Anonymous_Coward

Posting anon, obvious reasons - can't link to pictures. Can some kind soul post them for me?

So today found this site, fastdownloadarchive.com - offering all the newest whatever, pirated, to download.

xs140.xs.to/xs140/09266/scam-1181.gif

Select something to download:
xs140.xs.to/xs140/09266/scam-2676.gif

'Payment page':
xs140.xs.to/xs140/09266/scam-3452.gif

Clicking the 'make payment link' pops up a new window - it's a NATS powered gateway page, processing with NetBilling - and no doubt, this is on the MID for a completely different site. Note the buried double cross sales, too.
xs140.xs.to/xs140/09266/scam-4992.gif

Logging the headers, we pull out the NATS code + Site Code -
So joins are being processed under the site 'Cam With Paris' - confirming the above - they're processing illegal downloads, via an unapproved site on a different MID (also illegal)
xs140.xs.to/xs140/09266/scam-5771.gif

And who is behind it all?
Typing in the domain https://join.elecbillpayment.com [also a fairly shady billing name]:
xs140.xs.to/xs140/09266/scam-6173.gif

Hello SlickCash.

Care to explain? No 'rouge affiliate' BS - the fastdownload page checks for Netbilling transaction IDS [and actually checks them, it doesn't accept other valid NB IDs] - so the site is definitely yours.

I can only imagine that TMM, NetBilling & your merchant (paygea) - not to mention Visa, MC and the authorities would be fascinated by what's going on here.

Park sigs below.