hxxp://dot.itpoliceus.net/us1/ (still live)
lelz @ this. Smells like some .ru friends behind it. The script and code behind it are sorta cool. Thought I would share and archive this here on WF. I bet a lot of stupid ppl fall for this sadly. Looks like they are paying for PPC ads and then switching out the url w this one once their ads start running.
64.120.238.201 - IP in United States, Scranton - Comments and Complaints
Hosted on this IP
dot.itpoliceus.net -> m201.siphonostomecar.com
Starting Nmap 6.25 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2014-07-17 22:26 CDT
Nmap scan report for m201.siphonostomecar.com (64.120.238.201)
Host is up (0.061s latency).
Not shown: 989 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp filtered smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
3306/tcp open mysql
Apache/2.2.27 (CentOS) Server at c Port 80
Page source: FBI Lander - Pastebin.com
css source: FBI Lander CSS - Pastebin.com
divs.htm source: divs.htm - Pastebin.com
jquery.js source: jquery.js source - Pastebin.com
chrome.js source: chrome.js source - Pastebin.com
images: https://anonfiles.com/file/8ef24e97957cfee3107e9e1ee42ae1bf
check.php - cant get src
PS. Sup Feds, NSA, GCHQ, DoJ Bots! Dont subpoena or taze me bros!

lelz @ this. Smells like some .ru friends behind it. The script and code behind it are sorta cool. Thought I would share and archive this here on WF. I bet a lot of stupid ppl fall for this sadly. Looks like they are paying for PPC ads and then switching out the url w this one once their ads start running.
64.120.238.201 - IP in United States, Scranton - Comments and Complaints
Hosted on this IP
dot.itpoliceus.net -> m201.siphonostomecar.com
Starting Nmap 6.25 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2014-07-17 22:26 CDT
Nmap scan report for m201.siphonostomecar.com (64.120.238.201)
Host is up (0.061s latency).
Not shown: 989 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp filtered smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
3306/tcp open mysql
Apache/2.2.27 (CentOS) Server at c Port 80
Page source: FBI Lander - Pastebin.com
css source: FBI Lander CSS - Pastebin.com
divs.htm source: divs.htm - Pastebin.com
jquery.js source: jquery.js source - Pastebin.com
chrome.js source: chrome.js source - Pastebin.com
images: https://anonfiles.com/file/8ef24e97957cfee3107e9e1ee42ae1bf
check.php - cant get src
Code:
Domain Name: ITPOLICEUS.NET
Registry Domain ID:
Registrar WHOIS Server: whois.domaincontext.com
Registrar URL: www.domaincontext.com
Updated Date: 11-Jun-2014
Creation Date: 11-Jun-2014
Registrar Registration Expiration Date: 11-Jun-2015
Registrar: DomainContext, Inc.
Registrar IANA ID: 1111
Registrar Abuse Contact Email: tld-abuse@domaincontext.com
Registrar Abuse Contact Phone: +7 495 6459373
Domain Status: clientTransferProhibited
Registry Registrant ID: DI_35697948
Registrant Name: Vladimir Opranov
Registrant Organization: N/A
Registrant Street: Vavilova 7-64
Registrant City: Moscow
Registrant State/Province:
Registrant Postal Code: 117312
Registrant Country: RU
Registrant Phone: +7.4953692581
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: vova.opranov@bk.ru
Registry Admin ID: DI_35697948
Admin Name: Vladimir Opranov
Admin Organization: N/A
Admin Street: Vavilova 7-64
Admin City: Moscow
Admin State/Province:
Admin Postal Code: 117312
Admin Country: RU
Admin Phone: +7.4953692581
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: vova.opranov@bk.ru
Registry Tech ID: DI_35697948
Tech Name: Vladimir Opranov
Tech Organization: N/A
Tech Street: Vavilova 7-64
Tech City: Moscow
Tech State/Province:
Tech Postal Code: 117312
Tech Country: RU
Tech Phone: +7.4953692581
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: vova.opranov@bk.ru
Name Server: ns1.itpoliceus.net
Name Server: ns2.itpoliceus.net
PS. Sup Feds, NSA, GCHQ, DoJ Bots! Dont subpoena or taze me bros!