Posting anon, obvious reasons - can't link to pictures. Can some kind soul post them for me?
So today found this site, fastdownloadarchive.com - offering all the newest whatever, pirated, to download.
xs140.xs.to/xs140/09266/scam-1181.gif
Select something to download:
xs140.xs.to/xs140/09266/scam-2676.gif
'Payment page':
xs140.xs.to/xs140/09266/scam-3452.gif
Clicking the 'make payment link' pops up a new window - it's a NATS powered gateway page, processing with NetBilling - and no doubt, this is on the MID for a completely different site. Note the buried double cross sales, too.
xs140.xs.to/xs140/09266/scam-4992.gif
Logging the headers, we pull out the NATS code + Site Code -
So joins are being processed under the site 'Cam With Paris' - confirming the above - they're processing illegal downloads, via an unapproved site on a different MID (also illegal)
xs140.xs.to/xs140/09266/scam-5771.gif
And who is behind it all?
Typing in the domain https://join.elecbillpayment.com [also a fairly shady billing name]:
xs140.xs.to/xs140/09266/scam-6173.gif
Hello SlickCash.
Care to explain? No 'rouge affiliate' BS - the fastdownload page checks for Netbilling transaction IDS [and actually checks them, it doesn't accept other valid NB IDs] - so the site is definitely yours.
I can only imagine that TMM, NetBilling & your merchant (paygea) - not to mention Visa, MC and the authorities would be fascinated by what's going on here.
Park sigs below.
So today found this site, fastdownloadarchive.com - offering all the newest whatever, pirated, to download.
xs140.xs.to/xs140/09266/scam-1181.gif
Select something to download:
xs140.xs.to/xs140/09266/scam-2676.gif
'Payment page':
xs140.xs.to/xs140/09266/scam-3452.gif
Clicking the 'make payment link' pops up a new window - it's a NATS powered gateway page, processing with NetBilling - and no doubt, this is on the MID for a completely different site. Note the buried double cross sales, too.
xs140.xs.to/xs140/09266/scam-4992.gif
Logging the headers, we pull out the NATS code + Site Code -
So joins are being processed under the site 'Cam With Paris' - confirming the above - they're processing illegal downloads, via an unapproved site on a different MID (also illegal)
xs140.xs.to/xs140/09266/scam-5771.gif
And who is behind it all?
Typing in the domain https://join.elecbillpayment.com [also a fairly shady billing name]:
xs140.xs.to/xs140/09266/scam-6173.gif
Hello SlickCash.
Care to explain? No 'rouge affiliate' BS - the fastdownload page checks for Netbilling transaction IDS [and actually checks them, it doesn't accept other valid NB IDs] - so the site is definitely yours.
I can only imagine that TMM, NetBilling & your merchant (paygea) - not to mention Visa, MC and the authorities would be fascinated by what's going on here.
Park sigs below.
BUY MY SIG - 50$/Year
Comment