To protect your privacy, your card will formally be billed as a payment
for a product or service at some lawful online store.
The administration of that store doesn't know anything about memberships
we sold. They really sure that you purchased their product.
Legal?
Work of art?
Or abused children?
You know the answer to that.
Since I am scribbling down stuff mostly about trojans, viruses, spam and other nasty things, I am quite used to see that phrase. Or variations of that phrase. E.g. in connection with scareware, you know those fake "Antivirus 2009 Pro" or whatever they call themselves. "Warning: Your computer is infected with spyware!"
Some time back it showed up in a slightly bit different connection, an alleged receipt from a payment processor. The whole sentence (yes, in capitals):
WARNING! FOR SECURITY REASON, DO NOT CONTACT BANK OR BILLING COMPANY REGARDING THIS ORDER!
I earlier mentioned that one of the processors for the child abusers, pay.aspire-systems.biz, went from McColo to Ecatel in the Netherlands (89.248.168.80).
Another cockroach, flashbill.net ran to Ucraine after McColos nosedive. Now lives at 193.34.168.111, something called "Cyborg", LTD "VPS.COM.UA" or whatever.
To find out where all or most of them went would be too timeconsuming to find out. But now and then something will occasionally show up.
Brian Krebs over at SecurityFix has done a nice job focusing on McColo.
Which lead to a couple of their providers "cutting the lines".
Maybe only a shortlived "victory", but I am enjoying it.
A couple of small details:
This is what I get today when trying to connect to a couple of the live domains on the botnet:
I earlier briefly mentioned that I was following some child porn trails (http://www.matchent.com/wpress/?q=node/355 - Google is your friend?).
I did follow the trail, but I hate this kind of stuff. Angry and sad are a couple of words I could use to describe my own feelings when I stumble over it. But those words are not strong enough, I'm not good with words.
This is a relatively short description of what I found.
I will not mention specific child porn domains, only some facts about the paymentprocessor.
Avalonpay Inc. is the name of (one of) the new child porn paymentprocessor.
Recent comments
41 weeks 3 days ago
41 weeks 6 days ago
42 weeks 2 days ago
42 weeks 3 days ago
43 weeks 5 days ago
1 year 22 weeks ago
1 year 22 weeks ago
1 year 24 weeks ago
1 year 24 weeks ago
1 year 26 weeks ago