On the trail of 3NT Solutions LLP

NOTE: An updated list of IPs can be found here (October 2017)

Yesterday I blogged about a company called 3NT Solutions LLP apparently based in the UK and expressed my reservations about them as a business. They operate quite a large range of IP addresses, but a quick Google search shows pitifully little about this company.

Let's start our investigation by looking them up at Companies House. That gives some basic details:

3NT SOLUTIONS LLP
SUITE 4084
10 GREAT RUSSELL STREET
LONDON
ENGLAND
WC1B 3BQ
Company No. OC363382

LLPs are a relatively new type of company in the UK which allows a firm to be registered with the minimum of details, but there are reports that LLP structures are being widely abused. We'll have a look at the ownership in a moment, but first let's check out this grand-sounding office in Central London..

View Larger Map

It is, in fact, the Bloomsbury branch of Mail Boxes Etc and "suite" is simply a euphemism for "mail box".. in other words, this is a mail drop address that most likely forwards any mail to another address, a trick that conceals the full owners of the company.

OK, so that address is a bust. But the WHOIS records for their IP blocks, and their previous address registered at Companies House is something different:

DALTON HOUSE
60 WINDSOR AVENUE
LONDON
SW19 2RR

We can trundle over to that on Google StreetView too..

View Larger Map

Dalton House is basically the same thing as the MBE address, it offers a brass plaque somewhere and a mail forwarding service. So no real clues as to ownership here either.

A trip back to Companies House to find their Company Register information [rtf] reveals very little, except two related companies in Belize.

LLP DESIGNATED MEMBER:	DARL IMPEX LTD
Appointed:	01/04/2011
Nationality:	NATIONALITY UNKNOWN
No. of Appointments:	1
Address:	35 NEW ROAD
	BELIZE
	BELIZE
	NA

LLP DESIGNATED MEMBER:	LEGRANT TRADING LTD.
Appointed:	19/03/2013
Nationality:	NATIONALITY UNKNOWN
No. of Appointments:	1
Address:	BLAKE BUILDING SUITE 102, GROUND FLOOR, BLAKE BUIL
	CORNER EYRE&HUTSON STREETS
	BELIZE CITY
	BELIZE
	NA

Belize is a pretty much a haven for offshore companies, so it is quite likely that these two Belize companies are owned by someone in a different country again.

The domain registration for 3nt.com doesn't really give any more information, and oddly enough their website is down (so how do they expect to attract business?). But if we do a WHOIS lookup on one of their IP ranges then it becomes much more clear.

inetnum:        5.61.32.0 - 5.61.47.255
netname:        INFERNO-NL-DE
descr:          ********************************************************
descr:          * We provide virtual and dedicated servers on this Subnet.
descr:          *
descr:          * Those services are self managed by our customers
descr:          * therefore, we are not using this IP space ourselves
descr:          * and it could be assigned to various end customers.
descr:          *
descr:          * In case of issues related with SPAM, Fraud,
descr:          * Phishing, DDoS, portscans or others,
descr:          * feel free to contact us with relevant info
descr:          * and we will shut down this server: abuse@3nt.com
descr:          ********************************************************
country:        DE
admin-c:        TNTS-RIPE
tech-c:         TNTS-RIPE
status:         ASSIGNED PA
mnt-by:         MNT-3NT
mnt-routes:     LEASEWEB-MNT
source:         RIPE # Filtered

person:         Neil Young
address:        3NT SOLUTIONS LLP
address:        DALTON HOUSE 60, WINDSOR AVENUE
address:        LONDON, UK
phone:          +442081333030
abuse-mailbox:  abuse@3nt.com
nic-hdl:        TNTS-RIPE
mnt-by:         MNT-3NT
source:         RIPE # Filtered

route:          5.61.32.0/20
descr:          Routed via LEASEWEB
origin:         AS16265
mnt-by:         OCOM-MNT
source:         RIPE # Filtered

Alright, let's cut a long story short because we know who this is.. it's Serbian web host inferno.name who have featured on this blog several times before all the way back to 2011. Similar records exist on all of 3NT's ranges, linking them firmly with inferno.name.

Not it's not a particular surprise to see that inferno.name is trading under a different name, as the scummy sites they host pretty much ruined their reputation. And yeah, this blog helped with that.

I had a look into some of 3NT's IP ranges and you can tell instantly from these samples [csv] that they are pretty low-grade spammy sites. What you can't tell from that list are the command and control servers that they run, and of course they also host malware.

The following IP range are allocated to 3NT Solutions LLP. I recommend that you block them.
5.45.64.0/21
5.45.72.0/22
5.45.76.0/22
5.61.32.0/20
37.1.192.0/21
37.1.200.0/21
37.1.208.0/21
37.1.216.0/21
37.252.2.0/24
37.252.12.0/24
130.0.232.0/21

In addition, these other (smaller) ranges are allocated to inferno.name and v3servers.net who are the same outfit. I also recommend that you block these:
 46.21.147.128/25
46.21.148.128/25
46.22.211.0/25
80.79.124.128/26
92.48.122.0/28
92.48.122.16/28
92.48.122.32/28
92.48.122.48/28
94.100.17.128/26
95.168.165.0/24
95.168.173.0/24
95.168.177.0/24
95.168.178.0/24
95.168.191.0/24
188.72.204.0/24
188.72.213.0/24
212.95.54.0/24
212.95.58.0/24
212.95.63.0/24

Something evil on 74.50.122.8, 5.61.36.231 and 94.185.85.131

Thanks to @Techhelplistcom for the heads up on this little mystery..

It all starts with a spam evil (described here)..

The link goes to a URLquery report that seems pretty inconclusive,  mentioning a URL of [donotclick]overcomingthefearofbeingfabulous.com/xjvnsqk/fbktojkxbxp.php [an apparently poorly secured server at 74.50.122.8, Total Internet Solutions Pvt. Ltd in India] that just does a redirect to a spammy diet pill site at thefxs.com [94.177.128.10, Linkzone Media Romania] if you have a Windows User Agent set.

As Techhelplist says, set the UA to an Android one and you get a very different result. In this case you get bounced to a site hosted on 5.61.36.231 (3NT Solutions / Inferno.name)
[donotclick]mobile.downloadadobecentral.ru/FLVupdate.php  then to
[donotclick]mobile.downloadadobecentral.ru/FLVupdate2.php from where it attempts to download a file FlashUpdate.apk

3NT Solutions / inferno.name is a known bad actor and you should block all their IPs on sight, in this case they have a netblock 5.61.32.0/20 which I strongly recommend that you route to the bitbucket.

FlashUpdate.apk has a VirusTotal detection rate of 22/47, but most Android users are probably not running anti-virus software. The Andrubis analysis of that .apk shows a network connection to 94.185.85.131 (Netrouting Telecom, Sweden) plus (oddly) some pages loaded from ticketmaster.com.

It just goes to show that what you think might be harmless spam can actually be something very, very different if you access it on a mobile device.

Recommended blocklist:
5.61.32.0/20
94.177.128.10
74.50.122.8
94.185.85.131
downloadadobecentral.ru
jariaku.ru
350600700200.ru
overcomingthefearofbeingfabulous.com

UPDATE 2014-05-25: Note that overcomingthefearofbeingfabulous.com has been cleaned up and appears to be no longer compromised.

PRFC (Epcylon Technologies, Inc) pump-and-dump spam

This pump-and-dump spam run happened last night, which would have been Thursday afternoon in the US. Usually spam runs of this type happen over the weekend, but this P&D run is not quite like others.

From:     Zelma Williams
Date:     20 February 2014 19:04
Subject:     Very important information. Please read

Hi [redacted]

I know you were expecting to hear back from me much earlier but I didn't want to get back to you empty-handed. I finally found the perfect stock for you and I am confident that it will make you some serious profit. Remember the one I told you about in November of last year right? You did very well on it and I think this PRFC stock will do the same for your portfolio again.
I have to let you know though that I'm not the only one who found out about PRFC today. A few of my colleagues are aware as well and they are telling their friends and family about it so I must advise you to move fast if you want to buy it. I think it's trading at just around 15 cents right now, if you wait too long it might be at 30 or even higher and at that time I won't be able to safely advise you to buy it. You can buy as many shares as you can first thing at market open on Friday or worst case scenario buy it on Monday but move fast.
I know you don't care about what the company does because you know I've done all the due diligence for you already but PRFC is actually amazing and I think it will do much better than even the one I told you about a few months ago.
One of the company's divisions offers mobile software solutions for the gaming industry. The mobile apps allow customers to play lottery and other games of chance and skill on their smartphones. The software is extremely advanced and could be the backbone of all mobile casinos in the future. It is expected that the US will legalize online gaming in the near future and this could catapult PRFC to new highs however even without that the company's software is extremely valuable in the rest of the world and could become extremely profitable.  Something big is definitely brewing at the company. I heard something about buy out rumors but I don't have all the details yet I will keep you posted over the coming days or weeks.
Anyway I won't bore you with much more blabber, but if you have a second do check out PRFC. By the way I will be expecting a nice gift from you once you make fat bank on this one and a nice dinner with the wives is in order. It's been too long since we last spent a good evening over a bottle of wine. I was going to call you to tell you about PRFC but I figured youre probably asleep now with those crazy shifts you've been working. Take care and call me if there's anything.

Talk soon
Your favorite friend and only broker :)

Appended to the spam is some random text to try to fool spam filters.

According to stock charts, this spam has been successful and has pushed up the Epcylon Technologies, Inc / PRFC price by about 40% in afternoon trading.

The chart shows that 72885 shares were traded in this period, moving stock up from $0.14 to $0.20, the highest value for this stock since August. Trading is normally pretty thin for this stock at between 0 to 10,000 shares per day, but it does sometimes peak higher.

Usually with pump-and-dump scams somebody buys a large quantity of a few days before the spam run. This doesn't appear to be the case here, which leads to the possibility that the spam run is being pushed by an existing stockholder (it is unlikely to be anything to do with Epcylon though). Another thing that differentiates this pump-and-dump run from others is that there does seem to be some mildly positive news about this company.

However, I would urge you not to buy these stocks. The usual pattern is that the stock price collapses shortly after the initial spam run when the party responsible for the spam cashes out.

The spam itself was sent to scraped email addresses and addresses taken from various data breaches, although there does appear to have been some basic listwashing done to evade detection.

Update: a second version is doing the rounds..

From:     Rowena Rasmussen caroline@ordernowapp.com
To:     caroline [caroline@victimdomain]
Date:     22 February 2014 14:48
Subject:     This is the best stock tip of the year

Dear Investor,

If you're tired of playing the market for mediocre gains then you should read on. I'm Mike Statler. Some of you may know me from my last good stock tip (WPWR) which more than tripled within a short period of time (feel free to check it out). Now I have a brand new tip and I will think you will be pleased. This one should go up more than 6 times from current levels.
If you are interested in making a quick gain overnight, this is not for you, but if you're serious about buying my new tip PRFC and you are willing to hold a few weeks and see magic happen then you're definitely at the right place.
If you remember correctly I told you a few days ago about PRFC. I advised you to add it to your watch list but at the time I could not recommend that you buy it as I had not completed my due diligence.
I have good news and bad news for you. The bad news is that it is already up about 60% since I told you to add it to your watch list but the good news is that I think it still has a lot of room to go up and I expect to see PRFC trading at over 2 dollars before the end of the month or by the end of the 1st week of march at the absolute latest.
The company makes indispensable software that powers the backend of mobile gambling platforms. You can buy lottery on your smartphone, spin the roulette, enjoy blackjack or even play a game of poker. All this from your iphone or android phone. This is absolutely revolutionary and as we get closer to complete legalization of online gambling in America this little gem that is PRFC could soar dramatically.
PRFC (or Epcylon Technologies if you prefer) is going to work wonders for my subscribers' portfolios. I even bought $15,000 of it myself today. THAT'S how confident I am in it. I'm putting my money where my mouth is and I am telling you to BUY PRFC too if you believe in me, and if you don't it's too bad. You will be sending me an email two weeks from now saying how you regret not buying when I told you to do so.

Happy Trading,
I'm Mike Statler.

Update 24/2/14: new versions replace the text with an image in an attempt to bypass spam filters.

Update 25/2/14: a slightly different image this time, presumably in an attempt to evade scanners