8 ms·

This is a money laundering scheme where they are trying out how far they can go per domain. It's also a bug in the paypal API that they're abusing, where the S

This is a money laundering scheme where they are trying out how far they can go per domain. It's also a bug in the paypal API that they're abusing, where the SDK doesn't differ between example.com and www.example.com. If webshops like yours get exploited and used for money laundering, they will mix transactions from those two subdomains, while leaving the www.example.com domain as it is. The support people at paypal are dumb enough to not take care about each case, and usually they mix transactions later also via other social media services that have microtransactions (e.g. tiktok or snapchat streams where you can gift away items). The way paypal support's workflow works is that they have to nanually identify each and every transaction separately, meaning a human will be busy for weeks on end. Not kidding you. That's how the scammers keep winning with schemes like this. Usually there's also no way to escalate this, not even for business customers, at paypal, due to how their support offices are structured organizationally. As a mitigation I'd recommend to block ASNs that are known hosters that do this, and double check your webshop version for known vulnerabilities and fixes. If you don't use docker already, start to virtualize your webshop software now. I can't stress how important this is. Also double check any users and passwords you are using for the services, and the rest of the filesystem for indicators on the VPS. Disable SSH passwords and use only SSH key authentication on the VPS in case this hasn't been done already. I'm writing this because usually this kind of scheme starts to happen after the server got pwned already, and after e.g. the ssh password bruteforce scanner was successful or after the web exploit / persistence exploit was successful. If you need a starting point to block those botnet affiliated networks, I started both a firewall and scam database project that does exactly this: [1] https://github.com/cookiengineer/antispam https://github.com/cookiengineer/antispam [2] https://github.com/tholian-network/firewall https://github.com/tholian-network/firewall

m00x 1y ago
This is not money laundering. Why would they dispute if it's ML?
JamesAdir 1y ago
Sorry for the noob question, but how can Docker help remediate the situation? I'm currently learning about DevOps.
- calgoo 1y ago
  Not OP, but Im assuming its because of immutability of the containers where you can redeploy from a prebuilt image very quickly. There is nothing that says you cant do the same with servers / VMs however the deployment methodology for docker is a lot quicker (in most cases). Edit: Im aware its not truly immutable (read only) but you can reset your environment very easy and patching also becomes easier.
- cookiengineer 1y ago
  Containers allow separation of access rights, because you don't have to pwn only one program/service that is running on the host system to get physical access to it. Containers have essentially 3 advantages: - Restart the containers after they got pwned, takes less than a second to get your business up and running again. - Separation of concerns: database, reverse proxy, and web service run in separate containers to spread the risk, meaning that an attacker now has to successfully exploit X of the containers to have the same kind of capabilities. - Updates in containers are much easier to deploy than on host systems (or VPSes).
  - mjburgess 1y ago
    Just thinking about this from a proxmox pov -- applying this advice, do you see an issue with then saying: take a copy of all "final" VMs, delete the VM and clone the copy? And, either way, do you have a thought on whether you'd still prefer a docker approach? I have some on-prem "private cloud"-style severs with proxmox, and just curious about thinking through this advice.
  - imglorp 1y ago
    > Separation of concerns Sorta: yes the container is immutable and can be restarted, but when it does, it has the same privs and creds to phone up the same DB again or mount the same filesystem again. I'd argue touching the data is always the problem you're concerned about. If you can get an exec in that container you can own its data.
    - neom 1y ago
baobabKoodaa 1y ago
Please explain the money laundering part here?
- pbronez 1y ago
  Money only has meaning as a flow. Value moves from A to B. Forensic analysis can follow this chain quite a long way, which is a problem for people trying to hide illegal activity. They're always looking for ways to break that chain. If OP is correct and this attack allows you to covertly shift money around, that can break the chain and let the bad guys use the illegally obtained funds with legitimate services. It might look something like: 1) get funds via illegal activity (dirty funds) 2) spends funds at an ecommerce site (dirty funds) 3) secure a paypal refund WHICH GOES TO ANOTHER ACCOUNT (clean funds) The PayPal vulnerability allows the money to move from a dirty chain to a clean one.
  - high_na_euv 1y ago
    >2) spends funds at an ecommerce site (dirty funds) 3) secure a paypal refund WHICH GOES TO ANOTHER ACCOUNT (clean funds) How it breaks the chain? Account1 buys for 10k USD, requests refund, receives it? Even if it went for some reason to account2 then there is still the chain, but why would it go to other?
  - KomoD 1y ago
    It wouldn't go to another account if you do a dispute, what are you talking about?
    - m00x 1y ago
      Yeah I work at a large US fintech and this isn't ML
- miltava 1y ago
  Im not op and I’m not sure they are using it for money laundering. A money launderer can use a marketplace by creating a seller account and buying from himself. Since he’s the one buying he doesn’t need to deliver anything but he gets the money from a legit source. Usually he would use a payment method as close to money as possible so that it leaves less traces. But in OPs case, the amounts are low so he needs too many transactions to get something valuable. And because of the disputes, he’s (probably) not getting the money (?). It could be card testing: the fraudster has a bunch of cards and doesn’t know which is valid or canceled. The best way to find out is to test in a real site. So he’ll test out each of them and the ones that go through are good to use elsewhere. The thing is that it would be better for him not to dispute the transactions so the OP would take much longer to find out about the scheme and shut it down. It’s better to use low amount transactions in this case so it doesn’t use too much of the credit available for him to defraud and probably doesn’t warn the card owner. Another option is doing it just to hurt the OP marketplace. If you have too many disputes the brands can fine you and if you don’t solve the problem they can turn your account off. I’ve seen it happen when a competitor was trying to hurt the e-commerce. It’s a low move and rare but it happens. One thing that might help is to analyze the sellers too. In a money laundering and even in the other settings, it could be part of the scheme. Are they new accounts? Are their volume exploding out of nowhere? Etc
trod1234 1y ago
Unfortunately nowadays, blocking by ASN is not going to help you out much in solving this type of issue. The reason for this is stealthy botnets. For a brief rundown, I'd suggest this article. https://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-2/ https://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-...
- cookiengineer 1y ago
  Web scraping is not the same as web scanning. I am aware of these types of botnets, how they work, and which companies are behind them. Hence the reason for adding my spam database to the initial comment, which focuses on exactly those, combined with the ebpf firewall module that analyzes and correlates repeated bad behaviors. It's not a new technique btw, APT28/29 and others have been doing this for around 10 years now.

m00x 1y ago

This is not money laundering. Why would they dispute if it's ML?

JamesAdir 1y ago

Sorry for the noob question, but how can Docker help remediate the situation? I'm currently learning about DevOps.

calgoo 1y ago
Not OP, but Im assuming its because of immutability of the containers where you can redeploy from a prebuilt image very quickly. There is nothing that says you cant do the same with servers / VMs however the deployment methodology for docker is a lot quicker (in most cases). Edit: Im aware its not truly immutable (read only) but you can reset your environment very easy and patching also becomes easier.
cookiengineer 1y ago
Containers allow separation of access rights, because you don't have to pwn only one program/service that is running on the host system to get physical access to it. Containers have essentially 3 advantages: - Restart the containers after they got pwned, takes less than a second to get your business up and running again. - Separation of concerns: database, reverse proxy, and web service run in separate containers to spread the risk, meaning that an attacker now has to successfully exploit X of the containers to have the same kind of capabilities. - Updates in containers are much easier to deploy than on host systems (or VPSes).
- mjburgess 1y ago
  Just thinking about this from a proxmox pov -- applying this advice, do you see an issue with then saying: take a copy of all "final" VMs, delete the VM and clone the copy? And, either way, do you have a thought on whether you'd still prefer a docker approach? I have some on-prem "private cloud"-style severs with proxmox, and just curious about thinking through this advice.
- imglorp 1y ago
  > Separation of concerns Sorta: yes the container is immutable and can be restarted, but when it does, it has the same privs and creds to phone up the same DB again or mount the same filesystem again. I'd argue touching the data is always the problem you're concerned about. If you can get an exec in that container you can own its data.
  - neom 1y ago

baobabKoodaa 1y ago

Please explain the money laundering part here?

pbronez 1y ago
Money only has meaning as a flow. Value moves from A to B. Forensic analysis can follow this chain quite a long way, which is a problem for people trying to hide illegal activity. They're always looking for ways to break that chain. If OP is correct and this attack allows you to covertly shift money around, that can break the chain and let the bad guys use the illegally obtained funds with legitimate services. It might look something like: 1) get funds via illegal activity (dirty funds) 2) spends funds at an ecommerce site (dirty funds) 3) secure a paypal refund WHICH GOES TO ANOTHER ACCOUNT (clean funds) The PayPal vulnerability allows the money to move from a dirty chain to a clean one.
- high_na_euv 1y ago
  >2) spends funds at an ecommerce site (dirty funds) 3) secure a paypal refund WHICH GOES TO ANOTHER ACCOUNT (clean funds) How it breaks the chain? Account1 buys for 10k USD, requests refund, receives it? Even if it went for some reason to account2 then there is still the chain, but why would it go to other?
- KomoD 1y ago
  It wouldn't go to another account if you do a dispute, what are you talking about?
  - m00x 1y ago
    Yeah I work at a large US fintech and this isn't ML
miltava 1y ago
Im not op and I’m not sure they are using it for money laundering. A money launderer can use a marketplace by creating a seller account and buying from himself. Since he’s the one buying he doesn’t need to deliver anything but he gets the money from a legit source. Usually he would use a payment method as close to money as possible so that it leaves less traces. But in OPs case, the amounts are low so he needs too many transactions to get something valuable. And because of the disputes, he’s (probably) not getting the money (?). It could be card testing: the fraudster has a bunch of cards and doesn’t know which is valid or canceled. The best way to find out is to test in a real site. So he’ll test out each of them and the ones that go through are good to use elsewhere. The thing is that it would be better for him not to dispute the transactions so the OP would take much longer to find out about the scheme and shut it down. It’s better to use low amount transactions in this case so it doesn’t use too much of the credit available for him to defraud and probably doesn’t warn the card owner. Another option is doing it just to hurt the OP marketplace. If you have too many disputes the brands can fine you and if you don’t solve the problem they can turn your account off. I’ve seen it happen when a competitor was trying to hurt the e-commerce. It’s a low move and rare but it happens. One thing that might help is to analyze the sellers too. In a money laundering and even in the other settings, it could be part of the scheme. Are they new accounts? Are their volume exploding out of nowhere? Etc

trod1234 1y ago

Unfortunately nowadays, blocking by ASN is not going to help you out much in solving this type of issue. The reason for this is stealthy botnets. For a brief rundown, I'd suggest this article. https://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-2/ https://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-...

cookiengineer 1y ago
Web scraping is not the same as web scanning. I am aware of these types of botnets, how they work, and which companies are behind them. Hence the reason for adding my spam database to the initial comment, which focuses on exactly those, combined with the ebpf firewall module that analyzes and correlates repeated bad behaviors. It's not a new technique btw, APT28/29 and others have been doing this for around 10 years now.