accessed my VPS...

ONLY used it to create adwords account.

Entered new CC info, address, name etc.

Got a the "you have been suspended" email.

What on earth did I do wrong?

The only thing I can think is... I opened the welcome email from my banned IP BUT I didnt send anything back or reply! I just opened it!

Can they track your IP JUST BY OPENING IT?

It was a YAHOO email (not associated with gmail).

The only other thing is my IP was a location in Texas and the address on my CC was my local town (in Mississippi).

The address for the credit card was to a house right down the street from me.

Could that location be to close to my banned account and set off a red flag?

What on earth am I missing??

possible already compromised VPS ip?

Originally Posted by Fwiffo

possible already compromised VPS ip?

well I checked and it wasnt blacklisted. As far as someone else using this IP from this server and getting banned...what are the odds of that?

Did you sign up as a business?

Should I have changed the computer name and workgroup on the VPS?

I wonder if they use the 'fingerprint' method while their cookie is active to collect your system profile (your specific system, browser info, other installed programs, even BIOS data, etc). Even if you delete their cookie, the profile info may already be uploaded to them, and when a reinstalled temporary cookie sees the same profile at a session it interprets it as the same PC/IP. Just theorizing, but that is the intent of profile fingerprint IDing, and might be how G detected you.

Originally Posted by zebrahat

I wonder if they use the 'fingerprint' method while their cookie is active to collect your system profile (your specific system, browser info, other installed programs, even BIOS data, etc). Even if you delete their cookie, the profile info may already be uploaded to them, and when a reinstalled temporary cookie sees the same profile at a session it interprets it as the same PC/IP. Just theorizing, but that is the intent of profile fingerprint IDing, and might be how G detected you.

I would agree with this. They would almost certainly be fingerprinting you with js and / or flash and recording that fingerprint on signup. If the confirmation email was html with javascript (which gives them a full fingerprint, screen resolution, installed fonts and plugins etc) or even just had an invisible tracking image (which gives them your home IP + user agent and browser headers) then they could have got you then. Or flash cookies on your home PC. It's been a while since I signed up for an Adwords account, but if the welcome email is html then that's probably it.

Originally Posted by Autumn

I would agree with this. They would almost certainly be fingerprinting you with js and / or flash and recording that fingerprint on signup. If the confirmation email was html with javascript (which gives them a full fingerprint, screen resolution, installed fonts and plugins etc) or even just had an invisible tracking image (which gives them your home IP + user agent and browser headers) then they could have got you then. Or flash cookies on your home PC. It's been a while since I signed up for an Adwords account, but if the welcome email is html then that's probably it.

Ok, so just to clarify... the conclusion is that it most likely happened when I OPENED the email from the banned Ip?

And YES it was HTML

Don't wanna sound too tedious but -as a rule of thumb- both for adcents, gaypal, egay, you name it just create light-weight virtual machines (VMWare, VirtualBox, hell even Bochs if you have some maso tendency ) bridged to individual VPN/socks/whatever-non-suspicious IPs.

IP to VM ratio = 1:1. Use the specific virtual machine JUST for that specific task and put it to sleep as soon as you're done. Fire it up when needed again for that task, so you'll achieve a basically real sandboxed environment.

Never interconnect these services. We could go on forever trying reversing and debugging and trying to figure which specific technologies they use to track you down, but taking advantage of individual light-weight VMs will save you TONS of time and effort.

HTH!

I didn't know anyone from MS was here. I thought I was the only one :-)
lol

Originally Posted by bubu445

accessed my VPS...

ONLY used it to create adwords account.

Entered new CC info, address, name etc.

Got a the "you have been suspended" email.

What on earth did I do wrong?

The only thing I can think is... I opened the welcome email from my banned IP BUT I didnt send anything back or reply! I just opened it!

Can they track your IP JUST BY OPENING IT?

It was a YAHOO email (not associated with gmail).

The only other thing is my IP was a location in Texas and the address on my CC was my local town (in Mississippi).

The address for the credit card was to a house right down the street from me.

Could that location be to close to my banned account and set off a red flag?

What on earth am I missing??

If you opened an html email most likely they had a zero-pixel in there that got loaded up along with other html code and your real ip was exposed. Thats just a theory though.

Google is too clever it catches some or the other day .....so dont try to cheat google....