This document was written with the intent to make spam expensive for a particular spammer. This one posts the URL to thefappeningdump.com. Our spammer appears to be making money from ad revenue, pop-ups, and referrals. That will be explained later. Please use this information to report any and all instances of this campaign that you see.
Domain registrar: abuse@name.com
Registrant Name: Protected Domain Services
Registrant Organization: Protected Domain Services
Registrant Street: 191 University Blvd. , Unit 384
Registrant City: Denver
Registrant State/Province: CO
Registrant Postal Code: 80206-4613
Registrant Country: US
Registrant Phone: +1.7206339075
WHOIS privacy protection abuse address: compliance@protecteddomainservices.com
Domain host: Cloudflare (abuse@cloudflare.com, 104.28.{18,19}.72)
Name Server: fred.ns.cloudflare.com
Name Server: leia.ns.cloudflare.com
Ads served for JuicyAds (http://www.juicyads.com/report.php, sample link: http://ck.juicyads.com/getjuicy.php?jad=999386&juser=60062&data=ea25f684e99639a16396a1bed95c08fa&std2=x213s2x20333y2f4a494&pubid=29390&zoneid=333247&jsparked=b9e0487b04b6f35e5e5b74bdd143b3b61cbb4a69&jurl=p5y5l4i4130424n4p456s206h4k5l554x5l454i4f4g4g4a406k4u5p2b4i4v554) appear as banner links (which seem to feature Chaturbate, support@chaturbate.com, http://chaturbate.com/affiliates/in/Lc8u/fxTnv/?track=track).
Chaturbate affiliate link seems to redirect to random models.
The following bit of code is associated with PopAds.net (https://www.popads.net/report-abuse.html). Not sure what part of this is useful to them. Notice the references to Chaturbate.
<!-- PopAds.net Popunder Code for thefappeningdump.com -->
<script type="text/javascript">
var _pop = _pop || [];
_pop.push(['siteId', 420724]);
_pop.push(['minBid', 0]);
_pop.push(['popundersPerIP', 0]);
_pop.push(['delayBetween', 0]);
_pop.push(['default', false]);
_pop.push(['defaultPerDay', 0]);
_pop.push(['topmostLayer', false]);
(function() {
var pa = document.createElement('script'); pa.type = 'text/javascript'; pa.async = true;
var s = document.getElementsByTagName('script')[0];
pa.src = '//c1.popads.net/pop.js';
pa.onerror = function() {
var sa = document.createElement('script'); sa.type = 'text/javascript'; sa.async = true;
sa.src = '//c2.popads.net/pop.js';
s.parentNode.insertBefore(sa, s);
};
s.parentNode.insertBefore(pa, s);
})();
</script>
<!-- PopAds.net Popunder Code End -->
<!-- Begin JuicyAds PopUnder Code -->
<script type="text/javascript">juicy_code='44e4x233p256r2p2v29433a4';</script>
<script type="text/javascript" src="http://ads.juicyads.com/jsclients/jac.js" charset="utf-8"></script>
<!-- End JuicyAds PopUnder Code -->
</head>
<body id=thePicturePage>
<center><h1><a href="http://thefappeningdump.com">The Fappening Dump</a></h1></center></br></b>
<center><!--JuicyAds v2.0-->
<iframe border=0 frameborder=0 marginheight=0 marginwidth=0 width=736 height=98 scrolling=no allowtransparency=true src=http://adserver.juicyads.com/adshow.php?adzone=333247></iframe>
<script id='popupJS' src='http://chaturbate.com/creative/im/1.js?c=0&filename=cb_im_str8_240x210_01.gif&height=210&width=240&wm=fxTnv&tour=Lc8u&track=track'></script>
<!--JuicyAds END-->
