Carders and Video Pirates?

Sometimes criminals have interesting neighbors. After my post earlier this week discussing Russian Cyber criminals and their conversations about the CardingWorld arrests, I was surprised to see that the top site for making referrals to my blog was "carder.su". (Similarly after the Sun-Army story, the top city for visitors to my blog was Tehran!)

I thought I would take a moment to see where the carder.su folks were hosted and see what else was there, since they decided to call such attention to themselves.

carder.su = 91.213.175.24

If you aren't an established cybercriminal, they recommend that you use their sister site, carder.biz, which is for 'the general public'. Carder.biz is hosted on the same network.

carder.biz = 91.213.175.67

carder.biz is exactly what it sounds like - a place for their 14,000 members to have open conversations about the practice of stealing credit card and banking information from Westerners and turning that information into money.

Antiddos.eu = 91.213.175.130

This site offers, for a fee of $110 per month ($305 per month for large businesses) to protect you against having your company DDOS'ed. Given that this class C subnet is covered with criminals, I believe this is probably similar to paying a fee to prevent your kneecaps from being broken.

We asked NetCraft to tell us what the most popular sites on this Class C subnet were

NetCraft report for 91.213.175.0/24

and it gave us back this list:

443 = kino.to
676 = www.kino.to
6529 = kinozal.tv
19895 = www.panamoney.net
91446 = carder.su
94111 = vskachke.com
191098 = giga-files.net
248392 = verified.su
259548 = www.vaultinvestment.com
302835 = vskachke.info
748059 = 91.213.175.226
1232775 = carder.biz
1539852 = happysex.ch

Now, please take a minute to let this sink in. Those numbers are saying that a tiny little network block in the Ukraine, which is hosting Russian cybercriminal websites including Verified.su, Carder.su, PanaMoney.net, and Carder.biz is also hosting the 443rd most popular site on the Internet.

Panamoney is a "Forex" currency exchange system, hosted in Panama despite having a Ukrainian IP address. (Shades of Russian Business Networks!) Panamoney has managed currency trading funds where there experts can earn you between .5% and 2.8% interest per day. You'll happy to know that "PanaMoney guarantees your investment and profits are safe as PanaMoney Safety Fund has the required insurance coverage to provide a reliable client protection from any losses."

Note that the hosting has shifted back and forth between this network and another - "Protected Solutions, Ltd." on 92.241.173.0/24 ... see their hosting history report here:

http://toolbar.netcraft.com/site_report?url=http://kino.to

What other sites have that sort of popularity. Really - to be in the Top 500 Internet Sites on the planet, what would you have to be doing. Here are some of their neighbors on that ratings chart:

#412 = Chase Bank - www.chase.com
#414 = USA Today - www.usatoday.com
#426 = WalMart - www.walmart.com
#440 = Apple Store - store.apple.com
#443 - kino.to - kino.to
#465 = Yahoo! Groups - groups.yahoo.com
#466 = VMWare - www.vmware.com
#468 - Microsoft Office - office.microsoft.com
#488 - LinkedIn - www.linkedin.com

So, what sort of activity is going on at Kino.To that justifies having more visitors than Microsoft Office, Yahoo Groups, VMWare and LinkedIn? That puts them within a short reach as having as many visitors as USA Today, WalMart, and Chase Bank? (WalMart.com receives more than 30 million visits per month. What could possibly cause kino.to to be ranked that highly?)

FREE ILLEGAL MOVIES!

Actually, Kino.to is very direct in stating that they don't actually host any movies. Like the controversial "ThePirateBay", they provide links to places where you can download movies and television shows, currently hosting 80,000 movie links and 399,000 television show links. Whether the movie is "legal" doesn't seem to matter to them, as indicated by downloads of Sherlock Holmes, Strictly Sexual, The Twilight Saga: New Moon, etc. But there certainly seems to be a large number of people happy to join them in ignoring the law and downloading the movies.

They've helped 3.6 million people watch "Twilight New Moon" already.

They also don't seem to care if they movie has actually been released to DVD. 65,000 people have already watched "Kick-Ass" through their service, and more than 280,000 have watched "Clash of the Titans" with their help.

The real numbers though come on their television series . . .

93,524,000 downloads for Scrubs
72,657,000 downloads for Two and a Half Men
54,700,000 downloads for The Simpsons
etc.

Lots of folks watch television via the Internet. I wonder what the tie is between the credit card thieves and malware hosters on this network and the millions of visitors who use their service to watch movies. . .

Why do I not get a safe warm and fuzzy feeling to know that one of the busiest movie watching sites on the Internet has such stellar neighbors? Maybe they don't distribute malware. Maybe the fact they do porn pop-up advertisement to a site such as "mydirtyhobby.com" is enough revenue that they don't need to infect you with malware.

Be careful out there, net surfers!