{"id":163,"date":"2011-09-02T00:02:38","date_gmt":"2011-09-01T22:02:38","guid":{"rendered":"http:\/\/blog.pi3.com.pl\/?p=163"},"modified":"2011-09-02T00:25:24","modified_gmt":"2011-09-01T22:25:24","slug":"facebook-used-for-attack","status":"publish","type":"post","link":"https:\/\/blog.pi3.com.pl\/?p=163","title":{"rendered":"Facebook used for attack?"},"content":{"rendered":"

Today I’ve received strange mail:<\/p>\n

— CUT —<\/em>
\nDate: Thu, 01 Sep 2011 09:11:00 +0200<\/em>
\nFrom: gayroobaoll <gayroobaoll@o2.pl><\/em>
\nTo: pi3@itsec.pl<\/em>
\nSubject:<\/em><\/p>\n

Chcesz, http:\/\/facebook.com\/100002779484440<\/em><\/p>\n

— CUT —<\/em><\/p>\n

As we can see, there is no subject, mail include link to someone’s facebook profile and has got only one Polish world (yes, this is attack for the Polish ppl). “Chcesz” means “Do you want”. Strange, dosn’t it? Mail was send from the Polish portal (o2.pl) – free mails.<\/p>\n

OK \ud83d\ude09 Let’s check this profile…<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

\"\"<\/a>\u00a0 \"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Hm… interesting \ud83d\ude09 In the section “About” we can find Polish sentence: “Cze\u015b\u0107. Chcesz si\u0119 pozna\u0107. Co prawda tu rzadko bywam, wi\u0119cej pisz\u0119 na – www.relithibi.com\/-lenaa pisz do mnie.” which can be translated to: “Hi. I want to meet you. To be honest, I’m here very rarely, I’m more active here – www.relithibi.com\/-lenaa contact with me.” But in the section personal web page we can find different link:<\/p>\n

http:\/\/agagwhili.com\/-lenaa<\/p>\n

But this two different URLs go to the same site http:\/\/randkipl.com\/user.php?page=id&id=16112<\/p>\n

\"\"<\/a>\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

OK. What is important here? Anything what we can press on this site forward us to the registration form \ud83d\ude09 On the left site of this page we can see smth like chat box, but it isn’t. This is static talk (maybe sniffed somewhere else) which is always the same. Whenever we visit this page we can see exactly the same talk and sentence sent from the same nicknames. This talk suggest of course sex propositions \ud83d\ude09 But what is important this site detect from which IP address we visit this page and tries to get the possible city from where our IP are and resolve the name of the city and put to the chat box \ud83d\ude09 This is nice social engineering trick \ud83d\ude09 The same situation is in the middle of the site, where is information about profile which we visit. Of course the city name is the same which page detect and the same situation is with the country \ud83d\ude09 Of course in this profile is written that this woman are looking for a men who want to have sex with her \ud83d\ude09
\nOf course site tries to remember visitors (cookies) and not change so often the city name when we use different IPs.<\/p>\n

OK. So I thing this is good moment to check in more details the email which I received. Here is full headers:<\/p>\n

— CUT —<\/em>
\nReturn-Path: <gayroobaoll@o2.pl><\/em>
\nX-Original-To: pi3@itsec.pl<\/em>
\nDelivered-To: pi3@itsec.pl<\/em>
\nReceived: by itsec.pl (Postfix, from userid 1004)<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 id 97D164CE13; Thu,\u00a0 1 Sep 2011 09:00:43 +0200 (CEST)<\/em>
\nX-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on itsec.pl<\/em>
\nX-Spam-Level:<\/em>
\nX-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RCVD_IN_DNSWL_NONE,SPF_PASS,TVD_SPACE_RATIO,T_TO_NO_BRKTS_FREEMAIL<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 autolearn=ham version=3.3.2<\/em>
\nReceived: from mailout1.go2.pl (mailout1.go2.pl [193.17.41.11])<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 by itsec.pl (Postfix) with ESMTP id 84CF931F96<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 for <pi3@itsec.pl>; Thu,\u00a0 1 Sep 2011 09:00:24 +0200 (CEST)<\/em>
\nReceived: from mailout1.go2.pl (unknown [10.0.0.103])<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 by mailout1.go2.pl (Postfix) with ESMTP id BEDA05D5158<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 for <pi3@itsec.pl>; Thu,\u00a0 1 Sep 2011 09:11:01 +0200 (CEST)<\/em>
\nReceived: from o2.pl (unknown [10.0.0.40])<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 by mailout1.go2.pl (Postfix) with SMTP<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 for <pi3@itsec.pl>; Thu,\u00a0 1 Sep 2011 09:11:01 +0200 (CEST)<\/em>
\nSubject:<\/em>
\nFrom: gayroobaoll <gayroobaoll@o2.pl><\/em>
\nTo: pi3@itsec.pl<\/em>
\nMime-Version: 1.0<\/em>
\nMessage-ID: <1a68707d.72ac5cea.4e5f3004.83a38@o2.pl><\/em>
\nDate: Thu, 01 Sep 2011 09:11:00 +0200<\/em>
\nX-Originator: 115.132.51.92<\/em>
\nContent-Type: text\/plain; charset=”UTF-8″<\/em>
\nContent-Transfer-Encoding: quoted-printable<\/em>
\n— CUT —<\/em><\/p>\n

The real IP address of someone\/something who sent this mail is: 115.132.51.92
\nThis IP address alive and reply for ICMP-echo message:<\/p>\n

— CUT —<\/em>
\n# ping 115.132.51.92<\/em>
\nPING 115.132.51.92 (115.132.51.92) 56(84) bytes of data.<\/em>
\n64 bytes from 115.132.51.92: icmp_req=1 ttl=50 time=365 ms<\/em>
\n64 bytes from 115.132.51.92: icmp_req=2 ttl=50 time=363 ms<\/em>
\n64 bytes from 115.132.51.92: icmp_req=3 ttl=50 time=362 ms<\/em>
\n^C<\/em>
\n— 115.132.51.92 ping statistics —<\/em>
\n3 packets transmitted, 3 received, 0% packet loss, time 2002ms<\/em>
\nrtt min\/avg\/max\/mdev = 362.722\/363.863\/365.174\/1.225 ms<\/em>
\n— CUT —<\/em><\/p>\n

whois database:<\/p>\n

— CUT —<\/em>
\n# whois 115.132.51.92<\/em>
\n% [whois.apnic.net node-2]<\/em>
\n% Whois data copyright terms\u00a0\u00a0\u00a0 http:\/\/www.apnic.net\/db\/dbcopyright.html<\/em><\/p>\n

inetnum:\u00a0\u00a0\u00a0\u00a0\u00a0 115.132.0.0 – 115.135.255.255<\/em>
\nnetname:\u00a0\u00a0\u00a0\u00a0\u00a0 ADSLSTREAMYX<\/em>
\ndescr:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 CORE IP NETWORK DEVELOPMENT,<\/em>
\ndescr:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 TELEKOM MALAYSIA BERHAD<\/em>
\ncountry:\u00a0\u00a0\u00a0\u00a0\u00a0 MY<\/em>
\nadmin-c:\u00a0\u00a0\u00a0\u00a0\u00a0 SM135-AP<\/em>
\ntech-c:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 EAK2-AP<\/em>
\nstatus:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOCATED PORTABLE<\/em>
\nremarks:\u00a0\u00a0\u00a0\u00a0\u00a0 -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/em>
\nremarks:\u00a0\u00a0\u00a0\u00a0\u00a0 This object can only be updated by APNIC hostmasters.<\/em>
\nremarks:\u00a0\u00a0\u00a0\u00a0\u00a0 To update this object, please contact APNIC<\/em>
\nremarks:\u00a0\u00a0\u00a0\u00a0\u00a0 hostmasters and include your organisation’s account<\/em>
\nremarks:\u00a0\u00a0\u00a0\u00a0\u00a0 name in the subject line.<\/em>
\nremarks:\u00a0\u00a0\u00a0\u00a0\u00a0 -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/em>
\nchanged:\u00a0\u00a0\u00a0\u00a0\u00a0 hm-changed@apnic.net 20080805<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 APNIC-HM<\/em>
\nmnt-lower:\u00a0\u00a0\u00a0 MAINT-AP-STREAMYX<\/em>
\nchanged:\u00a0\u00a0\u00a0\u00a0\u00a0 hm-changed@apnic.net 20080919<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 APNIC<\/em><\/p>\n

person:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Siti Fuwaizah Mohd. Ghazali<\/em>
\nnic-hdl:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SM135-AP<\/em>
\ne-mail:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tm_osc@tmnet.com.my<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Telekom Malaysia Berhad<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Jalan Pantai Baru,\u00a0 Kuala Lumpur.<\/em>
\nphone:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +603-83185434<\/em>
\nfax-no:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +603-22402126<\/em>
\ncountry:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MY<\/em>
\nchanged:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 fuwaizah@tm.com.my 20090402<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 TM-NET-AP<\/em>
\nabuse-mailbox:\u00a0 abuse@tm.net.my<\/em>
\nnotify:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tmcops@tmnet.com.my<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 APNIC<\/em><\/p>\n

person:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 EMRAN AHMED KAMAL<\/em>
\nnic-hdl:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 EAK2-AP<\/em>
\ne-mail:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ssc@tmnet.com.my<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Telekom Malaysia<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Jalan Pantai Baru, Kuala Lumpur.<\/em>
\nphone:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +6-03-83185434<\/em>
\nfax-no:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +6-03-22402126<\/em>
\ncountry:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MY<\/em>
\nchanged:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 fuwaizah@tm.net.my 20080918<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 TM-NET-AP<\/em>
\nabuse-mailbox:\u00a0 abuse@tm.net.my<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 APNIC<\/em>
\n— CUT —<\/em><\/p>\n

So… of course IP address is “somewhere” \ud83d\ude09 In this case Malaysia Telekom is owner. Greetings for Polish ppl in Malaysia ;p xprobe2 says this is Apple machine:<\/p>\n

— CUT —<\/em>
\n# xprobe2 -v -r 115.132.51.92<\/em><\/p>\n

Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu<\/em><\/p>\n

[+] Target is 115.132.51.92<\/em>
\n[+] Loading modules.<\/em>
\n[+] Following modules are loaded:<\/em>
\n[x] [1] ping:icmp_ping\u00a0 –\u00a0 ICMP echo discovery module<\/em>
\n[x] [2] ping:tcp_ping\u00a0 –\u00a0 TCP-based ping discovery module<\/em>
\n[x] [3] ping:udp_ping\u00a0 –\u00a0 UDP-based ping discovery module<\/em>
\n[x] [4] infogather:ttl_calc\u00a0 –\u00a0 TCP and UDP based TTL distance calculation<\/em>
\n[x] [5] infogather:portscan\u00a0 –\u00a0 TCP and UDP PortScanner<\/em>
\n[x] [6] fingerprint:icmp_echo\u00a0 –\u00a0 ICMP Echo request fingerprinting module<\/em>
\n[x] [7] fingerprint:icmp_tstamp\u00a0 –\u00a0 ICMP Timestamp request fingerprinting module<\/em>
\n[x] [8] fingerprint:icmp_amask\u00a0 –\u00a0 ICMP Address mask request fingerprinting module<\/em>
\n[x] [9] fingerprint:icmp_port_unreach\u00a0 –\u00a0 ICMP port unreachable fingerprinting module<\/em>
\n[x] [10] fingerprint:tcp_hshake\u00a0 –\u00a0 TCP Handshake fingerprinting module<\/em>
\n[x] [11] fingerprint:tcp_rst\u00a0 –\u00a0 TCP RST fingerprinting module<\/em>
\n[x] [12] fingerprint:smb\u00a0 –\u00a0 SMB fingerprinting module<\/em>
\n[x] [13] fingerprint:snmp\u00a0 –\u00a0 SNMPv2c fingerprinting module<\/em>
\n[+] 13 modules registered<\/em>
\n[+] Initializing scan engine<\/em>
\n[+] Running scan engine<\/em>
\n[-] ping:tcp_ping module: no closed\/open TCP ports known on 115.132.51.92. Module test failed<\/em>
\n[-] ping:udp_ping module: no closed\/open UDP ports known on 115.132.51.92. Module test failed<\/em>
\n[-] No distance calculation. 115.132.51.92 appears to be dead or no ports known<\/em>
\n[+] Host: 115.132.51.92 is up (Guess probability: 50%)<\/em>
\n[+] Target: 115.132.51.92 is alive. Round-Trip Time: 0.36246 sec<\/em>
\n[+] Selected safe Round-Trip Time value is: 0.72492 sec<\/em>
\n[-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)<\/em>
\n[-] fingerprint:smb need either TCP port 139 or 445 to run<\/em>
\n[-] fingerprint:snmp: need UDP port 161 open<\/em>
\n[+] Primary guess:<\/em>
\n[+] Host 115.132.51.92 Running OS: “Apple Mac OS X 10.3.7” (Guess probability: 100%)<\/em>
\n[+] Other guesses:<\/em>
\n[+] Host 115.132.51.92 Running OS: “Apple Mac OS X 10.3.8” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “Apple Mac OS X 10.3.9” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “Apple Mac OS X 10.4.0” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “Apple Mac OS X 10.4.1” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “HP JetDirect ROM F.08.08 EEPROM F.08.20” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “HP JetDirect ROM F.08.08 EEPROM F.08.05” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “HP JetDirect ROM F.08.01 EEPROM F.08.05” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “HP JetDirect ROM A.05.03 EEPROM A.05.05” (Guess probability: 100%)<\/em>
\n[+] Host 115.132.51.92 Running OS: “HP JetDirect ROM A.03.17 EEPROM A.04.09” (Guess probability: 100%)<\/em>
\n[+] Cleaning up scan engine<\/em>
\n[+] Modules deinitialized<\/em>
\n[+] Execution completed.<\/em>
\n— CUT —<\/em><\/p>\n

OK. So let’s check who register randkipl.com domain:<\/p>\n

— CUT —<\/em>
\n\u00a0\u00a0 Domain Name: RANDKIPL.COM<\/em>
\n\u00a0\u00a0 Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D\/B\/A PUBLICDOMAINREGISTRY.COM<\/em>
\n\u00a0\u00a0 Whois Server: whois.PublicDomainRegistry.com<\/em>
\n\u00a0\u00a0 Referral URL: http:\/\/www.PublicDomainRegistry.com<\/em>
\n\u00a0\u00a0 Name Server: NS1.REG.RU<\/em>
\n\u00a0\u00a0 Name Server: NS2.REG.RU<\/em>
\n\u00a0\u00a0 Status: clientTransferProhibited<\/em>
\n\u00a0\u00a0 Updated Date: 06-jun-2011<\/em>
\n\u00a0\u00a0 Creation Date: 26-nov-2010<\/em>
\n\u00a0\u00a0 Expiration Date: 26-nov-2011<\/em><\/p>\n

>>> Last update of whois database: Thu, 01 Sep 2011 19:53:13 UTC <<<<\/em><\/p>\n

…<\/em>
\n…<\/em><\/p>\n

The Registry database contains ONLY .COM, .NET, .EDU domains and<\/em>
\nRegistrars.<\/em>
\nRegistration Service Provided By: DOMAIN NAMES REGISTRAR REG.RU LTD.<\/em>
\nContact: +7.4955801111<\/em><\/p>\n

Domain Name: RANDKIPL.COM <\/em><\/p>\n

Registrant:<\/em>
\n\u00a0\u00a0\u00a0 PrivacyProtect.org<\/em>
\n\u00a0\u00a0\u00a0 Domain Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@privacyprotect.org)<\/em>
\n\u00a0\u00a0\u00a0 ID#10760, PO Box 16<\/em>
\n\u00a0\u00a0\u00a0 Note – All Postal Mails Rejected, visit Privacyprotect.org<\/em>
\n\u00a0\u00a0\u00a0 Nobby Beach<\/em>
\n\u00a0\u00a0\u00a0 null,QLD 4218<\/em>
\n\u00a0\u00a0\u00a0 AU<\/em>
\n\u00a0\u00a0\u00a0 Tel. +45.36946676<\/em><\/p>\n

Creation Date: 26-Nov-2010 \u00a0<\/em>
\nExpiration Date: 26-Nov-2011<\/em><\/p>\n

Domain servers in listed order:<\/em>
\n\u00a0\u00a0\u00a0 ns1.reg.ru<\/em>
\n\u00a0\u00a0\u00a0 ns2.reg.ru<\/em><\/p>\n

Administrative Contact:<\/em>
\n\u00a0\u00a0\u00a0 PrivacyProtect.org<\/em>
\n\u00a0\u00a0\u00a0 Domain Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@privacyprotect.org)<\/em>
\n\u00a0\u00a0\u00a0 ID#10760, PO Box 16<\/em>
\n\u00a0\u00a0\u00a0 Note – All Postal Mails Rejected, visit Privacyprotect.org<\/em>
\n\u00a0\u00a0\u00a0 Nobby Beach<\/em>
\n\u00a0\u00a0\u00a0 null,QLD 4218<\/em>
\n\u00a0\u00a0\u00a0 AU<\/em>
\n\u00a0\u00a0\u00a0 Tel. +45.36946676<\/em><\/p>\n

Technical Contact:<\/em>
\n\u00a0\u00a0\u00a0 PrivacyProtect.org<\/em>
\n\u00a0\u00a0\u00a0 Domain Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@privacyprotect.org)<\/em><\/p>\n

\u00a0\u00a0\u00a0 ID#10760, PO Box 16<\/em>
\n\u00a0\u00a0\u00a0 Note – All Postal Mails Rejected, visit Privacyprotect.org<\/em>
\n\u00a0\u00a0\u00a0 Nobby Beach<\/em>
\n\u00a0\u00a0\u00a0 null,QLD 4218<\/em>
\n\u00a0\u00a0\u00a0 AU<\/em>
\n\u00a0\u00a0\u00a0 Tel. +45.36946676<\/em><\/p>\n

Billing Contact:<\/em>
\n\u00a0\u00a0\u00a0 PrivacyProtect.org<\/em>
\n\u00a0\u00a0\u00a0 Domain Admin\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (contact@privacyprotect.org)<\/em>
\n\u00a0\u00a0\u00a0 ID#10760, PO Box 16<\/em>
\n\u00a0\u00a0\u00a0 Note – All Postal Mails Rejected, visit Privacyprotect.org<\/em>
\n\u00a0\u00a0\u00a0 Nobby Beach<\/em>
\n\u00a0\u00a0\u00a0 null,QLD 4218<\/em>
\n\u00a0\u00a0\u00a0 AU<\/em>
\n\u00a0\u00a0\u00a0 Tel. +45.36946676<\/em><\/p>\n

Status:LOCKED<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Note: This Domain Name is currently Locked. In this status the domain <\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name cannot be transferred, hijacked, or modified. The Owner of this <\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 domain name can easily change this status from their control panel. <\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 This feature is provided as a security measure against fraudulent domain name hijacking.<\/em>
\n— CUT —<\/em><\/p>\n

Hm… All contact suggest the owner is somewhere in Australia (AU) but telephone number has prefix
\nto Denmark (+45). Of course name servers are in Russia \ud83d\ude09 Interesting is also STATUS of the domain:<\/p>\n

— CUT —<\/em>
\nStatus:LOCKED<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Note: This Domain Name is currently Locked. In this status the domain<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name cannot be transferred, hijacked, or modified. The Owner of this<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 domain name can easily change this status from their control panel.<\/em>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 This feature is provided as a security measure against fraudulent domain name hijacking.<\/em>
\n— CUT —<\/em><\/p>\n

More information:<\/p>\n

— CUT —<\/em>
\n# host randkipl.com<\/em>
\nrandkipl.com has address 91.202.63.130<\/em>
\n# host -t any randkipl.com<\/em>
\nrandkipl.com name server ns2.reg.ru.<\/em>
\nrandkipl.com name server ns1.reg.ru.<\/em>
\nrandkipl.com has address 91.202.63.130<\/em>
\n# host 91.202.63.130<\/em>
\nHost 130.63.202.91.in-addr.arpa. not found: 3(NXDOMAIN)<\/em>
\n% This is the RIPE Database query service.<\/em>
\n% The objects are in RPSL format.<\/em>
\n%<\/em>
\n% The RIPE Database is subject to Terms and Conditions.<\/em>
\n% See http:\/\/www.ripe.net\/db\/support\/db-terms-conditions.pdf<\/em><\/p>\n

% Note: this output has been filtered.<\/em>
\n%\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 To receive output for a database update, use the “-B” flag.<\/em><\/p>\n

% Information related to ‘91.202.60.0 – 91.202.63.255’<\/em><\/p>\n

inetnum:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 91.202.60.0 – 91.202.63.255<\/em>
\nnetname:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 AKRINO-NET<\/em>
\ndescr:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Akrino Inc<\/em>
\ncountry:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 VG<\/em>
\norg:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ORG-AI38-RIPE<\/em>
\nadmin-c:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IVM27-RIPE<\/em>
\ntech-c:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IVM27-RIPE<\/em>
\nstatus:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ASSIGNED PI<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE-NCC-END-MNT<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nmnt-lower:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE-NCC-END-MNT<\/em>
\nmnt-routes:\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nmnt-domains:\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE # Filtered<\/em><\/p>\n

organisation:\u00a0\u00a0 ORG-AI38-RIPE<\/em>
\norg-name:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Akrino Inc<\/em>
\norg-type:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OTHER<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Akrino Inc.<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 P.O.Box 146 Trident Chambers<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Road Town, Tortola<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BVI<\/em>
\ne-mail:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 noc.akrino@gmail.com<\/em>
\nmnt-ref:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE # Filtered<\/em><\/p>\n

person:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Igoren V Murzak<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Akrino Inc<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 P.O.Box 146 Trident Chambers<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Road Town, Tortola<\/em>
\naddress:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BVI<\/em>
\nphone:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +1 914 5952753<\/em>
\ne-mail:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 noc.akrino@gmail.com<\/em>
\nnic-hdl:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IVM27-RIPE<\/em><\/p>\n

mnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE # Filtered<\/em><\/p>\n

% Information related to ‘91.202.60.0\/22AS44571’<\/em><\/p>\n

route:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 91.202.60.0\/22<\/em>
\ndescr:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 AKRINO BLOCK<\/em>
\norigin:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 AS44571<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE # Filtered<\/em><\/p>\n

% Information related to ‘91.202.63.0\/24AS44571’<\/em><\/p>\n

route:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 91.202.63.0\/24<\/em>
\ndescr:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 AKRINO BLOCK #4<\/em>
\norigin:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 AS44571<\/em>
\nmnt-by:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MNT-AKRINO<\/em>
\nsource:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RIPE # Filtered<\/em>
\n— CUT —<\/em><\/p>\n

So Internet Service Provider is Akrino Inc. from Virgin Islands, British. If we google for this IP address we can discover that it was used many times for some attacks. Many domains was registered for this IP address, for example sex-v-odnoklassnikah.com, seks-v-mambe.com, sexnk.org, etc.<\/p>\n

Here is nmap scan:<\/p>\n

— CUT —<\/em>
\nNmap scan report for 91.202.63.130<\/em>
\nHost is up (0.045s latency).<\/em>
\nScanned at 2011-09-02 00:43:47 CEST for 10s<\/em>
\nNot shown: 999 filtered ports<\/em>
\nPORT\u00a0\u00a0 STATE SERVICE<\/em>
\n80\/tcp open\u00a0 http<\/em>
\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port<\/em>
\nOS fingerprint not ideal because: Missing a closed TCP port so results incomplete<\/em>
\nAggressive OS guesses: OpenWrt White Russian 0.9 (Linux 2.4.30) (93%), OpenWrt 0.9 – 7.09 (Linux 2.4.30 – 2.4.34) (93%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (93%), Crestron XPanel control system (87%), Netgear DG834G WAP (87%), OpenBSD 4.3 (87%), Apple Mac OS X 10.6.2 – 10.6.4 (Snow Leopard) (Darwin 10.2.0 – 10.4.0) (86%), Cisco IronPort C650 email security appliance (AsyncOS 7.0.1) (86%), FreeBSD 6.1-RELEASE (86%), OpenWrt (Linux 2.4.30 – 2.4.34) (86%)<\/em>
\nNo exact OS matches for host (test conditions non-ideal).<\/em>
\nTCP\/IP fingerprint:<\/em>
\nSCAN(V=5.51%D=9\/2%OT=80%CT=%CU=%PV=N%G=N%TM=4E600AAD%P=i686-pc-linux-gnu)<\/em>
\nSEQ(SP=105%GCD=4%ISR=107%TS=U)<\/em>
\nSEQ(SP=102%GCD=2%ISR=109%TI=RI%TS=U)<\/em>
\nOPS(O1=M5B4SLL%O2=M578SLL%O3=M280%O4=M5B4SLL%O5=M218SLL%O6=M109SLL)<\/em>
\nWIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)<\/em>
\nECN(R=Y%DF=Y%TG=40%W=2000%O=M5B4SLL%CC=N%Q=)<\/em>
\nT1(R=Y%DF=Y%TG=40%S=O%A=S+%F=AS%RD=0%Q=)<\/em>
\nT2(R=N)<\/em>
\nT3(R=N)<\/em>
\nT4(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)<\/em>
\nU1(R=N)<\/em>
\nIE(R=N)<\/em>
\n— CUT —<\/em><\/p>\n

OK. It’s time to look a bit for the site. Here is headers from the connection:<\/p>\n

— CUT —<\/em>
\nhttp:\/\/randkipl.com\/user.php?page=id&id=16112<\/em><\/p>\n

GET \/user.php?page=id&id=16112 HTTP\/1.1<\/em>
\nHost: randkipl.com<\/em>
\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:6.0.1) Gecko\/20100101 Firefox\/6.0.1<\/em>
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8<\/em>
\nAccept-Language: pl,en-us;q=0.7,en;q=0.3<\/em>
\nAccept-Encoding: gzip, deflate<\/em>
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7<\/em>
\nConnection: keep-alive<\/em>
\nReferer: http:\/\/agagwhili.com\/-lenaa<\/em>
\nCookie: view=1; p=336; sub=1887; sex=0; erotic=1; typep=0; PHPSESSID=a7a9a32d77f07a11d3b3cce52a7b2910<\/em><\/p>\n

HTTP\/1.1 200 OK<\/em>
\nServer: nginx<\/em>
\nDate: Thu, 01 Sep 2011 19:24:43 GMT<\/em>
\nContent-Type: text\/html; charset=UTF-8<\/em>
\nTransfer-Encoding: chunked<\/em>
\nConnection: keep-alive<\/em>
\nX-Powered-By: PHP\/5.2.17<\/em>
\nExpires: Thu, 19 Nov 1981 08:52:00 GMT<\/em>
\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0<\/em>
\nPragma: no-cache<\/em>
\nSet-Cookie: view=1; expires=Fri, 02-Sep-2011 19:24:43 GMT; path=\/<\/em>
\nSet-Cookie: p=336; expires=Sat, 01-Oct-2011 19:24:43 GMT; path=\/<\/em>
\nSet-Cookie: sub=1887; expires=Sat, 01-Oct-2011 19:24:43 GMT; path=\/<\/em>
\nSet-Cookie: sex=0; expires=Sat, 01-Oct-2011 19:24:43 GMT; path=\/<\/em>
\nSet-Cookie: erotic=1; expires=Sat, 01-Oct-2011 19:24:43 GMT; path=\/<\/em>
\nSet-Cookie: typep=0; expires=Sat, 01-Oct-2011 19:24:43 GMT; path=\/<\/em>
\n— CUT —<\/em><\/p>\n

Server is in fact Apache in version 1.3.42 but the fake server name is transfered (nginx). Server use PHP\/5.2.17 and create Cookies.
\nNext header:<\/p>\n

— CUT —<\/em>
\nhttp:\/\/randkipl.com\/js\/messages_pl.php?city=<city><\/em><\/p>\n

GET \/js\/messages_pl.php?city=<city> HTTP\/1.1<\/em>
\nHost: randkipl.com<\/em>
\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:6.0.1) Gecko\/20100101 Firefox\/6.0.1<\/em>
\nAccept: *\/*<\/em>
\nAccept-Language: pl,en-us;q=0.7,en;q=0.3<\/em>
\nAccept-Encoding: gzip, deflate<\/em>
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7<\/em>
\nConnection: keep-alive<\/em>
\nReferer: http:\/\/randkipl.com\/user.php?page=id&id=16112<\/em>
\nCookie: view=1; p=336; sub=1887; sex=0; erotic=1; typep=0; PHPSESSID=a7a9a32d77f07a11d3b3cce52a7b2910<\/em><\/p>\n

HTTP\/1.1 200 OK<\/em>
\nServer: nginx<\/em>
\nDate: Thu, 01 Sep 2011 19:24:43 GMT<\/em>
\nContent-Type: text\/html; charset=UTF-8<\/em>
\nTransfer-Encoding: chunked<\/em>
\nConnection: keep-alive<\/em>
\nX-Powered-By: PHP\/5.2.17<\/em>
\n— CUT—<\/em><\/p>\n

As we can see the city name is send to the server. This is what I wrote at the beginning. Site use this name to improve social engineering attack \ud83d\ude09<\/p>\n

I didn’t have a time to lok for the site closer, but it has a lot of bugs in the registering form. Here is simple XSS:<\/p>\n

\"\"<\/a>\u00a0 \"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

In the cookies we can find information like chat box id, etc. \ud83d\ude09 Site was written probably by some russian guy – comments in the code suggest it:<\/p>\n

$(‘#chat’).append(“<p><span>\u0413\u043e\u0441\u0442\u044c<\/span> \u0433\u043e\u0432\u043e\u0440\u0438\u0442:<br \/>”);
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 it means “Guess write”<\/strong><\/p>\n

<!–O mnie: <b>\u041c\u043e\u044f \u043a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u0433\u0440\u0443\u0434\u044c \u0432\u0441\u0435\u0433\u0434\u0430 \u0436\u0434\u0451\u0442 \u0436\u0430\u0440\u043a\u0438\u0445 \u0447\u0443\u0432\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u0446\u0435\u043b\u0443\u0435\u0432.
\n\u042f \u0433\u043e\u0442\u043e\u0432\u0430 \u043e\u0442\u0434\u0430\u0442\u044c\u0441\u044f \u043c\u0443\u0436\u0447\u0438\u043d\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043c\u043e\u0436\u0435\u0442 \u0441\u0432\u043e\u0438\u043c\u0438 \u043e\u043f\u044b\u0442\u043d\u044b\u043c\u0438 \u0440\u0443\u043a\u0430\u043c\u0438 \u0434\u043e\u0432\u0435\u0441\u0442\u0438
\n\u043c\u0435\u043d\u044f \u0434\u043e \u044d\u043a\u0441\u0442\u0430\u0437\u0430. \u0411\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u043e\u0431\u043e\u0436\u0430\u044e, \u043a\u043e\u0433\u0434\u0430 \u043c\u0435\u043d\u044f \u0431\u0435\u0440\u0443\u0442 \u0441\u0437\u0430\u0434\u0438.<\/b><br>–><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 I will not translate this \ud83d\ude09<\/strong><\/p>\n

About chat box. We can find it here:<\/p>\n

http:\/\/randkipl.com\/\/js\/messages_pl.php?city=<city><\/p>\n

— CUT —<\/em>
\nvar messages = <\/em><\/p>\n

new Array(<\/em>
\n“M6 – No tak fajnego ciala jeszcze nie widzialem, W5 powtorzmy w nast. tygodniu?!\\n”+<\/em>
\n“W5 – Popatrzymy\\n”+<\/em>
\n“W2 – Dobrze wypoczelismy wczoraj w miescie <city>\\n”+<\/em>
\n“M12 – Hej! Starczy pornem sie bawic, kto wczoraj byl na spotkaniu grupowym w <city>? \\n”+<\/em>
\n“W2 – Ja bylam, chcesz powtorzyc? \\n”+<\/em>
\n“M12 – W2 no ze zdjec widac, ze niezle bylo, jestes taka mila ) \\n”+<\/em>
\n“M10 – Ci, ktorzy waslali swoje nagranie ‘W calym domu’ prosze podac link do strony brunetki, bardzo mi sie spodobala \\n”+<\/em>
\n“W5 – Wyslalam Ci do privu\\n”+<\/em>
\n“W28 – dla poczatku by nie zaszkodzilo. Zobaczyc kto czego wart. I u kogo jak stoi)))\\n”+<\/em>
\n“M1 – To oczym pytanie – zapraszam do priwu albo do web przez skype!\\n”+<\/em>
\n“W24 – Zgubilam wideo, to co wysylala W2? Prosze o podanie linku!\\n”+<\/em>
\n“M6 – M2 aktywnie wyklada swoje domowe wideo, nawet podejrzewam, ze zapraszali kogos filmowac)!\\n”+<\/em>
\n“M18 – Kto tam sie grozil zorganizowac striptiz przez skype?\\n”+<\/em>
\n“M19 – Starczy dreczyc, dziewczynki, wlaczajcie kamere! \\n”+<\/em>
\n“W24 – A kto mi obiecywal foto swojego ptaszka?\\n”+<\/em>
\n“W25 – W24 – A kto, do rzeczy, obiecywal?\\n”+<\/em>
\n“M12 – Jestem gotowy do spotkania z dziewczyna z Piteru!\\n”+<\/em>
\n“W5 – Juz zrzucilam Ci do priwu komorke – otrzymales?\\n”+<\/em>
\n“M6 – Kto uwielbia anal lesbijek, rzuce do priwu zajebisty filmik!\\n”+<\/em>
\n“W26 – Mam propozycje dla powaznych mezczyzn. Zapraszam do mego priwu! (miasto <b><city><\/b>)\\n”+<\/em>
\n“M10 – Co znaczy powaznych? Z kasa?\\n”+<\/em>
\n“W37 – Proponuje swoje realne intymne zdjecia\\n”+<\/em>
\n“W24 – Co za super! Z poczatku – no i potem koszmar, jak ona to wszystko wytrzyma?!))\\n”+<\/em>
\n“M19 – M7 –\u00a0 W2 w dzienniku ma taki ekstremalny, paluszki oblizesz! \\n”+<\/em>
\n“M1 – Aha. To ona tam sama chyba z dwoma facetami wystepuje, a wszystkim mowi, ze to jej kuzynka\\n”+<\/em>
\n“W2 – Namawiacie na skromna dziewczyne, niepotrzebnie)))\\n”+<\/em>
\n“W22 – W24 – Zajebiscie, co teraz zobaczylam z linku Sergieja. Popatrz!\\n”+<\/em>
\n“W41 – Proponuje realny seks z dominowaniem w Moskwie!\\n”+<\/em>
\n“M26 – czesc wszystkim. Jestem tu nowy. Naprawde tu zapoznywaja sie dla seksu, jestem z miasta<city>?\\n”+<\/em>
\n“W28 – Zalezy od tego, co proponowac bedziesz\\n”+<\/em>
\n“W28 – Czy myslales, ze przyslismy tutaj w miasta grac?))\\n”+<\/em>
\n“M26 – Poczatek optymistyczny, do rzeczy\\n”+<\/em>
\n“M26 – Samara. Jestem gotowy do spotkania dzis wieczorem z sympatyczna dziewczyna) \\n”+<\/em>
\n“M10 – Polina – dinamo. Dalej zdjec nie pojdzie!\\n”+<\/em>
\n“M9 – Kurde, dziewczynki, chce od razu dwoch – co robic?\\n”+<\/em>
\n“W5 – zobacz ankiete M11 – dwie siostry ;)\\n”+<\/em>
\n“W41 – M9 – Przyjezdzaj do mnie na Sokol w Moskwie, wszystko zalatwie. Szczegoly – w priwie!\\n”+<\/em>
\n“M10 – W41 powazna pani. Moze taaakie pokazac, juz widzialem!\\n”+<\/em>
\n“W37 – M6 – Hejki! Nie zdradzales mi tutaj?Ostatnim razem nasze spotkanie bylo nawet za bardzo!)\\n”+<\/em>
\n“M6 – zdradzalem z dwiema brunetkami i jedna piersiasta lesbi. Poczekaj, zaraz Ci Linki podam!\\n”+<\/em>
\n“W1 – Nie chlopaki poszli, a same masturbanty. Choc by ktos mi wsunal!)\\n”+<\/em>
\n“W30 – Oj, ja tez chce zobaczyc! M19, jestes z Moskwy?\\n”+<\/em>
\n“M19 – Tula! Proponuje dzisiaj grupowe spotkanie!\\n”+<\/em>
\n“W11 – co do seks-party w Tule zwracaj sie do mnie – w zeszlym miesiecu bylo niezle!\\n”+<\/em>
\n“W23 – Prosze i dla mnie troche czegoc slodziutkiego zostawic!)\\n”+<\/em>
\n“M9 – W2 – A jak Ci sie bardziej podoba?\\n”+<\/em>
\n“W2 – gdy w dupe, ale ostroznie! \\n”+<\/em>
\n“M18 – Starczy nakrecac, lepiej wyloz swoje nowe przygody w biurze!\\n”+<\/em>
\n“M26 – Popatrzcie w moim dzienniku na msj skarb i konczycie na siebie!\\n”+<\/em>
\n“W15 – Aha. Juz widzialam. Naprawde zachwyca! A to naprawde twoj?\\n”+<\/em>
\n“W1 – Ehe. Widzialam w realu, jeszcze wiekszy)))\\n”+<\/em>
\n“M1 – Gdy u niego wstaje, M26 pada!))))\\n”+<\/em>
\n“W26 – Kto chce nie przez skype – prosze do priwu po telefon i warunki!) \\n”+<\/em>
\n“M26 – M6 – A co, spotykales sie z Oksana?\\n”+<\/em>
\n“W10 – Patrzcie na ta rzecz. Krecili prosto na lekcji!\\n”+<\/em>
\n“M1 – Kurwa! Jak to oni wpali na sposob – prosto na podlodze!\\n”+<\/em>
\n“M21 – Tak, ciekawa poza, trzeba bedzie sprobowac!\\n”+<\/em>
\n“M24 – Starczy masturbowac, kto tam z <city> – przyjezdzajcie do mnie, pogramy w doroslych!\\n”+<\/em>
\n“W10 -M24 – telefon i zdjecie wyslij, moze i przyjade\\n”+<\/em>
\n“W5 – No jestem z <city>.\u00a0 A co umiesz?\\n”+<\/em>
\n“M24 – Co zechcesz – polize, anal, seks zabawki!\\n”+<\/em>
\n“W18 – Romka jest wielkim wymyslaczem! W sobote konczylam z nim 5 razy!)))\\n”+<\/em>
\n“M15 – A mi sie podobaja dziewczyny z piercingiem na wargach sromowych! Sa takie?\\n”+<\/em>
\n“W12 – Tutaj wszyscy takie!\\n”+<\/em>
\n“W27 – Aha, i nie tylko na wargach. Mam na pepku i jezyku pierscionek!\\n”+<\/em>
\n“M12 – Mowia, lody z piercingiem sa uajebiste! \\n”+<\/em>
\n“W22 – A ty co, nie probowalecs? To 7 niebo!\\n”+<\/em>
\n“M1 – M10 – Sluchaj, widziales W1 w realu?\\n”+<\/em>
\n“W1 – kto tu plotkuje o mnie? A psik!\\n”+<\/em>
\n“W5 – W2 – Popatrz-no, laseczko, na to! I to trzeba pod takim ujeciem zfilmowac! \\n”+<\/em>
\n“M12 – Prosze mi tez to pokazac, ocenie!\\n”+<\/em>
\n“W2 – WoW! Jak ona go tam wsunela?\\n”+<\/em>
\n“M6 – W11 – A ja o czym mowie? Rzucilem Ci do priwu link do bezoplatnego porno.\\n”+<\/em>
\n“W30 – A kto co wiecej lubi?\\n”+<\/em>
\n“M19 – ja uwielbiam lesbi z zabawkami)))\\n”+<\/em>
\n“W36 – Tak-tak, jak jedna druga straponem … – to superrrrrrr)))))\\n”+<\/em>
\n“W9 – Chce sie mezczyzny zywego – z penisem\u2026\\n”+<\/em>
\n“M15 -W9 – Posluchaj, jak zrozumialem, jestes z Moskwy, to spotkajmy sie? \\n”+<\/em>
\n“W9 – Lap w priwie telefon!\\n”+<\/em>
\n“M24 – M7 – Zobacz, penisa dziewczynkom sie zechcialo. Moze pomozemy laseczkam? Zrobimy stoleczne swing-party? \\n”+<\/em>
\n“M7 – Tak zawsze za. W36, podaj numerek!\\n”+<\/em>
\n“W36 – M24 i M7 napiszcie do priwu!\\n”+<\/em>
\n“W35 – Popatrzcie, to ja z komorki swego chlopaka krecilam!\\n”+<\/em>
\n“W24 – Co za, jakiego ma miecza! Jak go przyjmujesz?\\n”+<\/em>
\n“W35 – Latwo!)))\\n”+<\/em>
\n“M26 – W48 – to Twoje wideo wysylal M2?\\n”<\/em><\/p>\n

);<\/em><\/p>\n

function rand(l,k)<\/em>
\n{<\/em>
\n\u00a0 var rand_no = Math.random();<\/em>
\n\u00a0 rand_no = l+rand_no * (k-l);<\/em>
\n\/\/\u00a0 alert(“”+rand_no+” “+Math.ceil(rand_no));<\/em><\/p>\n

\u00a0 return Math.round(rand_no);<\/em>
\n};<\/em><\/p>\n

var rndnum = getCookie(‘curchattext’);<\/em>
\nif (rndnum) <\/em>
\n{<\/em>
\n\u00a0 if ((rndnum<0) || (rndnum>=messages.length))<\/em>
\n\u00a0 {<\/em>
\n\u00a0\u00a0\u00a0 rndnum = rand(0, messages.length-1);<\/em>
\n\u00a0 }<\/em>
\n}<\/em>
\nelse<\/em>
\n{<\/em>
\n\u00a0 rndnum = rand(0, messages.length-1); \u00a0<\/em>
\n}<\/em>
\nsetCookie(‘curchattext’,rndnum);<\/em><\/p>\n

\/\/alert(rndnum);<\/em>
\nvar messagesArray=messages[rndnum].split(“\\n”);<\/em><\/p>\n

\/\/alert(messagesArray.length);<\/em><\/p>\n

var boys=new Array(<\/em>
\n“dar”,<\/em>
\n“michalkania”,<\/em>
\n“Alex”,<\/em>
\n“Amadeus”,<\/em>
\n“Znieczulenie”,<\/em>
\n“Andrzey”,<\/em>
\n“Kamil”,<\/em>
\n“Jakub”,<\/em>
\n“Patrick”,<\/em>
\n“Adrian”,<\/em><\/p>\n

“Mihial”,<\/em>
\n“David”,<\/em>
\n“Katsper”,<\/em>
\n“Mateus”,<\/em>
\n“Ivan”,<\/em>
\n“Marcin”,<\/em>
\n“Daniel”,<\/em>
\n“Shimon”,<\/em>
\n“Bartlomieja”,<\/em>
\n“Philip”,<\/em>
\n“Christian”,<\/em>
\n“Paul”,<\/em>
\n“Adam”,<\/em>
\n“Arkady”,<\/em>
\n“Conrad”,<\/em>
\n“Lukas”,<\/em>
\n“Dariush”,<\/em>
\n“Dominique”,<\/em>
\n“Oscar”,<\/em>
\n“Andrew”,<\/em>
\n“Damian”,<\/em>
\n“Przemyslaw”,<\/em>
\n“Radoslav”,<\/em>
\n“Rafal”<\/em>
\n);<\/em><\/p>\n

var boys_colors=new Array(<\/em>
\n“red”, <\/em>
\n“blue”, <\/em>
\n“#e69240”, <\/em>
\n“green”, <\/em>
\n“black”, <\/em>
\n“#c96a6a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“red”, <\/em>
\n“blue”, <\/em>
\n“#e69240”, <\/em>
\n“green”, <\/em>
\n“black”, <\/em>
\n“#c96a6a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em><\/p>\n

“red”, <\/em>
\n“blue”, <\/em>
\n“#e69240”, <\/em>
\n“green”, <\/em>
\n“black”, <\/em>
\n“#c96a6a”,<\/em>
\n“red”<\/em>
\n);<\/em>
\nvar girls=new Array(<\/em>
\n“\u041e\u043b\u044f”,<\/em>
\n“niunia”,<\/em>
\n“aniaw”,<\/em>
\n“Oliwia”,<\/em>
\n“ania”,<\/em>
\n“xxmartaxx”,<\/em>
\n“milenka”,<\/em>
\n“Katanyna”,<\/em>
\n“Jana”,<\/em>
\n“kari”,<\/em>
\n“Emanuela”,<\/em>
\n“Elica”,<\/em>
\n“mi6kata”,<\/em>
\n“krissito”,<\/em>
\n“Zocha”,<\/em>
\n“korona”,<\/em>
\n“rainaxristovaa”,<\/em>
\n“lusinda”,<\/em>
\n“Mada”,<\/em>
\n“Ewa”,<\/em>
\n“Brygid”,<\/em>
\n“Kunigunde”,<\/em>
\n“Krysta”,<\/em>
\n“Yalgonata”,<\/em>
\n“Lidia”,<\/em>
\n“Ingrid”,<\/em>
\n“sensoria”,<\/em>
\n“rosito”,<\/em>
\n“justysia”,<\/em>
\n“Grazyna”,<\/em>
\n“pysia”,<\/em>
\n“hotbeborana”,<\/em>
\n“bebeto”,<\/em>
\n“ognyanov”,<\/em>
\n“treis”,<\/em>
\n“LadyBetina”,<\/em>
\n“crazyangel”,<\/em>
\n“angel”,<\/em>
\n“eli4ka”,<\/em>
\n“lo6omomi4e”,<\/em>
\n“niczky”,<\/em>
\n“ledenataaaa”,<\/em>
\n“aniaw”,<\/em>
\n“justysia”,<\/em><\/p>\n

“Krystyna”,<\/em>
\n“Elwira”,<\/em>
\n“Lodoiska”<\/em>
\n);<\/em><\/p>\n

var girls_colors=new Array(<\/em>
\n“red”, <\/em>
\n“blue”, <\/em>
\n“#e69240”, <\/em>
\n“green”, <\/em>
\n“black”, <\/em>
\n“#c96a6a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”,<\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“red”, <\/em>
\n“blue”, <\/em>
\n“#e69240”, <\/em>
\n“green”, <\/em>
\n“black”, <\/em>
\n“#c96a6a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”,<\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”,<\/em>
\n“#7979e9”, <\/em>
\n“#3c8d51”, <\/em>
\n“#4dafa9”, <\/em>
\n“#426664”, <\/em>
\n“#e2631e”, <\/em>
\n“#16910a”<\/em>
\n);<\/em><\/p>\n

— CUT —<\/em><\/p>\n

The name of the city is bold in the messages. This text are randomly put to the chat box with the random nick name. Of course we can post some java script code there instead of city \ud83d\ude09
\n\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Probably there is much more useful bugs. I didn’t register myself to play more, because I don’t have time to do that. If someone is interested in this topic and have some extra info please contact with me \ud83d\ude09<\/p>\n

Best regards,
\nAdam Zabrocki<\/p>\n","protected":false},"excerpt":{"rendered":"

Today I’ve received strange mail: — CUT — Date: Thu, 01 Sep 2011 09:11:00 +0200 From: gayroobaoll <gayroobaoll@o2.pl> To: pi3@itsec.pl Subject: Chcesz, http:\/\/facebook.com\/100002779484440 — CUT — As we can see, there is no subject, mail include link to someone’s facebook profile and has got only one Polish world (yes, this is attack for the Polish […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4,5,1],"tags":[],"class_list":["post-163","post","type-post","status-publish","format-standard","hentry","category-bughunt","category-exploiting","category-o-wszystkim-i-o-niczym"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=163"}],"version-history":[{"count":29,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/163\/revisions"}],"predecessor-version":[{"id":207,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/163\/revisions\/207"}],"wp:attachment":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}