Money Mule

Keeping Money Mule Recruiters on a Short Leash – Part Eleven

29 Aug 2011 By Dancho Danchev

The following intelligence brief is part of the Keeping Money Mule Recruiters on a Short Leash series. In it, I’ll expose currently active money mule recruitment domains, their domain registration details, currently responding IPs, and related ASs. Money mule recruitment domains: ACWOODE-GROUP.COM – 78.46.105.205 – Email: admin@acwoode-group.com    ACWOODE-GROUP.NET – 78.46.105.205 – Email: admin@acwoode-group.net ART-GAPSON.COM –Read More

Keeping Money Mule Recruiters on a Short Leash – Part Ten

07 Jul 2011 By Dancho Danchev

The following intelligence brief is part of the Keeping Money Mule Recruiters on a Short Leash series. In it, I’ll expose currently active money mule recruitment domains, their domain registration details, currently responding IPs, and related ASs. Currently active money mule recruitment domains: ACWOODE-GROUP.COM – 184.168.64.173 – Email: admin@acwoode-group.com ACWOODE-GROUP.NET – 184.168.64.173 – Email: admin@acwoode-group.netRead More

Keeping Money Mule Recruiters on a Short Leash – Part Nine

30 May 2011 By Dancho Danchev

The following brief summarizes currently active money mule recruitment web sites, actively recruiting money mules for the processing of fraudulently obtained funds. Currently active sites residing within AS42708, PORTLANE Network www.portlane.com; AS29713, INTERPLEXINC Interplex LLC; AS38913, Enter-Net-Team-AS; AS24940, HETZNER-AS Hetzner Online: ATLANTALTD-UK.CC – 193.105.134.233 ATLANTA-LTD-UK.NET – 78.46.105.205 – Email: admin@atlanta-ltd-uk.net 3ATLANTA-UK.COM – 193.105.134.233 BLITZNET-GROUPINC.CC –Read More

Keeping Money Mule Recruiters on a Short Leash – Part Eight – Historical OSINT

25 May 2011 By Dancho Danchev

With money mule recruitment scams continuing to represent an inseparable part of the cybercrime ecosystem, in this post I’ll summarize the findings from an assessment I conducted on currently active mule recruitment scams over a month ago. As always, the historical OSINT offered is invaluable in case-building practices in particular a very well segmented groupRead More

Keeping Money Mule Recruiters on a Short Leash – Part Six

10 Mar 2011 By Dancho Danchev

Following my previous post on “Keeping Money Mule Recruiters on a Short Leash – Part Five“, in this post we’re once again going to expose a portfolio of money mule recruitment domains, their related ASs and name servers of notice, including some additional SpyEye activity within one of the ASs. What’s particularly interesting is theRead More

Keeping Money Mule Recruiters on a Short Leash – Part Five

31 Jan 2011 By Dancho Danchev

With money mule recruitment continuing to represent the most actively used risk-forwarding tactic within the cybercrime ecosystem for the purpose of securely distribution fraudulently obtained funds, part five of the “Keeping Money Mule Recruiters on a Short Leash” series are here to stay. What’s particularly interesting about the money mule recruitment domain portfolio that I’llRead More

Money Mule Recruitment Campaign Serving Client-Side Exploits

30 Mar 2010 By Dancho Danchev

Remember Cefin Consulting & Finance, the bogus, money mule recruitment company that ironically tried to recruit me last month? They are back, with a currently ongoing money mule recruitment campaign, this time not just attempting to recruit gullible users, but also, serving client-side exploits (CVE-2009-1492; CVE-2007-5659) through an embedded javascript on each and every pageRead More

Dissecting an Ongoing Money Mule Recruitment Campaign

12 Feb 2010 By Dancho Danchev

Money mule recruiters can be sometimes described as mass-marketing zombies, who have absolutely no idea who they’re trying to recruit. Cefin Consulting & Finance – cefincf .com – 195.190.13.106 – Email: flier@infotorrent.ru is the very latest example of such a campaign, trying to recruit, well, me. The initial recruitment email was spammed from maximumsxz78@roulottesste-anne.com withRead More

How the Koobface Gang Monetizes Mac OS X Traffic

02 Feb 2010 By Dancho Danchev

Mac users appear to have a special place in the heart of the Koobface gang, since they’ve recently started experimenting with a monetization strategy especially for them – by compromising legitimate sites for the sole purpose of embedding them with the popular PHP backdoor shell C99 (Synsta mod), in an attempt to redirect all theRead More

The Koobface Gang Wishes the Industry “Happy Holidays”

26 Dec 2009 By Dancho Danchev

Oops, they did it again – the Koobface gang, which is now officially self-describing itself as Ali Baba and the 40 Thieves LLC, has not only included a Koobface-themed — notice the worm in the name — background on Koobface-infected hosts, but it has also included a “Wish Koobface Happy Holidays” script — last timeRead More

Unit-123.org E-shop Owner Information

Who is Dancho Danchev?

Unit-123.org

Focused on delivering daily batches of personally-produced never-ending supply of high-quality and never-published and released before classified and sensitive Intelligence Deliverables.

Latest Products