LEO and the web

[Kyobanim]

Here's my story and I'm sticking to it.

I operate several web sites. I was checking my personal website on the server side last night and noticed several new directories that I am positive I didn't create. I wouldn't create a directory called www.paypal.com 2008.bak.

So upon further investigation, it turns out that someone hacked my site from a London IP, dropped their paypal hacking stuff in there and proceeded to do their thing. But this isn't the issue.

The issue is, I contacted the web host I use and haven't heard back. so I called the local FBI office since I figgured it was international crime. No, contact the florida department of law enforcement.

OK

Called FDLE, no, you need to contact the local sherriffs office.

ok

Called Seminole county SO. No, you need to call the FBI.

So, here I sit with a paypal spoof site on my server, 50,000 illegally obtained email addresses with MD5s, and a chat log of 2 guys doing a transaction to sell/buy those 50k email addresses.

Before you say anything, I have already reset all account names and passwords to the site.

So who do I report this to?

[Ivedog]

Probably best to check out http://ic3.gov

[The Reaper]

What would happen if you told DHS that you suspected it was a terrorist fundraising operation?

And for all you know, it might be.

TR

[CoLawman]

I know what our agency would do. Tell you to contact the FBI! LOL, but it is true. My understanding is that no one is touching this stuff as there is no US Attorney's office in the country that would prosecute such a case. Your example is just the tip of the iceberg. There are plenty of international scams that are quite lucrative that the feds ignore. If you have a day or two I could cite example after example after example. :(

[JJ_BPK]

Here's my story and I'm sticking to it.

So, here I sit with a paypal spoof site on my server, 50,000 illegally obtained email addresses with MD5s, and a chat log of 2 guys doing a transaction to sell/buy those 50k email addresses.

So who do I report this to?

Looks like you know your way around the web business,,

AND depending of your business disruption risk aversion factors,,

And assuming you don't want to just jump to a new IPS..

1)get your legal to write a nasty letter to you ISP, state you are concerned about NATIONAL SECURITY and LOSS OF REVENUE of yourself and the other system users. Explain how you have requested assistance from the LEO's and PAYPAL, COPY EVERYBODY. You don't need to tell them your getting zero responce..

2)get PAYPAL involved, despite what you think of their business model, they are very protective of their franchise. This would also preempt any PAYPAL backlash, should they get wind of your IP address from some other source,, thinking YOU ARE THE PERP.

3)Contact any of the IP address blocking orgs like SPAMHAUS, explain the problem. See if they know about the perps, make sure you and your ISP are not on their blocked list.. <<< LOST REVENUE

http://www.spamhaus.org/sbl/

4)if your still have any log(s) of the perp activity on your server, mention it in all correspondence, show your concern, your want to cooperate and need for business transparency to PREVENT LOSS OF REVENUE...

5)If you feel the need,, Interpol, I know, not the number 1 go-to LEO outfit,, but they are available..

http://www.interpol.int/

Now,, if you found some arabic fonts in your text log,, Swiss bank accounts,, and Hilary's cell phone number,, this might have the potential for a new Tom Clancy movie???

Good Luck

[SF_BHT]

Here's my story and I'm sticking to it.

I operate several web sites. I was checking my personal website on the server side last night and noticed several new directories that I am positive I didn't create. I wouldn't create a directory called www.paypal.com 2008.bak.

So upon further investigation, it turns out that someone hacked my site from a London IP, dropped their paypal hacking stuff in there and proceeded to do their thing. But this isn't the issue.

The issue is, I contacted the web host I use and haven't heard back. so I called the local FBI office since I figgured it was international crime. No, contact the florida department of law enforcement.

OK

Called FDLE, no, you need to contact the local sherriffs office.

ok

Called Seminole county SO. No, you need to call the FBI.

So, here I sit with a paypal spoof site on my server, 50,000 illegally obtained email addresses with MD5s, and a chat log of 2 guys doing a transaction to sell/buy those 50k email addresses.

Before you say anything, I have already reset all account names and passwords to the site.

So who do I report this to?

PM me your contact info. I am flying tonight to DC to our HQ and have meetings with our DOJ INTERNET group. I may be able to get you a POC tin Justice. FBI Is the agency but as you have found they are slow to non responsive. If you get a POC they can then move. This is a international banking fraud scheme. It is hard to do but there are some people specializing in this type of thing. Have you contacted PayPal?

[Kyobanim]

I contacted paypal when I found it but they haven't responded yet. PM inbound.