Another vintage approach I see right off the bat are a few references in his code that is pointing toward Samy's own servers.... interesting he didn't obfuscate

Another vintage approach I see right off the bat are a few references in his code that is pointing toward Samy's own servers.... interesting he didn't obfuscate it or use a MITM server. At the minimum, the host(victim) is establishing a websocket with Samy, so his server is aware who is being compromised or researched on.