to keep in mind that if his IP is owned by Verizon.. Gotta play it safe when any one access it. Sure what hes doing is immoral but by loading his software on your pc its "giving" him the access. He didnt do anything illegal to gain accounts.

Sorry, but phishing (which is what he used to get people to download his keylogged) and obtaining personal information without consent are both felony-class crimes.

[Taj]

Hmm.. I might try to pull out my old Netscantools and port scanners when I get home from work. I wonder if this guy would happen to have any other open ports other than FTP?? Also may want to keep in mind that if his IP is owned by Verizon.. Gotta play it safe when any one access it. Sure what hes doing is immoral but by loading his software on your pc its "giving" him the access. He didnt do anything illegal to gain accounts.

Incorrect. Keylogging is 100% illegal. And when you think about it, he's really treading on thin ice. If any of the people he's keylogging have made a purchase from an eCommerce website or logged into PayPal, he has all of their Financial information sitting on his harddrive. That's Financial Information that doesn't belong to him, and wasn't explicitly provided by it's rightful owner. Nobody allowed him to install his software on their PC, it was attached to another Program and disguised as something else.

[Dezzimal]

Guys I need to re-iterate that you're not getting his actual location by tracing his IP like that. If you were to trace my IP it'd show that I'm in LaCrosse, Wisconsin which is actually pretty far from where I really am. What you're getting is just the address the ISP used to register that IP block, its usually a good indicator of general location, but the culprit could be 50-100 miles in any direction.

[Dank]

lol, nice and fitting avatar change^^

[divisortheory]

Yea, but the ISP should know who had that particular address at that particular time.