NEWS FROM THE LAB - Tuesday, February 19, 2008

Paid for Receiving Bank Transfers Posted by Sean @ 17:22 GMT

Here's a screenshot of a site that we discovered back in December, BGI-Funds:


It's of a PHP based Bulletin Board that's used for money laundering recruitment.

We searched for the following text taken from the site:

I'll get right to the point. I have large amount of funds

At the top of the search results was a Symantec post (September '07) making the link between Storm spam and a copy of the phpBB site. So that pretty much confirmed what we wanted to know.

Returning to the search today — the site's still alive — though the name has changed several times. Submitting a Google search for Paid for Receiving Bank Transfers provides a large number of results.

Most of the sites are offline; you'll need to view the cache to see an example.

We located two sites that are currently active. They're hosted using fast flux:

ati-manager fast flux

Another example:

vks-manager fast flux

New forum members have been signing up at both locations in order to communicate with the site's Admin (who promises 10%). The membership list appears to be merged prior to February of this year. Posts to the forum date back to the end of 2004. The recycled forum will apparently survive as long as does the Storm botnet.

One curious thing about the membership list… of those that provide their location, the majority are Canadians. What's up with that?

ATI-Manager member list

A two minute video is available on the Weblog's YouTube Channel that toggles through the cached results.

Update: Our readers have located an answer to the Canadian question. You'll find the details in this post's comments.