TOKYO (MacHouse) – YouTube becoming more and more popular, cyber criminals use it as a means of online advertising. Some 17 months ago, they used YouTube to advertise porn websites. And it took YouTube a few weeks to make overall changes to combat spam comments. Because of them, YouTube users are no longer allowed to use hyperlinks to write comments. In the meantime, cyber criminals still use YouTube and create spam profiles mostly to advertise fake online pharmacy stores to scam Internet users.
 Screenshot 01 – Source: YouTube |
 Screenshot 02 – Source: YouTube |
 Screenshot 03 – Source: XXX Blackbook |
A few hours ago, a cyber idiot posted a spam comment at YouTube to advertise a porn website. The comment posted by user named HAttelzq756 says
.See What The Buzz Is About
FASTLOVERFUN . COM (See Screenshot 01.)
This YouTube user is not exactly new. The account appears to have been created nearly 4 months ago. (See Screenshot 02.)
If you access http://fastloverfun.com, you will be redirected to a different website in matter of a few seconds. The final destination is an x-rated porn website hosted at the domain of xxxblackbook.com. (See Screenshot 03.) It seems that this porn website is hosted in Ireland along with the website of camazon.com. (See Screenshot 04.) Whether or not the website at xxxblackbook.com is involved with any unethical spam operation, there isn’t much that we could do against it as they are likely to have their own server.
 Screenshot 04 – Source: Camazon.com |
 Screenshot 05 – Source: WhoIs.Net |
 Screenshot 06 – Source: netriver.net |
As for the redirection website hosted at the domain of fastloverfun.com, let’s first take a look at the WhoIs registration. It says
Registration Service Provided By: Pink Sites Billing Corporation. (See Screenshot 04.)
The WhoIs registration also says “whois.enom.com” at the top. That means Pink Sites Billing Corporation is eNom’s reseller, providing a registration service to the porn spammer.
In the meantime, the redirection website itself seems to be hosted in Phoenix, Arizona. This data center is possibly owned by NetRiver Corporation (netriver.net). The IP address of the web server is 204.245.42.129, which points to pqhost2.lynnwood.netriver.net. (See Screenshot 06.)
References:
Fake Online Pharmacy Store at PILLS-DEALS.COM with a Chinese Connection?
YouTube Hit by Online Pharmacy Spam
YouTube Stricken By Botnet Spam Messages
spammers or the porn industry, you’ve got to be able to appreciate how creative people get for finding solutions to problems.
[Partially edited by Administrator]