Money Mule Recruiters on Yahoo!'s Web Hosting

UPDATED: Saturday, March 13, 2010 - Yahoo! Web Hosting abuse just pinged me that "We have investigated the sites and taken the necessary action".

Just how dumb, or perhaps ingenious is a cybecriminal that would host his money mule recruitment operations using Yahoo!'s Web Hosting services? Is the reputable hosting location, worth the risk of having their campaigns taken down much easily than if there were hosting them on the bad reputation block, and would have never bothered replying to abuse notifications?

Whatever the motivation of the people behind this money mule recruitment campaign, they are currently using Yahoo! Web Hosting. Domains in question, including contact details:

 - Reed Financial Services - reed-fs.com - 68.180.151.74
555 11th St NW
Washington, DC 20004
Phone numbers:
(866) 863-6438
(202) 355-6678 (FAX)

- Stevens Financial Solutions - stevensfs.com - 98.136.50.138; 69.147.83.187; 69.147.83.188
Postal address:
Stevens Financial Solutions
Bahnhofstrasse 32
CH-8001 Zurich, Switzerland
Value Added Tax Nr.: 428 643

Phones and fax no's:
Phone: +41 (43) 219-2551
Fax 1: +41 (43) 219-2551
Fax 2: +1 (866) 703-7622 US Toll-Free

- Waters & Co. LLP - watersllp.com - 216.39.57.104
400 East Pratt Street,
Baltimore, MD 21202
United States
Phone numbers:
(443) 524-9221
(443) 524-9221 (FAX)

- Nilson Financial Solutions - nilson-fs.com - 98.136.92.76; 98.136.92.77; 98.136.92.78
Nilson Financial Solutions
Bahnhofstrasse 32
CH-8001 Zurich, Switzerland
Value Added Tax Nr.: 428 643

Phones and fax no's:
Phone: +41 (43) 219-2551
Fax 1: +41 (43) 219-2551
Fax 2: +1 (866) 472-0560 US Toll-Free

Upon submitting the personal details, the potential money mule is required to send a scanned copy of their ID or driving license:

• "Familiarize yourself with all clauses of the contract. Fill the contract and send us a scanned copy of it to the e-mail address info@watersllp.com or by fax: (443) 524-9221. The contract becomes valid from the moment of the reception of the correctly filled copy of the contract. You should be familiar with that the validity of the contract in the electronic form is completely identical to the contract signed at personal presence of both parties.* To pass the procedure of identity verification in order to prevent fraudulent registrations, you are required to send a scan of valid ID or a driving license to the e-mail: info@watersllp.com or by fax: (443) 524-9221. We guarantee full confidentiality of your personal information, more information on this matter you will find in our Privacy Policy PLEASE LET US KNOW BY EMAIL WHEN YOU WILL FAX BACK/EMAIL AS ATTACHEMENT THE CONTRACT AND APPLICATION FORM WITHIN 48 HOURS."

Yahoo!'s Web Hosting abuse team has been notified of the campaigns, and will nuke the offline a.s.a.p

Related coverage of money laundering in the context of cybercrime:
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

AS50215 Troyak-as Taken Offline, Zeus C&Cs Drop from 249 to 181

2nd update for Friday, March, 12, 2010 - Troyak-AS is down again - "This AS is not currently used to announce prefixes in the global routing table, nor is it used as a visible transit AS."

UPDATED: Friday, March, 12, 2010 - Troyak-AS peering courtesy of AS25189 - NLINE-AS JSC Nline. Since the entire Troyak-as takedown campaign is turning into an infinite loop, it's time for a "terminating condition".

2nd update for Thursday, March 11, 2010: Troyak-AS is back from the dead. Upstream courtesy of AS8342 - RTCOMM-AS RTComm.RU Autonomous System. The good news? Troyak's Zeus C&Cs are still offline.

UPDATED: Thursday, March 11, 2010 - TROYAK-AS Starchenko Roman Fedorovich is dead again - "This AS is not currently used to announce prefixes in the global routing table, nor is it used as a visible transit AS."

UPDATED: Troyak-as is now AS44051 YA-AS Professional Communication Systems.

AS50215 Troyak-as, the cybercrime-friendly virtual neighborhood that was a key component in the hosting infrastructure for all of the Zeus-crimeware serving campaigns during Q1 of 2010, has been taken offline, resulting in a pretty evident drop in Zeus C&Cs, according to this graph courtesy of the ZeusTracker.

AS50215 Troyak-as (ctlan.net; prombd.net) was of course the tip of the iceberg, directly or indirectly interacting with the following ASs:

• AS31366 - smallshop-as Stebluk Vladimir Vladimirovich 
• AS44107 - PROMBUDDETAL-AS Prombuddetal LLC 
• AS50369 - VISHCLUB-as Kanyovskiy Andriy 
• AS49934 - VVPN-AS PE Voronov Evgen Sergiyovich 
• AS47560 - VESTEH-NET-as Vesteh LLC

Don't pop the corks just yet, their customers, in particular their money mule recruitment customers are already migrating to the competition.

From a cybercriminal's perspective, such minor operational glitches don't undermine the business model. Sadly, it's more cost-effective to build a new botnet, compared to trying to gain access to the old one. What truly undermines their business model is their inability to utilize the monetization vector.

AS50215 TROYAK-AS Starchenko Roman Fedorovich activity during Q1, 2010:
Outlook Web Access Themed Spam Campaign Serves Zeus Crimeware
Pushdo Serving Crimeware, Client-Side Exploits and Russian Bride Scams
PhotoArchive Crimeware/Client-Side Exploits Serving Campaign in the Wild
Tax Report Themed Zeus/Client-Side Exploits Serving Campaign in the Wild
Keeping Money Mule Recruiters on a Short Leash - Part Two

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Don't Play Poker on an Infected Table - Part Three

The monetization of phony online gambling networks -- clearly tolerating systematic violation of their TOS -- is continuing with the scammers behind last month's campaign (Don't Play Poker on an Infected Table - Part Two) spamvertising another portfolio of domains using new templates.

It's worth pointing out that the spammers don't just earn revenue every time someone installs the application, but also, every time the, now converted visitor, interacts financially with the service, a monetization approach you'll see in the attached screenshots.

Detection rates for the spamvertised binaries (downloaded from gamez-lux.com and we3tt.com) : StarsVIPCasino_Setup.exe - Result: 14/42 (33.33%); GoldenMummyEN.exe - Result: 9/42 (21.43%); RubyRoyaleEN.exe - Result: 11/42 (26.19%). Sample phone back locations: download.thepalacegroupgaming.com; pcm3.valueactive.eu; rubyfortune.mgsmup.com

Spamvertised domains include:
adrembovesttes.net - Email: pengjiajie222@163.com
bonuscasinoslux.net - Email: fgsdvbbvd@qq.com
bonusgameslux.net - Email: fgsdvbbvd@qq.com
bonusluxcasinos.net - Email: fgsdvbbvd@qq.com
bonusluxplays.net - Email: fgsdvbbvd@qq.com
bonusplayslux.net - Email: fgsdvbbvd@qq.com
casinosbonuslux.net - Email: fgsdvbbvd@qq.com
casinosluxclub.net - Email: fgsdvbbvd@qq.com
casinosluxstar.net - Email: fgsdvbbvd@qq.com
clopelinesutes.net - Email: fgsdvbbvd@qq.com
clubgameslux.net - Email: fgsdvbbvd@qq.com
clubluxgames.net - Email: fgsdvbbvd@qq.com
club-of-lux.net - Email: fgsdvbbvd@qq.com
clubs-play.net - Email: fgsdvbbvd@qq.com
clubvegas-games.net - Email: fgsdvbbvd@qq.com
gameclubviva.net - Email: fgsdvbbvd@qq.com
game-lux-club.net - Email: fgsdvbbvd@qq.com
gamesbonuslux.net - Email: fgsdvbbvd@qq.com
games-gold.net - Email: fgsdvbbvd@qq.com
gameslux.net - Email: fgsdvbbvd@qq.com
gamesstarlux.net - Email: fgsdvbbvd@qq.com
gamevivagold.net - Email: fgsdvbbvd@qq.com
gorxshop.net - Email: sdfxckj@msn.com
hannoweramtes.net - Email: ftyughsere@qq.com
lutiok.net - Email: ftgy23fge@126.com
luxbonusgames.net - Email: fgsdvbbvd@qq.com
luxbonusplays.net - Email: fgsdvbbvd@qq.com
luxcasinosbonus.net - Email: fgsdvbbvd@qq.com
luxclubcasinos.net - Email: fgsdvbbvd@qq.com

luxclubplays.net - Email: fgsdvbbvd@qq.com
luxgamesbonus.net - Email: fgsdvbbvd@qq.com
luxgamesstar.net - Email: fgsdvbbvd@qq.com
luxplaysclub.net - Email: fgsdvbbvd@qq.com
luxplaysstar.net - Email: fgsdvbbvd@qq.com
luxs-games.net - Email: fgsdvbbvd@qq.com
luxstarplays.net - Email: fgsdvbbvd@qq.com
mollehoukutes.net - Email: guoaiwense@163.com
murgadobarotes.net - Email: guoaiwense@163.com
namedosaras.net - Email: ftyughsere@qq.com
pay3500win.net - Email: dfgdvbcv@sina.com
playeuro777.net - Email: fghvvbcfgds@tom.com
playeuro888.net - Email: fghvvbcfgds@tom.com
playglobal777.net - Email: dfhhjg4ee@163.com
playsclublux.net - Email: fgsdvbbvd@qq.com
playsluxclub.net - Email: fgsdvbbvd@qq.com
realcash-mine.net - Email: dfgdvbcv@sina.com
realcash-offer.net - Email: dfgdvbcv@sina.com
realcash-wins.net - Email: dfgdvbcv@sina.com
regal-jackpot.net - Email: dfgdvbcv@sina.com
regalvegas-online.net - Email: dfgdvbcv@sina.com
royalcasino777.net - Email: edwfrsdf@126.com
royalcasino888.net - Email: edwfrsdf@126.com
royalvegas-play.net - Email: dfgdvbcv@sina.com
satregonovates.net - Email: pengjiajie222@163.com
softaserutes.net - Email: ftyughsere@qq.com
softoutnertes.net - Email: ftyughsere@qq.com
softuoplowtes.net - Email: ftyughsere@qq.com
stargameslux.net - Email: ftyughsere@qq.com
starluxcasinos.net - Email: ftyughsere@qq.com
sundowutortes.net - Email: guoaiwense@163.com
vegasclubsgame.net - Email: fgsdvbbvd@qq.com
vegasgamesclub.net - Email: fgsdvbbvd@qq.com

Sample monetization in action:

Phony affiliate networks are reserve the right to forward the responsibility for the malicious activity to participants violating their Terms or Service. A violation that earned both parties significant amounts of money, in between

The "don't play poker on an infected table" series are prone to expand.

Related posts:
Don't Play Poker on an Infected Table - Part Two
Don't Play Poker on an Infected Table
Malware Serving Online Casinos

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Summarizing Zero Day's Posts for February

The following is a brief summary of all of my posts at ZDNet's Zero Day for February, 2010. You can also go through previous summaries, as well as subscribe to my personal RSS feed, Zero Day's main feed, follow me or all of ZDNet's blogs on Twitter.

Recommended reading - Reports: SQL injection attacks and malware led to most data breaches; Report: Malicious PDF files comprised 80 percent of all exploits for 2009 and 10 things you didn't know about the Koobface gang

01. Does Blippy really pose a security risk? 
02. Reports: SQL injection attacks and malware led to most data breaches
03. Scammers phishing for sensitive iPhone data
04. Report: Malicious PDF files comprised 80 percent of all exploits for 2009
05. The Kneber botnet - FAQ
06. 10 things you didn't know about the Koobface gang

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Fotolog's FTLog Malware Campaign Serves Bogus Video Codecs

Don't Play Poker on an Infected Table - Part Two

Over the past week and a half, cybercriminals have been aggressively spamvertising a growing portfolio of domains, relying on deceptive advertising for nonexistent and fraudulent online gambling web sites, serving the well known Win32.GAMECasino.

• Go through related posts: Don't Play Poker on an Infected Table; Malware(Client-Side Exploits) Serving Online Casinos

What's particularly interesting about the campaign, is the fact that all of the domains serve identical template, with the SmartDownload.exe binary hosted "in the cloud" thanks to Amazon's Web Services (anat.s3.amazonaws.com/dir4/ SmartDownload.exe).

Detecting rate for SmartDownload.exe - Win32.GAMECasino - Result: 10/42 (23.81%). Sample phones back the following domain - download.realtimegaming.com /cdn/goldvipclub/package_list.ini.zip?fakeParam=1 - 212.201.100.144 - Email: admin@REALTIMEGAMING.COM; RealTime Gaming Holding Company, LLC, registered under the following address according to the information published on their web site:

• For Licensing opportunities or Company Information,please submit request to Hasting B.V. Click Here.Hastings International B.V.New Haven Office CenterEmancipatie Boulevard 31 – P.O. Box 6052Curacao Netherlands Antilles

Here are the spavertised domains in question, including the name servers involved.

Spamvertised domains parked on 116.123.221.17; 112.159.237.58:
aerojackpot.net - Email: dfgdfgvcsx12@foxmail.com
compujackpot.net - Email: dfgdfgvcsx12@foxmail.com
jackpotadvance.net - Email: dfgdfgvcsx12@foxmail.com
jackpotalist.net - Email: dfgdfgvcsx12@foxmail.com
jackpotbee.net - Email: dfgdfgvcsx12@foxmail.com
jackpotbuzz.net - Email: dfgdfgvcsx12@foxmail.com
jackpotcanyon.net - Email: dfgdfgvcsx12@foxmail.com
jackpotclubs.net - Email: dfgdfgvcsx12@foxmail.com
jackpotfairy.net - Email: dfgdfgvcsx12@foxmail.com
jackpotfan.net - Email: dfgdfgvcsx12@foxmail.com
jackpotflag.net - Email: dfgdfgvcsx12@foxmail.com
jackpoticity.net - Email: dfgdfgvcsx12@foxmail.com
jackpotjets.net - Email: dfgdfgvcsx12@foxmail.com
jackpotlodge.net - Email: dfgdfgvcsx12@foxmail.com
jackpotlodge.net - Email: dfgdfgvcsx12@foxmail.com
jackpotmoment.net - Email: dfgdfgvcsx12@foxmail.com
jackpotpair.net - Email: dfgdfgvcsx12@foxmail.com
jackpotrocket.net - Email: dfgdfgvcsx12@foxmail.com
jackpotthink.net - Email: dfgdfgvcsx12@foxmail.com
jackpottodoor.net - Email: dfgdfgvcsx12@foxmail.com
jackpotwire.net - Email: dfgdfgvcsx12@foxmail.com
jacpotcongress.net - Email: dfgdfgvcsx12@foxmail.com
linejackpot.net - Email: dfgdfgvcsx12@foxmail.com
lux777cazino.net - Email: efghfgbvghfgh@qq.com
majicjackpot.net - Email: dfgdfgvcsx12@foxmail.com
midjackpot.net - Email: dfgdfgvcsx12@foxmail.com
mixerjackpot.net - Email: dfgdfgvcsx12@foxmail.com
needjackpot.net - Email: dfgdfgvcsx12@foxmail.com
nestjackpot.net - Email: dfgdfgvcsx12@foxmail.com
shopjackpot.net - Email: dfgdfgvcsx12@foxmail.com
smart-nest.net - Email: dfgdsfvcb@163.com
structjackpot.net - Email: dfgdfgvcsx12@foxmail.com
the-cash.net - Email: dfgdsfvcb@163.com
thejackpots.net - Email: dfgdfgvcsx12@foxmail.com
windowjackpots.net - Email: dfgdfgvcsx12@foxmail.com
win-vox.net - Email: dfgdsfvcb@163.com

aerowin.net - Email: dfgdsfvcb@163.com
beach-jackpot.net - Email: dfgdsfvcb@163.com
beautyselite.net - Email: dfgdsfvcb@163.com
binwin.net - Email: dfgdsfvcb@163.com
clashflash.net - Email: dfgdsfvcb@163.com
couldwin.net - Email: dfgdsfvcb@163.com
dinwin.net - Email: dfgdsfvcb@163.com
eliteclasss.net - Email: dfgdsfvcb@163.com
eliteorder.net - Email: dfgdsfvcb@163.com
eliteplaza.net - Email: dfgdsfvcb@163.com
elitescoop.net - Email: dfgdsfvcb@163.com
eliteweird.net - Email: dfgdsfvcb@163.com
ezelite.net - Email: dfgdsfvcb@163.com
flashapex.net - Email: dfgdsfvcb@163.com
flashbrook.net - Email: dfgdsfvcb@163.com
flashbuzzs.net - Email: dfgdsfvcb@163.com
flashcensus.net - Email: dfgdsfvcb@163.com
flashclashs.net - Email: dfgdsfvcb@163.com
flashlasch.net - Email: dfgdsfvcb@163.com
flashlash.net - Email: dfgdsfvcb@163.com
flashmoment.net - Email: dfgdsfvcb@163.com
flashnest.net - Email: dfgdsfvcb@163.com
flashpixie.net - Email: dfgdsfvcb@163.com
flashslash.net - Email: dfgdsfvcb@163.com
flashspark.net - Email: dfgdsfvcb@163.com
flashspell.net - Email: dfgdsfvcb@163.com
flashzap.net - Email: dfgdsfvcb@163.com
free-smart.net - Email: dfgdsfvcb@163.com
ginwin.net - Email: dfgdsfvcb@163.com

goingtowins.net - Email: dfgdsfvcb@163.com
hitecwinner.net - Email: dfgdsfvcb@163.com
innerwinner.net - Email: dfgdsfvcb@163.com
interelite.net - Email: dfgdsfvcb@163.com
jackpot-direct.net - Email: dfgdsfvcb@163.com
jackpot-fire.net - Email: dfgdsfvcb@163.com
jackpot-help.net - Email: dfgdsfvcb@163.com
jackpot-infinity.net - Email: dfgdsfvcb@163.com
jackpot-mind.net - Email: dfgdsfvcb@163.com
jackpot-minute.net - Email: dfgdsfvcb@163.com
jackpot-phone.net - Email: dfgdsfvcb@163.com
jackpot-reunion.net - Email: dfgdsfvcb@163.com
jackpot-senate.net - Email: dfgdsfvcb@163.com
jackpot-talk.net - Email: dfgdsfvcb@163.com
jackpot-taven.net - Email: dfgdsfvcb@163.com
jackpot-topia.net - Email: dfgdsfvcb@163.com
jackpot-wire.net - Email: dfgdsfvcb@163.com
laschflash.net - Email: dfgdsfvcb@163.com
learn-jackpot.net - Email: dfgdsfvcb@163.com
magicwinner.net - Email: dfgdsfvcb@163.com
mapwinner.net - Email: dfgdsfvcb@163.com
mediaselite.net - Email: dfgdsfvcb@163.com
mindelite.net - Email: dfgdsfvcb@163.com
mrelite.net - Email: dfgdsfvcb@163.com
needwin.net - Email: dfgdsfvcb@163.com
pixiewinner.net - Email: dfgdsfvcb@163.com
powerwinners.net - Email: dfgdsfvcb@163.com

predict-jackpot.net - Email: dfgdsfvcb@163.com
pushelite.net - Email: dfgdsfvcb@163.com
reseachelite.net - Email: dfgdsfvcb@163.com
sellelite.net - Email: dfgdsfvcb@163.com
sgameelite.net - Email: dfgdsfvcb@163.com
sharpwinner.net - Email: dfgdsfvcb@163.com
smart-enough.net - Email: dfgdsfvcb@163.com
smart-fire.net - Email: dfgdsfvcb@163.com
smart-log.net - Email: dfgdsfvcb@163.com
smart-nest.net - Email: dfgdsfvcb@163.com
smart-spree.net - Email: dfgdsfvcb@163.com
steelites.net - Email: dfgdsfvcb@163.com
surveylite.net - Email: dfgdsfvcb@163.com
targetelite.net - Email: dfgdsfvcb@163.com
theelites.net - Email: dfgdsfvcb@163.com
theflashers.net - Email: dfgdsfvcb@163.com
theywin.net - Email: dfgdsfvcb@163.com
velowinner.net - Email: dfgdsfvcb@163.com
vote-smart.net - Email: dfgdsfvcb@163.com
wanttowin.net - Email: dfgdsfvcb@163.com
winbot.net - Email: dfgdsfvcb@163.com
winnercrest.net - Email: dfgdsfvcb@163.com
winnerfast.net - Email: dfgdsfvcb@163.com
winnerhut.net - Email: dfgdsfvcb@163.com
winnerincumbent.net - Email: dfgdsfvcb@163.com
winnermass.net - Email: dfgdsfvcb@163.com
winnerpub.net - Email: dfgdsfvcb@163.com
winnerrocket.net - Email: dfgdsfvcb@163.com
winnersalon.net - Email: dfgdsfvcb@163.com
winnerscan.net - Email: dfgdsfvcb@163.com
winnertake.net - Email: dfgdsfvcb@163.com
winnertal.net - Email: dfgdsfvcb@163.com
winnertoyou.net - Email: dfgdsfvcb@163.com
zap-smart.net - Email: dfgdsfvcb@163.com

Name servers of notice:
ns1.bb6ns.com - 58.83.8.45 - Email: li-zhenshu@163.com
ns1.bedws.com - 218.61.126.28 - Email: guoxiufenghy@163.com
ns1.catdogns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns1.cebht.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns1.dd5ns.com - 61.191.191.61 - Email: li-zhenshu@163.com
ns1.dogmens.com - 208.78.242.185 - Email: hmr@data99.com
ns1.euromarketorder.com - 218.61.126.28
ns1.fesws.com - 218.61.126.28 - Email: info2@data99.com
ns1.goatdns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns1.hh7ns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns1.kindball.com - 218.61.126.28 - Email: zhaokaijunlp@163.com
ns1.mm8ns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns1.nn4ns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns1.ss6ns.com - 61.191.191.61 - Email: shirley9127@hotmail.com
ns1.wildnn.com - 208.78.242.185 - Email: hmr@data99.com
ns2.gg9ns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns2.sruisorehoes.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns2.zz8ns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns3.bavns.com - 218.61.126.28 - Email: shirley9127@hotmail.com
ns3.bawns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns3.becns.com - 218.61.126.28 - Email: li-zhenshu@163.com
ns3.bojns.com - 218.61.126.28 - Email: li-zhenshu@163.com

The campaign is a great example of cybercrime-friendly affiliate networks, with the cybercriminals in this case investing a modest amount of money for the actual spamming process, and then earning 30% flat rate, which can also be scaling between 20% to 45% depending on their choice.

The practice has been around for years. Here are three monetizations strategies seeing within the last two years, all of which remain an active tactic for fraudsters to take advantage of:

• Brandjacking and monetizing through pseudo-value added crapware applications- this practice has been profiled in a previous analysis "Cybersquatting Security Vendors for Fraudulent Purposes". PandaSecurity's reaction back then? Immediate notification of their legal department.
• SMS micro-payment scams through typosquatting and brandjacking - this tactic has already been profiled in "Legitimate Software Typosquatted in SMS Micro-Payment Scam" analysis. Compared to the typosquatting in the previous scheme, this campaign was monetizing freely available software.
• Abuse of legitimate affiliate networks - In January, 2009, I profiled and took down a campaign that has typosquatted domains for popular applications and was advertising them through Google's AdSense in an attempt to earn money from a legitimate affiliate network - Conduit's Rewards Program. The abuse of these networks can be easily taken care of, since the cybercriminal that's violating their Terms of Service is exposing himself as a legitimate user, with his very own CampaignID.

You may want to reconsider using an online gambling application that's being spammed using a botnet, with the actual application crypted using a tool exclusively used by malware authors in an attempt to bypass signatures based antivirus scanning.

Amazon's Web Services are aware of this campaign. Action against it should be taken shortly.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.