safepaymentsonline.com - down the rabbit hole we go...
I have been taking a look at the site safepaymentsonline.com because a report of naughtiness was received. Here is what I found:
Current WHOIS:
ICANN Registrar: TLDS, LLC DBA SRSPLUS
Domain created: 8 April 2008
NS1, 2, 3, 4.SAFEPAYMENTSONLINE.COM
IP: 216.195.56.148 (Oregon - Portland - Aps Telecom)
Registrant: Markus Simpson (further details hidden behind SRSPlus Private Registration)
Sharing IP with 29 domains: 1softwarespot.com, Adult-billing.com, Bestsoftclub.com, Billhlp.com, Billingcenteronline.com, Billinghost.net, Billingintegrator.com, Billingmill.com, Billingserviceonline.com, Billingsquad.net, Billinternet.com, Billsvc.com, Customerhlp.com, Dopaymentsonline.com, Ebillingcenter.com, Fantazybill.com, Interbills.com, Justnetbilling.net, Legalbillingsystems.com, Mainbillingcenter.com, Megafixer.com, Orderhlp.com, Paymentbit.com, Paymentbit.net, Paymentforge.com, Safepaymentsonline.com, Softwbill.com, Spankyhosting.com, Support-wizard.com, Truebillingservices.com.
Following the white rabbit...
Once again, I will take the opportunity to show my gentle readers how we can uncover the ties that bind when investigating non-reputable domains. It is becoming more and more important that we become proficient in undertaking such checks now that the bad guys are trying harder to hide who they are, what they are doing, and any history of misbehavior.
In this case, we start with the name "Markus Simpson" which is already familiar to me. We can tie "Markus Simpson" to our favorite monitored pseudonym, "Serg Moon", when we note that the WHOIS information for truebillingservices.com was changed from "Serj Moondy" to Markus Simpson" back in October of this year.
I have also come across the safepaymentsonline domain before in association with malvertizing:
http://msmvps.com/blogs/spywaresucks/archive/2008/10/10/1650407.aspx
http://msmvps.com/blogs/spywaresucks/archive/2008/10/01/1649358.aspx
We can tie some of the domains above that share IP with safepaymentsonline.com, being truebillingservices.com, softwbill.com, spankyhosting.com and others, to ultimatepayment.com (via shared IP address). This in turn leads us to bucksbill.com (which also used to share IP address). Bucksbill was notorious for charging twice as much to credit cards for fraudware/fake security software as was authorized:
http://msmvps.com/blogs/spywaresucks/archive/2008/10/01/1649358.aspx
Overcharging of credit cards - check out the comments:
http://msmvps.com/blogs/spywaresucks/archive/2008/03/28/1558045.aspx
Historical WHOIS information for safepaymentsonline.com reveals even more ties that bind. Back when the domain was first registered, the Registrant was listed as a "Kira Nigel", with an email address of deryderuki@yahoo.com.
"deryderuki" is familiar to me too - sure enough, it appears in the internal research about Innovative Marketing as released by Sunbelt Software. Innovative Marketing are, of course, the subject of a lawsuit recently announced by the FTC.
"deryderuki" appears three times in the Sunbelt documentation:
bestpaymentsolution.net (Kira Nigel, deryderuki@yahoo.com)
direct-billing.com (Jim Havbeck, deryderuki@yahoo.com)
securefileshredder.com (Jim Havbeck, deryderuki@yahoo.com)
"Jim Havbeck" draws our attention to even more names and email addresses: admin@securefileshredder.com, "Sagent Group" (adminsagent@gmail.com) and "Sam Akshay" (mail@secureexpertcleaner.com).
Malvertizements and fraudware/fake security software incidents implicating Sagent Group:
http://www.bluetack.co.uk/forums/index.php?showtopic=18064&st=180
http://msmvps.com/blogs/spywaresucks/archive/2008/10/16/1650974.aspx
http://www.bluetack.co.uk/forums/index.php?showtopic=18064&st=120&p=88834&#entry88834
http://ddanchev.blogspot.com/2008/11/diverse-portfolio-of-fake-security_27.html
A Sagent Group was forced to hand over ownership of the domain "hillenbrandindustries.com" after failing to reply to Complainant's contentions:
http://www.wipo.int/amc/en/domains/decisions/html/2007/d2007-0503.html
"Sagent Hostmaster" implicated in malvertizement hijack leading to a pornographic web site, complete with streaming media on the opening page.
Back in December 2007 I wrote about a malvertizement that was appearing on mlb.com which was different to the norm because it did not redirect victims to a fraudware/fake security software site. Instead, it redirected victims to a pornographic web site, complete with streaming media. The incident is recorded here (and I still have a copy of the advertisement in question, and a video recording of the hijack incident, in my archives):
http://msmvps.com/blogs/spywaresucks/archive/2007/12/31/1428144.aspx
I still use the mlb.com incident when giving presentations about malvertizements - the risk environment that a business is exposed to changes for the worse when employees are exposed to pornography (especially pornography with sound and motion).
The pornographic domain was h q tube.com (white spaces interspersed in domain name). The WHOIS for that domain is:
ICANN Registrar: TLDS, LLC DBA SRSPLUS
Domain created: 14 August 2006
NS1, 2, 3, 4.SERVERFIELD.COM (hosting 20 domains)
IP: 88.85.66.116 - Utrecht, Webazilla
Registrant: Sagent Hostmaster (clenos@gmail.com)
Now we have yet another email address, clenos@gmail.com. A Clusty search for that email address reveals some interesting information, including an ICQ number and allegations of what looks like small time investment fraud:
http://clusty.com/search?input-form=clusty-simple&v%3Asources=webplus&query=%22clenos@gmail.com%22
