+---------------------------------------------best-viewed-in-DAMN-NFO-VIEWER-+ S N | RLS DATE: 20.06.06 | C O | TYPE: Scene Notice | E T | SOURCE: Some concerned sceners | N I | EVIDENCE: Screenshots [Made in: Opera v9.0.8501 / By: SnagIt v8.0.2] | E C +------------------------------------------------made-using-ASCII-ART-STUDIO-+ THE PLOT: Straight to the chase. He has site access, we belive it is only one site at the moment. He started a group recently, MP3 section, mostly UA releases, some RU. Reencodes > possible, not confirmed yet. He both races [FXP] and uploads to torrent sites, at least one MAJOR public [www.] site confirmed. He is from Russia. He seems to have a perm IP address. He is reported to own or root a 100mbit .ru server (NOT a scene site, just a server). INFORMATION: +--------------------------------------+---------------------------------------+ | IRC NICKs | [Alive] / [Aliv3] / mushroomhead | +--------------------------------------+---------------------------------------+ | WWW NICKs | mushroomhead | +--------------------------------------+---------------------------------------+ | COUNTRY OF ORIGIN / DOMAIN | Russia / .ru | +--------------------------------------+---------------------------------------+ | IP ADDRESS / HOST MASK | 217.10.40.35 / 217.10.*.* | +--------------------------------------+---------------------------------------+ | CONFIRMED TORRENTs | http://www.vipmusic.org/ | | | http://tracker.vipmusic.org/ | | | IPs [both]: 83.140.32.136 | +--------------------------------------+---------------------------------------+ | SCENE GROUP / SECTION | EVEN / MP3 | +--------------------------------------+---------------------------------------+ | SPOTTED ON IRC NETWORKS / NICK | EFNet / [Alive] | | | LinkNet / [Alive] | | | After-All / [Alive] | +--------------------------------------+---------------------------------------+ IRC WHOIS: ___EFNet___ - [Alive] is henry@av27475.comex.ru * mushroomhead [Alive] on @#plz.die.whois.whore.k.thx [Alive] using efnet.*.*.* WHY my piggy, WHY? I loved you my piggy. [Alive] End of /WHOIS list. - ___After-All___ - af'[Alive] is henry@v.i.p * mushroomhead af'[Alive] has identified for this nick af'[Alive] on af'[Alive] using *.After-All.* After-All IRC Network af'[Alive] is using a secure connection (SSL) af'[Alive] End of /WHOIS list. - NOTE: Here, what we see is not a PSY, but simply a vhost given by the network. It is a free for all feature on After-all. Notice by the way, that here too he used "v.i.p" as vhost (derived from http://www.vipmusic.org/ ). ___Link-Net___ - ln'[Alive] is henry@LinkNet-099826725e.comex.ru * mushroomhead ln'[Alive] using link-net.* LinkNet IRC Network ln'[Alive] is an SSL Encrypted Client ln'[Alive] End of /WHOIS list. - SCREENSHOTS: On the screenshots included, you can see his user profle on the torrent site. You can see that he is not an average user and belongs to a special user class. On other screenshots, you can see the stuff he has uploaded so far. And well, he is not going anywhere and actively participates by FXPing new stuff and uploading older genuine scene releases. For those wondering, flag on the screenshots is Russian. Now, some of you might say that the screenshots prove nothing, since there is no ip or hosts shown. Yes, but we have other evidence we cannot really provide, and we are 100% positive that it is him. You certanly do not have to believe anything, its your call and your choice. RECOMMENDATIONS: 1. GENERAL: As we can notice, A LOT of Russian people who are either in the scene or have scene access are involved in torrents, www warez forums, p2p, dc++ and alike. BEWARE and always think twice of the people from .ru you either have or thinking of adding! We suggest doing a big cleanup of all .ru users. 2. TO SITEOPS: We suggest you check your sites for users names that match the following keyword: alive, aliv3, mushroomhead, henry, vip AND any others you can think of. Also, check for IPs/host masks that might match his IP: 217.10.40.35. Also, as we mentioned before, he owns or roots a 100mbit .ru site, thus any user offering you a new .ru slave MIGHT be him. Check nicks, IPs, etc.! 3. TO USERS: We suggest you be on the look-out for the user discussed here. Look for similar nick/hostmask or irc whois. If you are on a site with him, we suggest either reporting to siteop and DEMANDing (Yes, demanding. Why should you tolerate insecure people that might threat YOUR security?) a deluser for him OR if the first option is not really possible (reluctant siteop) deluser yourself and SPREAD THE WORD about that site/siteop (no, not snitching on the site/siteops, but telling the racers/groups/sceners you know that that site might be insecure). 4. TO NUKERS: Be on the lookout for releases from EVEN. There is a possibility of reencoding/bad or lame ripping. DISCLAIMER: What can we really say here? We do not have ANYTHING whatsoever aga- inst this guy. BUT sharing genuine scene releases with www public/ ordinary people, people who do not contribute is wrong, to say the least. CONCLUSION: To all siteops/users and people who have any kind of power in the scene. We recommend giving out a SCENEBAN to both this guy, [Alive], and his group EVEN. The leader of the group uploading to torrent sites means that he and his group are insecure and that there is a chance of reencoded releases. By the same token, people who know him are potential threat as well. Our points remain: siteops, do you really want taking a chance with a torrent user on your site?; users, do you really want to be on a site that have torrent uploader there and thus having a chance of being busted together with the site you are on? nukers, do you really want another p2p/torrent-related group ON THE SCENE? Ask yourself, make a difference, demand security TODAY! Yes, he might switch nicks, but at least we have tried... >>> DELUSER/PURGE GROUP/SCENEBAN. Regards, Council of V3ND3TT4 (a bunch of concerned sceners). P.S. Now, users, siteops, nukers, all yall: please try to UNDERSTAND this, this notice doesnt not mean you MUST do anything. Think and decide for yourself.