Qurium has traced a global web scraping campaign to POPA, a residential proxy network hidden inside consumer devices including your smart TV Read the press release: www.qurium.org/press-releas...

[PRESS RELEASE] Who is scraping public interest journalism and why is the infrastructure so hard to trace? Qurium's latest investigation exposes opaque scraping networks revealing the hidden actors operating behind large scale data collection. Read more: www.qurium.org/press-releas...

Just posted. Quantum AI investments are not a scam. Meta 💸💳 #scamempire https://www.facebook.com/reel/654852003661912

Get ready for the "Big bash" #scamempire

Ten years ago Boaelite (now Affilomania/Trafficon) published this video. What has really change at the #scamempire?

Coming soon... #scamempire

Landing pages used by affiliates of the #scamempire

Tonight watch #scamempire

“By turning over the material to the media, I/we hope this issue gets enough attention for authorities to take action against these criminals. This problem is not impossible to solve. We all just need to care enough to do something about it.” - Source of the leak of #scamempire

Scam call centers are destroying lives across the world. Now we’re putting the spotlight on them. Coming soon… #ScamEmpire

"When Kehr meets Vextrio" shows how dating scams and disinformation use a common infrastructure. https://www.qurium.org/forensics/when-kehr-meets-vextrio/ (1/4) 👇

Yesterday, Bullet Proof Hosting provider sclad{.}us aka Morningstars (AS215939) connected to UAC-0050 (CERT-UA#8453 and CERT-UA#8494 Alerts) announced "technical works" as their main upstream drop them.

One month after the release of our Doppelganger investigation and the shutdown of Aeza at Datacamp, the ASNs that made it to the finish line have migrated to @packetbouncer @aurologiccom and @RoyaleHostingBV @stanvandeklippe Many prefixes remain behind GRE tunnels.

The power of CSI (194.36.177{.}229) server of 1cent{.}host runs in AS210281. Can you figure out where do the GRE tunnels of this BPH terminate? @banthisguy9349

MTU1448 update: Doppelganger Prefix sneaking away from Aurologic upstream to AS214891. Prefix now using AS56630 Melbikomas (LT) as upstream in Germany. route: 77.91.66.0/24 origin: AS214891 mnt-by: CENTHOST-MNT last-modified: 2024-08-02T09:47:27Z

The answer is 1448. In a standard setup the maximum payload for a ICMP packet will be 1472 bytes (1500-20-8). 28 bytes for the IP (20) and ICMP (8) headers. If you run GRE tunnels, you need to account for a 24 extra bytes overhead for Outer IP(20) and GRE(4). 1500-20-8-20-4=1448

Yesterday, AS198981 (netshield/1centhost) continued to serve Doppelganger domains but this time with @packetbouncer (Aurologic) as upstreams. This is not the kind of blocking we were expecting from you.

This is why we think that Lethost bullet proof hosting that run DG is NOT just a costumer of Aeza (1/x)

Suspended Cyberhub ASN that is part of the Doppelganger ecosystem has been just renamed to HellaAS (Hellenic Digital Services Ltd / Luxhost). Seems like "luxhost" is the new Aeza bullet proof hoster. 🤦 @Gi7w0rm @banthisguy9349 @SourcesOuvertes

In a new twist in the saga of Doppelganger, Aeza has decided to stop providing connectivity to two bullet proof hosters: Lethost and Sunhost. What a nice way to show the world that they handle "abuse". (1/3)

Since the release of our forensic investigation about Doppelganger infrastructure there has been a few interesting developments. Once of them is that the F-domains @ TNSECURITY and NETSHIELD remain online thanks to one common upstream provider: Datacamp/CDN77

It seems that TNSECURITY/EVILEMPIRE is no longer routing traffic from Germany. Nice to have now a much clear picture of where Lethost is coming from

Impressed of their setup or our report? Maybe both? @cymnu https://t.co/Ds8gNGobjK

Hostinger today, DNS parking the F domains of DG. bikerspace[.]shop btwidea[.]shop cscerbr[.]shop envhb[.]shop summitslope[.]shop vokei[.]shop

TNSecurity (aka Evilempire) is interesting for 4 things: - Runs from Germany as downstream of @packetbouncer - Runs front proxies for Doppelganger - It is a hotspot of malware distribution - It was a "dorector" @Gi7w0rm @ffforward @banthisguy9349

Let us check of few domains of DG campaign today that were registered with Namecheap and then moved to Hostinger DNS parking service. The service has been provided for months and tje domains have been pointed to: AS215428 Mykyta Skorobohatko RU AS216309 Tnsecurity Ltd RU

Just a couple of hours ago, all these domains has been used by Doppelganger. All controlled from: - Hostinger DNS Parking service and - Served from "Evilempire" downstream of Aurologic in Germany.

Today, we make public our latest research on Doppelganger. https://www.qurium.org/alerts/russia/exposing-the-evil-empire-of-doppelganger-disinformation/

Meet Ben Rose from Supreme Media (Amashen) that runs "regulated financial traffic". 🤣

Do you wonder who is promoting those scams impersonating personalities and media? Read about how we found three affiliate networks behind those ads. https://www.qurium.org/alerts/tell-of-spring-exposing-crypto-scam-affiliate-networks/ 👇(1/8)

“We have a well-established process for identifying and mitigating risks on our platforms,” said Meta. “We look forward to continuing our co-operation with the European Commission and providing them with further details of this work.”

We are trying to reach out @PlainProxies regarding the use of their IPv6 proxies to conduct denial of service attacks.

300 crypto-scams promoted with Paid Ads.

Rutman Yakov from RPT explains that they are very new (noobs) using celebrities in their campaigns and there is lots to learn. @pixelsfr Full video here: How to EARN $250K on TRAFFIC ARBITRATION https://youtu.be/ZYFb2uFCXNY?t=3498

Does anyone know why crypto-scams dashboards are no threats? Ping us if you want the list and can do something about it.

"A journey into the Crypt of cloned media" is a joint investigation with Le Monde @pixelsfr, tracing how crypto scams make use of Facebook Ads. 👇 https://www.qurium.org/forensics/into-the-crypt-of-cloned-media/ (1/8)

It just took 1254 days. Thanks to those that report it @jsrailton @RonDeibert @accessnow @PeterGuest https://www.qurium.org/alerts/egypt/how-operators-use-sandvine-to-block-independent-media-in-egypt/ https://x.com/PeterGuest/status/1762457911446401462

We wonder why is taking so long for @ServerHub @jrb01984 to address our open ticket that describes how hundreds of websites have been cloned to promote Chinese gambling. Should not take long, check it out! 🤦‍♀️🧐 See a pattern?

Watch how hundreds of websites have been cloned and translated to Chinese to promote gambling online. https://www.qurium.org/press-releases/hundreds-of-sites-cloned-to-promote-a-chinese-gambling-network/

Imagine a world when you can operate million of IPv6 addresses that have bogus geolocations and you can be anywhere. https://www.qurium.org/press-releases/ddos-attacks-against-hungarian-media-traced-to-yet-another-proxy-provider/

8000+ addresses leased by @IPXOcom to Aliat Data. Is this "Know your Custumer? "Advanced KYC checks"

This is the latest of our new reports about the use of Proxy and VPN providers weaponized to conduct denial of service attacks. https://www.qurium.org/weaponizing-proxy-and-vpn-providers/volatile-networks/ 👇 (1/4)

. @kloopnews got blocked by ElCat/Homeline this morning. The page is blocked by court decision, order of GKNB KR and prescription of GKIT KR

Wow! @IPXOcom

This is just a few minutes of one of the DDoS launched against @sjs_Somalia @Nacionaleks @adalatseeker using @IPXO @VGrinius leased IP space. Is this a "miss-configuration"?

We have reported abuse of 32 networks leased by @IPXO used to conduct DDoS. "None" of the contact details responded with any details. The most hilarious think is to see that "abuse observability" is 100%. Ethical marketing for the win! @VGrinius

Read this article from @mybroadband to understand how unaccountable IP addresses are the driving force of cybercrime. The market of vast amounts of IP addresses changing owners and their bogus geo-locations. https://t.co/qaad9bL8zP

In the past two years, our hosted organizations have received DDoS attacks from five different residential proxy providers. Four of them claim to be "ethical". Welcome to the world of "ethically sourced denial of service attacks" 🤯

Since the past Friday, we are mitigating a denial of service attack against @sjs_Somalia. The attacker has taken advantage of a proxy-provider to weaponize thousands of IP addresses 👇(1/4)