Searching for my man

[mystic]

DannyJones, unfortunately for you, I know about marine internet. So, where are you harbored? No harbor offers static IP addresses, and you are connecting always from the same place. That's very weird. Neither the very expensive internet satellite gives static IPs.

ptr 216.155.153.104
Sayreville, NJ, United States
216.155.153.104.choopa.net 216.155.128.0/19
Choopa, LLC
AS20473
ASN-CHOOPA

Choopa rents dedicated servers. Did you hack a server? Proxies are not allowed by the forum policies. Moreover, your machine is online but invisible from the net, which is very suspicious.

Just in case, I will believe you and give you two possibilities to prove your identity. I have to modify the software rules just for you to keep your account from deletion... you understand, it takes work.

1. If you use internet satellite, which can be $2000 a month, I think you are rich enough to contribute to this wonderful site with a donation. I think $10,000 is nothing for you, and many kids in the Philippines will benefit from your generosity.
2. Your account will be terminated if you don't furnish proof of identity. You can PM me a scan of your passport or ID card.

[mystic]

I thought to post additional info on DannyJones. I think that he will have to give a very good explanation now, but the way of the $10,000 donation is still open

He connects definitely from a server. It seems a Linux box. So, no way he is connecting from a boat, unless he is using this address as a proxy. The SMTP server betrays him, showing his domain: usaupload.net. This is one of those domains such as filesonic.com, rapidshare.com, etc., which are known to infringe copyrights and make money from their illegal activity. The domain is protected by a scheme of "man in the middle person" (WhoisGuard ), so you cannot see the real person, unless you get a court order.

It looks like this troll is one of those guys that live with illegal activities. He has probably many servers that he uses to store illegal content. So he can easily switch between one and another to launch his unclear activities.

FTP - 21 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 1 of 50 allowed.
220-Local time is now 08:22. Server port: 21.
220-This is a private system - No anonymous login
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
220 Logout.

SMTP - 25 220-plain4.usaupload.net ESMTP Exim 4.80 #2 Sun, 26 May 2013 09:22:27 +0200
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
421 plain4.usaupload.net lost input connection

HTTP - 80 HTTP/1.0 404 Not Found
Content-Type: text/html
Content-Length: 345
Connection: close
Date: Sun, 26 May 2013 07:22:27 GMT
Server: Apache

POP3 - 110 +OK Hello there.

IMAP - 143 * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc. See COPYING for distribution information.

Registrant Contact:
WhoisGuard
WhoisGuard Protected ()

Fax:
11400 W. Olympic Blvd. Suite 200
Los Angeles, CA 90064
US

[mystic]

For Gary2310 we have more info. He resides in the NY area and uses the home DSL by Optimum: http://www.optimum.com/home-internet-service/?s_cid=cvc_ool

When he connects, he receives theoretically a dynamic IP address, so there is no proxy here. But... his IP is blacklisted in 5 lists. So, there could be something weird happening here. Since this does not happen with other members in the forum, it is correct to investigate. So Gary2310 can help us improve our antispam software. Waiting for your passport or ID card, Gary.

Address lookup

canonical name ool-182c3fe2.dyn.optonline.net.
aliases
addresses 24.44.63.226


Domain Whois record

Queried whois.internic.net with "dom optonline.net"...
Domain Name: OPTONLINE.NET
Registrar: NETWORK SOLUTIONS, LLC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com/en_US/
Name Server: NS.CV.NET
Name Server: NS.CVNET.COM
Status: clientTransferProhibited
Updated Date: 26-sep-2011
Creation Date: 07-oct-1996
Expiration Date: 06-oct-2014

>>> Last update of whois database: Sat, 25 May 2013 23:49:14 UTC <<<


Queried whois.networksolutions.com with "optonline.net"...
Registrant:
Cablevision Systems Corporation
1111 Stewart Avenue
Bethpage, NY 11714-3533
US

Domain Name: OPTONLINE.NET

------------------------------------------------------------------------
Promote your business to millions of viewers for only $1 a month
Learn how you can get an Enhanced Business Listing here for your domain name.
Learn more at http://www.NetworkSolutions.com/
------------------------------------------------------------------------

Administrative Contact:
Ciruolo, Pina CVDOMAIN@CABLEVISION.COM
Cablevision Systems Corporation
1111 Stewart Avenue
Bethpage, NY 11714-3533
US
516.803.9687 fax: 516-396-8738

Technical Contact:
Security, Internet abuse@cv.net
CSC Holdings, Inc.
1111 Stewart Avenue
Bethpage, NY 11714
US
516-803-2400


Record expires on 06-Oct-2014.
Record created on 07-Oct-1996.
Database last updated on 25-May-2013 19:09:26 EDT.

Domain servers in listed order:

NS.CV.NET 167.206.1.30
NS.CVNET.COM 167.206.1.103


DNS records

name class type data time to live
ool-182c3fe2.dyn.optonline.net IN A 24.44.63.226 86400s (1.00:00:00)
dyn.optonline.net IN SOA
server: ns.cv.net
email: hostmaster@cv.net
serial: 2012040200
refresh: 7200
retry: 600
expire: 604800
minimum ttl: 86400
86400s (1.00:00:00)
dyn.optonline.net IN NS ns.cv.net 86400s (1.00:00:00)
dyn.optonline.net IN NS ns.cvnet.com 86400s (1.00:00:00)
optonline.net IN SOA
server: ns.cv.net
email: hostmaster@cv.net
serial: 2012090900
refresh: 7200
retry: 600
expire: 604800
minimum ttl: 900
7200s (02:00:00)
optonline.net IN NS ns.cvnet.com 172800s (2.00:00:00)
optonline.net IN NS ns.cv.net 172800s (2.00:00:00)
optonline.net IN A 66.54.17.31 86400s (1.00:00:00)
optonline.net IN MX
preference: 2
exchange: mx1.optonline.net
7200s (02:00:00)
optonline.net IN MX
preference: 2
exchange: mx2.optonline.net
7200s (02:00:00)
226.63.44.24.in-addr.arpa IN PTR ool-182c3fe2.dyn.optonline.net 86400s (1.00:00:00)
63.44.24.in-addr.arpa IN SOA
server: ns.cv.net
email: abuse@cv.net
serial: 2002030402
refresh: 7200
retry: 600
expire: 604800
minimum ttl: 86400
86400s (1.00:00:00)
63.44.24.in-addr.arpa IN NS ns.cv.net 86400s (1.00:00:00)
63.44.24.in-addr.arpa IN NS ns.cvnet.com 86400s (1.00:00:00)

[Smiley]

Smiley you never named the subject, could you identify the subject you refer to?

I believe the subject should be clear by now. . . . . . .

[Edwin]

Yes, Smiley, the subject should be crystal clear!

[mystic]

UPDATE

I thought that Gary2310's account was genuine, because it pointed to a real dynamic IP address. However, I received I think over 5 PMs by Gary2310, with ridiculous excuses and off topic polemics that nothing had to do with the only thing I requested from him: a scanned copy of a valid identity document that could prove his identity. I told him that his account will be kept online if he complies with the security verification. We are doing this for his safety also, because his IP address is in 5 blacklists. So, he should become aware of that and be happy that we verify and redeem him.

Instead of helping us, he only increases our doubts. First, he says that he lives in Deer Park ... uh ... the same location of his provider. Very strange. Second, he connected again to Jaderune through his dynamic IP address. A dynamic IP means that it changes every time one connects to the internet. But, surprise surprise, he came back with the same IP. That's not how a dynamic IP works, because it had to change. It seems a static IP. I also verified that, before his reconnection today, his machine was unreachable, thus disconnected from the internet. So, his provider had to assign him a new IP. Despite there might be an explanation, it simply looks overall like suspicious activity.

The thing that Gary2310, DannyJones, BigBlastGuy do not know is that I published only very little info on them, but I have a very big file. Today, I will show something more.

Gary2310

IP Address Country Code Location Postal Code Coordinates ISP Organization Domain Metro Code
24.44.63.226 US Deer Park, New York, United States, North America 11729 40.7627, -73.3227 Optimum Online Optimum Online optonline.net 501

DannyJones:

IP Address Country Code Location Postal Code Coordinates ISP Organization Domain Metro Code
216.155.153.104 US New York, New York, United States, North America 40.7143, -74.006 Choopa.com Reliable_Servers choopa.net 501

Gary2310's address is his provider's, which should be close to his home. He indeed said that he lives in Deer Park, but it is strange that he lives in the exact location of his provider. If he is a techie, he could have given it just to hide his real address. Anyways, we are very close to his home, as I said... I might even already have his direction and know his identity, but I will give him a chance to behave correctly.

Now, the real location of DannyJones is hidden, but... his server (the machine from where he connects to Jaderune) is in New York, same town of Gary2310. So we are effectively reaching him. Just a coincidence? Gary2310 might be the real man behind DannyJones and others. But somebody told me that a troll was seen in the Angeles area... so this is on the opposite side of the US. I wonder how correct his info were, because my tracings all point to New York. I have a cousin there, who is a lawyer.

So, the profile of our troll is a good techie/hacker, who has plenty of free time and lives of illegal activities. In particular, he hosts those services for uploading/downloading illegal content (copyrighted material). He also practiced email spamming, pornography, etc. His activity got him in dark waters, so he is used to fake his identity. He uses proxies, third persons, and every trick to avoid being detected. In the case of DannyJones, it is simply ridiculous. He has the same modus operandi/pattern of BigBlastGuy. And now he pretends that he is hosting a server on a boat. A reverse ARPA check reveals that he is renting that server from Choopa, because he even programmed the DNS in the Choopa records. That's something a person with an ordinary internet connection does not do. It's something for techies.

So, I will give some more hours to Gary2310 to send me his ID card, because we might catch a "false positive" - i.e. we might do a mistake due to a number of weird coincidences. There are still patterns that let me think his account might be genuine. With DannyJones, I think he was caught violating our site. I think he is actually BigBlastGuy. So, his account could be closed straight away.

[Edwin]

Good work, mystic! Thank you so much!

[mystic]

DannyJones' account was disabled due to site rules infringement.

In particular:
-he is using proxies and hiding his identity
-he discussed about money matters, which is not allowed
-he harassed other people
-he posts off topic things
-and most of all, he did not provide a valid identity document at a security check

If he wants his account re-enabled, he needs to provide a valid identity document (passport, ID card, driving license, etc.). He can mail it to the site administrator, if he feels he is in good faith.

[Edwin]

Eillene and any others, I would suggest that you not advertise your email address or your telephone number here. If someone is interested in you after reading your posts, then that person can PM you, and you can decide if you want to allow that person further contact with you. There is a little safety in doing it that way.

The reason I am suggesting that you make the person go through jaderune.com for your contact information, or make them PM you, then you decide if you want to give that person your contact information is that there has been a person in the past trying to get contact information, probably to sent something harmful to people, and I know in the past we were approached about that, and this person attempting to get that information was a very bad person, involved in criminal activities, pornography, underaged sex, and who knows what else. So it is a very good idea to protect your personal information, and only release it if you know you can trust that person!

[mystic]

UPDATE (QUICK)

Gary2310 provided his generalities and phone number for verification. Somebody residing in the New York area and wanting to invite Gary for a beer (and complete verification)?