How to Find Unethical Webmasters When They Try to Hide
While I’ve been an adult webmaster for a relatively short time, I’ve been amazed at the level of professionalism of adult webmasters. It seems that the majority of webmasters are honest, professional and trying to make an honest buck.While I’ve been an adult webmaster for a relatively short time, I’ve been amazed at the level of professionalism of adult webmasters. It seems that the majority of webmasters are honest, professional and trying to make an honest buck. However, some people are always coming up with new ways to be sly and make a buck in any which way they can. I have seen mainly two reasons why I’ve had to track down the responsible parties for a particular website.
One reason is that they steal my content and post it on their website, and the other is they list my passwords on their site. There is a related issue called hotlinking where people link to images directly on your site and steal your bandwidth in addition to your content, but this article doesn’t address that issue. For hotlinking tips, I found this article to be the best intro.
While registering for a corporation or a P.O. Box, one is required to show proof of identity, but with the historic laissez faire attitude towards the web, it makes it more difficult to find people and hold them responsible when they do something wrong.
Ok, let’s say some site is stealing your content. If you just suspect this but aren’t sure, you may simply try emailing them first (e.g. if you license pics, they could simply have bought them the same as you). I recently found a couple of sites with our exclusives on them (I took the photos myself, so there was no issue about assignment of rights).
One of the first times I’ve had to track someone down was regarding a forum that was hotlinking to my pics (before I learned the hard way about htaccess… we all learn the hard way sometimes!). I couldn’t find an email address — only a form — so I gave feedback via the form and gave them the URL which had my pics on them.
Now perhaps might be a good time to pause and discuss attitudes here. They’re stealing my pics and bandwidth. Some of you may want to give them time, etc., but my take is that they were well aware of such issues potentially arising (they can prevent linking to outside pics, but chose to let users do this). So I have a very short tolerance for this, and you should too. You shouldn’t be afraid to call up the CEO of a 10,000+ person company and complain (you’ll get their assistant by the way, but the company will respond).
Whois
Ok, back to the forum. The first thing to do when trying to find more info about the owners of a site is to do a “whois” search. “Whois” is Internet jargon for looking up the registration information on a website. There are lots of sites that offer a whois service, but I generally go to one of the original sites: Network Solutions. Go there and click on the “whois” on the menu bar. You’ll be asked for the domain name. For example, if you want to look up www.ibm.com, you’ll type in “ibm.com” without the “www”. You’ll get something like this:
—————————————————————
IBM Corporation (IBM-DOM)
Old Orchard Rd
Armonk, NY 10504
US
Domain Name: IBM.COM
Administrative Contact, Technical Contact, Billing Contact:
Trio, Nicholas (NRT1) nrt@WATSON.IBM.COM
IBM T.J. Watson Research Center
PO Box 218
Yorktown Heights, NY 10598
US
(914) 945-1850
Domain servers in listed order:
NS.WATSON.IBM.COM 198.81.209.2
NS.ALMADEN.IBM.COM 198.4.83.35
NS.AUSTIN.IBM.COM 192.35.232.34
NS.ERS.IBM.COM 204.146.173.35
—————————————————————
This shows the street address and phone number of the person who registered (or is responsible for) the site. Sometimes the administrative, billing and technical contact are listed separately. Always look at the technical contact, it may tell you who the hosting company is, but we’ll get more into that later. At the very bottom are the “domain servers”, sometimes called the “name servers”. Without getting technical, look at the domain name there — in this case it says “ibm.com”, which simply means they do their own hosting.
IBM’s record is complete. Except for the fact that IBM is quite well established, you really have no way of knowing if that street address truly exists, and if it does, whether they actually receive mail there, and whether that phone number and email address work or whether they are the true recipients. Now let’s look at another site: fleshcafe.com:
—————————————————————
Domain name: fleshcafe.com
Registrant:
NA
Neon Productions (NA)
NA
P.O. BOX 4188
Waynesville, MO 65583
US
Administrative:
NA
Neon Productions (NA)
NA
P.O. BOX 4188
Waynesville, MO 65583
US
Billing:
NA
Neon Productions (NA)
NA
P.O. BOX 4188
Waynesville, MO 65583
US
Technical:
NA
Hostmaster, Account (dns@MAXIM.NET)
510-226-0695
Maxim Computer Systems
42712 Lawrence Place
Fremont, CA 94538
US
DOMAIN CREATED : 1998-09-29 00:00:00
DOMAIN EXPIRES : 2004-09-28 00:00:00
NAMESERVERS: The previous information has been obtained either directly from the registrant or a registrar of the domain name other than Network Solutions. Network Solutions, therefore, does not guarantee its accuracy or completeness.
—————————————————————
I’m actually very impressed by this. What’s nice about it is that they clearly show they are trying to hide, so there’s no reason to try the street address (I’d never bother doing postal mail anyway), phone number (if it were listed) or email address. If you don’t already know, this clearly illustrates how people can and will try to hide themselves. What’s more impressive is that no name servers are listed (the first time I’ve seen this), but it does list a technical contact, which may very well be accurate since it appears legitimate and it can be (but not necessarily) pulled from a different database.
By the way, as you trace back who’s connecting to who (and the order of responsibility), you can do a whois on “maxim.net”. I’ll discuss this more in a moment.
Let’s look at a third possible scenario:
—————————————————————
Domain name: fleshcafe.com
Administrative Contact, Technical Contact, Billing Contact:
NA
Neon Productions (NA)
NA
P.O. BOX 4188
Waynesville, MO 65583
US
Domain servers in listed order:
NS.FLESHCAFE.COM 198.81.209.2
NS.FLESHCAFE.COM 198.4.83.35
—————————————————————
This one is the trickiest of them all, where there is no legitimate technical contact and the domain servers (ns.fleshcafe.com) show the same site (fleshcafe.com) we’re looking up. This is also my favorite because they fold the quickest.
Trace Route
Perhaps I should back up and talk a little bit about how the Internet works. Essentially it works by everyone connecting to everyone else. If you want to run your own servers, no problem — you simply find someone who agrees to connect to you and thereby gives you access to the entire web (and gives the entire web audience access to your servers). “Traceroute” is Internet jargon that refers to seeing what servers’ information passes through from Point A to Point B. You can go to traceroute.org and find a list of sites that offer traceroute services (similar to whois in this manner). It should be noted that everything in this article can extend to all international sites (for example .tw for Taiwan) but can be slightly more work. The traceroute services can be divided into two groups, one group will do a trace route from their server to your personal PC, the other group will do a trace route from their server to a server you specify. We want the latter. I tend to use Princeton’s and Best’s trace route services.
Using fleshcafe.com as an example again:
—————————————————————
tracing path from www.net.princeton.edu to 128.121.20.87 …
traceroute to 128.121.20.87 (128.121.20.87), 30 hops max, 40 byte packets
1 vgate1 (128.112.128.114) 0.832 ms 0.573 ms 0.416 ms
2 tcggate (128.112.60.11) 0.898 ms 1.028 ms 0.615 ms
3 12.124.192.5 (12.124.192.5) 2.568 ms 2.489 ms 3.444 ms
4 gbr1-p50.phlpa.ip.att.net (12.123.137.6) 2.853 ms 2.998 ms 3.570 ms
5 gbr4-p20.n54ny.ip.att.net (12.122.2.17) 6.601 ms 6.167 ms 6.700 ms
6 ggr1-p370.n54ny.ip.att.net (12.123.1.125) 6.811 ms 6.676 ms 5.902 ms
7 p1-0.att.nycmny06.us.bb.verio.net (192.205.32.174) 6.586 ms 7.004 ms 6.714 ms
8 p4-1-3-0.r00.nycmny06.us.bb.verio.net (129.250.3.129) 6.601 ms 6.983 ms 6.156 ms
9 p4-4-0-0.r01.mclnva02.us.bb.verio.net (129.250.3.182) 37.730 ms 37.801 ms 38.133 ms
10 p16-7-0-0.r00.stngva01.us.bb.verio.net (129.250.3.158) 39.177 ms 38.538 ms 40.497 ms
11 ge-1-1.a01.stngva01.us.da.verio.net (129.250.27.162) 56.446 ms 37.407 ms 50.101 ms
12 128.121.10.162 (128.121.10.162) 41.288 ms 39.617 ms 45.184 ms
13 128.121.20.87 (128.121.20.87) 39.958 ms 41.216 ms 40.700 ms
Done.
—————————————————————
You’ll see the very last site listed is 128.121.20.87. The last site listed is the site you’re inquiring about, in this case this is fleshcafe.com’s IP address. To interpret the above, you can say that for fleshcafe.com to send a web page to Princeton, the webpage would leave their server (128.121.20.87), go to the next server (128.121.10.162), then go to four different Verio servers, etc. until the web page reaches Princeton, having been passed along about 13 servers.
Now let’s do the same thing with Best’s traceroute:
—————————————————————
Source is www.best.com
1 fa-8-1-0.a01.mtvwca01.us.ra.verio.net (206.184.139.129) 29.950 ms 94.115 ms 0.435 ms (0% loss)
2 ge-2-0.a05.mtvwca01.us.ra.verio.net (129.250.122.193) 0.369 ms 0.339 ms 0.443 ms (0% loss)
3 p4-0-0.a03.plalca01.us.ra.verio.net (129.250.122.69) 1.562 ms 1.506 ms 1.588 ms (0% loss)
4 ge-5-2-0.r06.plalca01.us.bb.verio.net (129.250.15.1) 1.775 ms 1.696 ms 1.709 ms (0% loss)
5 p16-3-0-0.r00.plalca01.us.bb.verio.net (129.250.2.162) 1.890 ms 1.747 ms 1.749 ms (0% loss)
6 p4-6-0-0.r02.mclnva02.us.bb.verio.net (129.250.2.246) 81.882 ms 81.726 ms 81.740 ms (0% loss)
7 p16-7-0-0.r02.stngva01.us.bb.verio.net (129.250.5.46) 82.564 ms 82.559 ms 82.546 ms (0% loss)
8 ge-1-2.a01.stngva01.us.da.verio.net (129.250.27.194) 82.665 ms 82.600 ms 82.677 ms (0% loss)
9 128.121.10.162 (128.121.10.162) 83.032 ms 88.409 ms 83.019 ms (0% loss)
10 128.121.20.87 (128.121.20.87) 95.758 ms 110.502 ms 83.652 ms (0% loss)
—————————————————————
Okay, from these two different sources, the common thread is:
8 ge-1-2.a01.stngva01.us.da.verio.net (129.250.27.194) 82.665 ms 82.600 ms 82.677 ms (0% loss)
9 128.121.10.162 (128.121.10.162) 83.032 ms 88.409 ms 83.019 ms (0% loss)
10 128.121.20.87 (128.121.20.87) 95.758 ms 110.502 ms 83.652 ms (0% loss)
This says that fleshcafe.com connects to the web via 128.121.10.162. Notice there is no domain name associated with this. There could be several reasons for this, but most likely they use some small hosting service or it’s their own hosting service. You can do a whois on an IP address in the same way you can do a domain name (be sure to select “IP address” from the default selection of “domain name”). In this case it comes up not found. Next, you can enter 128.121.10.162 on your web browser to see if a site comes up… you will notice that no site comes up. You can then determine that whoever owns and runs the 128.121.10.162 server doesn’t care to let the world know who they are. This leaves Verio to deal with. If you don’t know who Verio is, they are a pretty big hosting company, and to tell you the truth, they really don’t want to hear your complaint. This is nothing specific about Verio — it’s just these big players hate spending resources squashing out these small bugs that pay them only $20 or $30 bucks a month. In this scenario though, Verio is your only bet to resolve this. You’ll find hosting companies responses vary. Some are very quick and seem to have an honest desire to stop these sites from using their services for illegal purposes. Many of the big players seem to have a bureaucratic process.
Hopefully now with these tools in hand, more webmasters will fight these sites conducting illicit activities. If enough of us are squashing out these sites, such theft issues will hopefully diminish (but the problem will always be there, just hopefully a lot smaller). I should also mention that if the site is a pay site, try complaining to their payment processor. I inquired with iBill about this and they said they will stop payment with any site caught stealing content. If the offending site links to sponsors, tell the sponsors that they are using your content (or sharing your password, etc.).
For encouragement, I’ll tell you a couple of my squashing stories. The first one continues with the forum I mentioned earlier. Through whois I contacted their hosting service through their 800 number (yes, I did get pleasure out of them having to pay for the call). The person who answered told me that I don’t know anything about copyright law and that I had to follow DMCA (a section of law dealing with copyright infringement) procedures. Of course he wouldn’t tell me what those procedures were. I asked to speak to a supervisor, telling him how he didn’t know anything (yes, it was getting pretty ugly), he then informed me it was him and his partner running the host. I’ve always suspected they also ran the forum, and one way to make a forum popular and cheap is to hotlink adult content. Well, I contacted their hosting service I found via whois (again, the people who provide them connection to the rest of the Internet). I CC’d them in my email to their hosting service and their response to this was quite rude!! Anyway, the entire forum was permanently taken down two days later, even though it was only after that one posting.
Another story involves a password sharing site. All information about them on whois was bogus, and they listed their own name servers making the whois search worthless. So I did a trace route and contacted their hosting company. At first I didn’t hear anything. I then called one of their VPs (got an assistant as expected). She apologized that no one had contacted me and said she’ll pass on the info to the appropriate people (always make sure you get their name and number, it makes them act more responsibly). A few days later the entire site was permanently taken down. Mission accomplished.
Good luck out there!!!
GreatGirls.com offers lots of exclusive content and high conversions, so join our 50/50 RevShare program and share in the profits!