Anyone want to bait a mugu sympathiser? (Phishing host)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Oct 10, 2014 6:49 pm

There is a notorious fake bank phishing site at fnbplc.com (presently shut down). It keeps getting shut down, only to reappear on a different host. HOWEVER, the latest host is a lady in Issaquah, WA who runs a server in her basement and rents a T1 line to connect to the internet. This is known as the "bullet proof web hosting" business.

What usually happens is that a man loses his earning potential (usually for medical reasons), so he has his wife generate some cash by hosting scam or spam websites from their home, connected to the internet by what is called a T1 line, basically like a twisted pair phone line (hence the T) only for digital information. This particular lady is fairly new to the trade, because she gave her real contact info to the T1 provider (online.net) as required by law. They would cancel the service if she gave a bogus address, and T1 lines cost around $2,000 per month. Obviously the line has to be connected to her home, so the T1 provider has to know the real address. This lady has not yet discovered the loophole that allows her to hide her contact info (and I am not about to reveal it here!).

Anyways, are any experienced baiters up for baiting this mugu sympathizer? Maybe pose as a lad who wants to host a site, deliver flowers to her address complements of some really sinister Somali pirate leader, complete with terrifying message, have a lad call her..., send her a few fake cashiers checks for $50,000, the possibilities are endless. BUT be careful not to violate any forum rules, particularly the innocent third party rule. I personally think that neither the web host nor any lad are innocent third parties, but I don't have enough experience to be sure. I suspect that having her SWATted (google it) might be a rule violation, but again I don't really know.

Information deleted-Capone

Posted: Fri Oct 10, 2014 6:57 pm

Hi J.

I've deleted the WhoIs info you posted. You've been here, you know that we don't allow personal info to be posted on the Forum with no supporting evidence. People post their ex's info, their employers, etc, etc. So unless there's more than an allegation, not on this forum.

You also know that the suggestions of sending materials, phoning this person etc are violation of the ITP rules. Again we don't have evidence that this person is running a service such as you describe or that she isn't hosting legitimate users?

Posted: Fri Oct 10, 2014 6:57 pm

Do you actually have proof that this is being hosted in the "woman's basement"? A check on the IP says the host is Iliad Hosting in France.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Quote:

I suspect that having her SWATted (google it) might be a rule violation

Really? Come up with that on your own?

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

I don't know how to bait that. but I'd go the way of baiting the lad behind the mule, and twist dollarchops in a way, that the mule took the money.

they always hate being chopped, especially by the mule. it destroyes trust.

and if that happens with several unrelated victims, the mule gets troubles.

EDIT: besides, if that is bulletproof hosting, why is the website down? bulletproof hosting is a way to avoid that.

Posted: Sat Oct 11, 2014 1:39 pm

^ The site is down because I killed it.

The person whose name shows up in the who is probably isn't the actual creator or hoster of the website. Most likely she is an ITP whose details got phished, or a mule who was convinced to register sites for the lads. Baiting her would be unnecessary and probably counterproductive.

I'm not sure why the OP is fixated on this particular person or this particular site either. We know of several "repeat offenders" who have dozens or even hundreds of sites in the AA419 DB registered to them, and this person isn't anywhere near that level (she has only three, as far as I can tell). And a site jumping hosters repeatedly isn't particularly unusual either. When we see it has happened, we just give it another whack and it usually goes back down.

Posted: Sat Oct 11, 2014 4:31 pm

Big X wrote:

^ The site is down because I killed it.

Big X, you kill sites? Hmmm...I never knew.

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

@big X: great that you got it killed.

the thing I suggested was hurting the lad together with the mule. and that would hurt any mule the lad brings in, and it would specifically not hurt this woman, if she was just someone whose data were phished.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Quote:

and that would hurt any mule the lad brings in, and it would specifically not hurt this woman, if she was just someone whose data were phished.
.....and if that happens with several unrelated victims, the mule gets troubles.

I would like to be very, very clear on this.

We Do Not Bait or target Mules.

If any of you come across a mule, you report it to a Mod.

Lads are lads and are criminals. Mules can be many, many things - ultimately, however, they are victims.

X posted the same thing many of of us believe.

Personally, from my experience, I lean towards former victims or just random people pulled from the internet and set up as strawmen when a registrant is created.

Faker makers - the really good ones who do it professionally - know how to djinn the system. They know what registrars look for, and what site killers look for, and they will use ITP when they can/when they are smart.

JBStrabismus - you don't know what you are talking about.

Posted: Sat Oct 11, 2014 8:15 pm

I just thought I would try my hand at site killing, and picked this one because it was the most recent site reported. My first attempt at killing it failed, but X took it down with no difficulty, incidentally educating me in the proper technique (I had made an important mistake, but said mistake obviously did not compromsie X's efforts.). I am not obsessed with this site by any means - it does not even exist any more, thanks to X!

X's arguments about the WHOIS contact info probably being a mule or ITP are well taken, and I will respect the fact that this forum does not bait mules. Nobody on this forum HAS baited the mule (or whatever) involved.

Should it ever spring back to life then I will report that fact, if I happen to notice, but otherwise I am done with this particular phishing site.
JB

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Fair.

Please read and look around.

Many of us have been doing this an awful long time. We do tend to know what we are talking about.

You have been a member here for a while, but lurking. Read, please.