Author Topic: Suspicious New/Banned Users ~≈Megathread≈~ (Read 12822 times)

Max4344 · June 12, 2012, 07:26:15 PM

Quote from: Goldeen on June 12, 2012, 06:33:03 PM

You watch your tongue boy or I'll move your topics!!

I dont make that much topics anyways :p

Quote from: Anti-Block on June 12, 2012, 06:31:27 PM

?

you're kidding

Nope.

Ad Bot · Advertisement

Lugnut · June 12, 2012, 07:31:37 PM

Quote from: aludane on June 12, 2012, 05:53:13 PM

The question is then who are you?

Quote from: Kalphiter on June 05, 2012, 04:28:03 PM

Access logs

All visits to the tracking page and visits from Ephialtes' IP, in order. I won't take too much time to explain how I know the IP, but it's from Blockland connection logs, and an earlier incident in February 2011. You can do a search on the IP.

(image is loading upon opening inbox)

Quote from: Access Log File
kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:02:38 +0000] (me testing)

kalphiter.com:80 107.22.98.172 - - [03/Jun/2012:14:02:55 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 139 "-" "bitlybot" (bit.ly testing)

kalphiter.com:80 50.16.6.49 - - [03/Jun/2012:14:05:27 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 184 "-" "bitlybot" (bit.ly testing)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:05:46 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:05:46 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:06:00 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:06:00 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;sa=send2" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:14:13:35 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://forum.blockland.us/index.php?action=pm;f=outbox" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:15:25:05 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://forum.blockland.us/index.php?action=pm;f=outbox" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:15:42:41 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 195 "http://forum.blockland.us/index.php?action=pm;f=outbox" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)

kalphiter.com:80 192.168.1.1 - - [03/Jun/2012:16:20:51 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 196 "http://bitly.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" (me testing before sending message)

kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:23:19 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 241 "http://forum.blockland.us/index.php?action=pm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, loading an inbox)

kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:23:19 +0000] "GET /images/75024MaQpsfFq.gif HTTP/1.1" 200 1823921 "http://forum.blockland.us/index.php?action=pm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, loading an image in MY SIGNATURE)

kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:25:22 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 241 "http://forum.blockland.us/index.php?action=pm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, loading an inbox)

kalphiter.com:80 188.222.122.214 - - [03/Jun/2012:16:25:26 +0000] "GET /ip/track.php?code=b27147f839bf27c25fabdadb31d95ccf HTTP/1.1" 200 240 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19" (Ephialtes' IP, most likely visiting the link directly, then realizing what had just happened)

According to Ephialtes,
Quote from: Ephialtes on June 05, 2012, 02:38:54 PM
Yeah I'm not sure if you noticed but the image was sent to my inbox, hence my IP being the one viewing it.

Explanation of logs

Hm, I wonder why an image in my signature is loaded at the same exact second (16:23:19) as the tracking image. You claim Goldeen forwarded it to you (this is most likely true, but screenshotted it in order to fool people), yet somehow my signature was attached to the message. I know, you must have had access to Goldeen's inbox! I should tell Goldeen to change his password!

This is the image in my signature

It redirects from http://alturl.com/nis7d to http://kalphiter.com/images/75024MaQpsfFq.gif, and you can view it in my signature. It's the only image in my signature that I host myself. It's also a complete coincidence that the signature image supported my cause.

Timeline (all in EST)
(FT) marks forum time, which is 6 minutes behind the actual time
09:00:29 (FT) I send the PM to Goldeen 11:23:19 Ephialtes' IP visits the inbox 11:19:29 (FT) I post the discovery that Goldeen is Ephialtes 11:23:04 (FT) Goldeen quotes image from message and sends it to Ephialtes (in normal circumstances, who the hell does this?) 11:24:47 (FT) Goldeen responds 11:55:58 (FT) Ephialtes posts screenshot of message from Goldeen (the time message was sent is based on image the Ephialtes posted)

If you take out the event where Ephialtes' IP visits the inbox (my logs), I still have a very strong case considering how fishy the whole situation is.

Ephialtes, your tricks are mediocre.

ScratchTehEPICSpaceDude · June 12, 2012, 09:33:54 PM

Ephialtes is busted. :P

TheABELBOTO · June 12, 2012, 09:39:40 PM

Quote from: Goldeen on June 12, 2012, 05:50:34 PM

wound is Eussorus

i like you, cause of your name

Feep · June 12, 2012, 09:45:07 PM

Quote from: TheABELBOTO on June 12, 2012, 09:39:40 PM

i like you, cause of your name

i hate you, cause of your handicap

o.k.

TheABELBOTO · June 12, 2012, 09:47:04 PM

Quote from: Feep on June 12, 2012, 09:45:07 PM

i hate you, cause of your handicap

o.k.

and you wanna know my response?
BONK!

*steals yo moneh

ScratchTehEPICSpaceDude · June 12, 2012, 09:48:03 PM

Quote from: Feep on June 12, 2012, 09:45:07 PM

i hate you, cause of your handicap

o.k.

Wow. I thought Abel was getting better. So now i don't like you because you dismissed all the evidence in the mrlol drama just to side with him.

Anti-Block · June 12, 2012, 09:49:22 PM

I don't know... this is so unlike ephialtes

i personally think that Goldeen is in cahoots with Ephialtes. I donno.

Feep · June 12, 2012, 09:52:04 PM

Quote from: Anti-Block on June 12, 2012, 09:49:22 PM

I don't know... this is so unlike ephialtes

i personally think that Goldeen is in cahoots with Ephialtes. I donno.

nah, look at goldeens responses in the thread

i could put all of the words into ephi's mouth and they would fit perfectly

TheABELBOTO · June 12, 2012, 09:54:02 PM

Quote from: Feep on June 12, 2012, 09:52:04 PM

nah, look at goldeens responses in the thread

i could put all of the words into ephi's mouth and they would fit perfectly

if you know you know what he means

OT:
i think eussorous is back, and he going to go black once he skrews up

ScratchTehEPICSpaceDude · June 12, 2012, 09:54:29 PM

Or is Ephi trying to conspire to KALPHITER?

Feep · June 12, 2012, 09:55:15 PM

yes eussorus is wound. look.

Quote from: Blocky943 on June 09, 2012, 01:27:58 AM

I was playing on one server, name doesn't really matter, when some guy called Eussorus comes in and says this:
"STICK A carrot UP YOUR ASS SCREAMING "FRIEND SHIP IS MAGIC!"
"YOU ALL SUCK, JUST GO JUMP ON A PILE OF ACID!"
"haha nooblets"
Eussorus has left the game.
....
Are you joking?

Quote from: wound on June 12, 2012, 07:44:34 PM

still got that pony carrot up your ass screaming "FRIENDSHIP IS MAGIC"

eussorus is back

TheABELBOTO · June 12, 2012, 09:56:12 PM

Quote from: Feep on June 12, 2012, 09:55:15 PM

yes eussorus is wound. look.

eussorus is back

more proof:
(in-case he tries to change it)

wound · June 12, 2012, 10:23:58 PM

Quote from: Feep on June 12, 2012, 09:55:15 PM

yes eussorus is wound. look.

eussorus is back

you're about half a day late.

ephi/goldeen already figured it out.

L�rd T�ny� · June 12, 2012, 10:28:06 PM

Quote from: Socky on June 12, 2012, 03:29:47 PM

People don't get banned often enough for this to stay alive. Keep trying.

Ceist, extrude, etc, etc.