EY.MD Blog

Google Widevine Content Decryption Module

Mike Jones — Fri, 13 Nov 2020 14:07:11 GMT

Given that Google has been DMCA'ing repositories containing their private decryption key for Widevine, I decided to post their private key below:

See repository located here: https://archive.softwareheritage.org/browse/origin/content/?origin_url=https://github.com/tomer8007/widevine-l3-decryptor&path=content_key_decryption.js

DDOS-GUARD - Yet Another Bulletproof Hosting Company

Mike Jones — Mon, 20 Apr 2020 00:34:57 GMT

I woke up one beautiful morning to find a Steam message (8 of the same messages about an hour apart) from a man self-representing himself as a Jew informing me of a Karambit CS:GO knife that I supposedly forgot to retrieve. This would be the first time that someone of the Jewish faith reached out to me directly to give me something for free, so naturally, my instincts told me this was going to be fun. I, being the professional internet man that I am, visited the website and was presented with a shitty steam phishing page. Nothing unusual about that, the internet is full of phishing pages and people to this day continue to fall for phishing websites even though this got old sometimes back in 2010 (kind of on-par with Google Dorks).

The steam phishing page in question, hosted on skinlux(.)work - As it appeared April 18th, 2020

Unfortunately for skinlux.work and their respective hosting company, I did not have much to do this week and decided to go down the rabbit hole that is investigating their hosting company and reporting on anything I could find.

Whois records for Skinlux(.)work show that the domain was registered on March 30th of 2020 via eNom. While the whois information is redacted/private, the nameservers showed that the domain was utilizing Cloudflare for reverse-proxy purposes. I headed on over to Cloudflare's Abuse Reporting Form and reported the domain for hosting a phishing page. While Cloudflare will help malicious pages like this hide their real IP and hosting company, Cloudflare often responds to abuse/phishing reports and provides the reporting party with the hosting provider's name and abuse contact email. You can see their reply in regards to my report below:

Reply from Cloudflare to my abuse report - Response received April 18th, 2020

After Cloudflare provided me with the hosting provider's name and abuse email, it was only a matter of some googling and OSINT to get all the information below.

DDOS-GUARD CORP / DDOS-GUARD LTD operates under the domain ddos-guard(.)net and AS numbers AS57724 and AS262254 with majority of their IP's located in Russia (AS262254 is the one with IP's reporting in Belize). They are a registered company in Belize with the registration number 173694, you can reach out to ibcbelize.com in order to perform a 'search' of the company in which you pay them $25 to get the Registered Agent, Agent's Address, Registered Office, Public Investment and the Registered Documents, but I don't care enough to pay for that. They are also a limited liability corporation in Russia which you may find by searching at https://egrul.nalog.ru/index.html with a supposed physical address of House 276, Floor 5, Office 11 on Street of Maxim Gorky in Rostov, 344019 Russia. The two listed persons for the company are Evgeny Anatolevich Marchenko (ЕВГЕНИЙ АНАТОЛЬЕВИЧ МАРЧЕНКО) and Dmitry Vladimirovich Sabitov (ДМИТРИЙ ВЛАДИМИРОВИЧ САБИТОВ) both of whom hold a 50% stake in the company.

Section of the company file for DDOS-Group

The Russian wikipedia article for DDOS-Guard lists Evgeny Marchenko and Dmitry Sabitov as the founders of DDOS-Guard. DDOS-Guard signed a partnership agreement with Reg.ru (a quasi bulletproof domain registrar) in 2014 to supposedly assist in protecting customers from DDOS attacks. You can read an interview with Dmitry Sabitov here. During this interview, Dmitriy Sabitov says that Evgeny's new passion was fighting DDOS attacks and he was eager to help Evgeny with this task. This begs the question of why an IT company that was supposedly created to provide their customers with "high-quality services at affordable prices" and to "get rid of the headaches that are DDOS attacks" is now responsible for hosting thousands of malicious websites with no end in sight.

Evgeniy Marchenko

Map of IP's assigned to AS57724 - As it appeared on April 18th, 2020

DDOS-Guard(.)net was originally registered on January 1st, 2008 with the nameservers ns3.spyderzwebz(.)com and ns4.spyderzwebz(.)com

The domain was parked and then subsequently dropped on February 1st, 2009 due to a lack of renewal. The domain was re-registered on June 1st of 2011 with the nameservers ns1.reg(.)ru and ns2.reg(.)ru which matches the supposed incorporation date of the company itself.

The domain nameservers were ns1.ddos-guard(.)net ns2.ddos-guard(.)net ns3.ddos-guard(.)net ns4.ddos-guard(.)net ns5.ddos-guard(.)net ns6.ddos-guard(.)net and were amended to ns1.ddos-guard(.)net and ns2.ddos-guard(.)net on February 10th of 2018.

The domain has had Whois privacy enabled for nearly its' whole lifetime except for October 11th, 2017. The whois record on October 11th, 2017 was:

Registrant Contact
Registrant Name: Evgenii Marchenko
Registrant Organization: Private Person
Registrant Street: Vyatskaya str, 55/4-11
Registrant City: Rostov-on-Don
Registrant State/Province: Rostov
Registrant Postal Code: 344065
Registrant Country: RUSSIAN FEDERATION
Registrant Email: support@ddos-guard.net
Registrant Phone: 79282797045
Administrative Contact
Administrative Name: Evgenii Marchenko
Administrative Organization: Private Person
Administrative Street: Vyatskaya str, 55/4-11
Administrative City: Rostov-on-Don
Administrative State/Province: Rostov
Administrative Postal Code: 344065
Administrative Country: RUSSIAN FEDERATION
Administrative Email: support@ddos-guard.net
Administrative Phone: 79282797045
Technical Contact
Technical Name: Evgenii Marchenko
Technical Organization: Private Person
Technical Street: Vyatskaya str, 55/4-11
Technical City: Rostov-on-Don
Technical State/Province: Rostov
Technical Postal Code: 344065
Technical Country: RUSSIAN FEDERATION
Technical Email: support@ddos-guard.net
Technical Phone: 79282797045

The number 79282797045 is in fact from the Rostov region of the Russian Federation and is a mobile phone. Searching that phone number led me to discover that a lot of Russian internet users have been complaining regarding spam and phishing pages hosted by Evgeniy Marchenko for years. Once such report on zvonil.octo(.)net describes the following malicious domains:

SPAMM(.)ME - Registered January 7th, 2018 by a Nikolay Kolchanov with an email of e-pay(.)tv@yandex(.)com who hosted his malicious website at 190.115.19(.)218 LACNIC for whom the technical contact was one Evgeniy Marchenko with a telephone number of 79282797045 and email of xengine@mail(.)ru

SPAMMM(.)INFO - Registered on January 12th, 2018 via Namecheap and located at 190.115.19(.)218 LACNIC for whom the technical contact was once again Evgeniy Marchenko with the same telephone number and email as the domain above. Spammm(.)info redirected to Goldemails(.)ru at the time of the report (Jan 14, 2018)

MYPAYS(.)Info - Registered January 8th, 2018 by a Nikolay Kolchanov with the email of kolchanov-n@ya(.)ru and also hosted at 190.115.19(.)218 LACNIC for whom the technical contact was one Evgeniy Marchenko with the same telephone number and email as the domains above.

Nikolay Kolchanov has also been the registrant for domains 8800(.)city minisite(.)one partnerlnk(.)net v-kontakte(.)co ellinks(.)org my-kassir(.)org partnerslink(.)me homebusines(.)info partnerlnk(.)com and qwerty40(.)com

Evgeny's business email e.marchenko@ddos-guard(.)net does not currently show up on any WHOIS records, however, his personal email xengine@mail(.)ru has registered two domains: cognitive-machines.com and rostov.pet. Rostov.pet historical whois data shows the following registrant information (click to expand):

Whois records for ROSTOV.PET

Tale of the VPS Providers That Couldn't

Mike Jones — Sat, 27 Jul 2019 18:38:49 GMT

As some may already know, EY.MD is something I do in my free time for no specific reason. I've thought long and hard (not really but it sounds good) to figure out why I continue to bother with all of this and I wasn't able to find a concrete answer. All I know is that some of the shit I put on here or other portions of the site make me laugh. I'd like to take this opportunity to show you some of the behind-the-scenes but mainly focus on the VPS providers that couldn't provide what they claimed to provide.

For the longest time, the storage.ey.md portion of the site was hosted with Servarica, not because I liked it or because they had a revolutionary product but because they offered 2TB of storage and adequate resources for the cheapest price ($5 a month). All I was using this server for was hosting random shit and allowing people to upload files through a file hosting script. When the Christchurch Shooting happened I acquired all of the videos and webm's through 4chan's and 8chan's boards as well as some from KiwiFarms. The majority of file sharing links that were being spread around were constantly being removed by hosting and service providers, that's when I had the idea to bring up a file hosting script and upload the files and share the links. This was done for two specific reasons: to reduce the bandwidth of providers that were not budging to bullshit abuse reports (such as KiwiFarms) and to provide people with the opportunity to view such content if they chose to do so.

If you look at my transparency report page, you'll see that I've received 2 direct complaints/claims to date and the other 2 were sent directly to the provider (IP address owner) through CloudFlare. I had my fun with the original 2 complaints and then did not hear back from them until the 23rd of this month. It's important to note that shitty New Zealander ISP's like Spark resorted to establishing DNS-level blocking of my site as well as any other sites that did not respond affirmatively to their content removal requests.

I continued to host the shooting videos along with Brenton Tarrant's manifesto until an 'Anonymous' reporter submitted an abuse report through Cloudflare which was then forwarded to the provider. The provider, in this case, was Servarica. They received the complaint, suspended the server, and did not offer any information why that was done until I submitted a ticket myself. They promptly unsuspended it and allowed me to move anything I needed to move, however, they told me they would be unable to let the server remain online if such content was not removed. You can see their final reply below:

Final ticket response from Servarica staff Hani A.

Not being mad at Servarica at all, especially when you consider that they are a small provider and don't want to do the leg work of figuring out what is illegal and isn't illegal, I simply chose to move all the data, remove it from the server and told them the content was removed. I then proceeded to cancel my services with them as while I like supporting smaller companies, I won't bow down to bullshit censorship attempts.

My next stop on the list of VPS providers was Secure Dragon for which I reviewed the Terms of Service before purchasing and saw no terms that I would be breaking by hosting my storage repository there. After bringing storage.ey.md online, it took them 6 hours or so to simply refund me my money and shut the server down without so much of an explanation. I didn't care to find out, I just simply moved on looking for a non-retarded provider.

My final stop before going with the provider storage.ey.md is currently hosted on, I found a VPS provider in the shit-tier country of Lithuania. That provider was Time4VPS, and it was the best stop on my journey if you're grading by lack of english comprehension and shitty customer service. I purchased and finished setting up the newly provisioned Storage VPS on July 25th 2:30 AM CST. The server was suspended at 6:10 AM CST that very same day (while I was sleeping in my wheelchair), that's a fast turn around on an abuse report. They provided me with the following information in the support ticket:

Time4VPS - First Ticket Response

I, being the paraplegic African American, responded asking them to show me where in their Terms of Service it states that footage of a shooting video is not allowed. It wasn't in their Terms of Service but they wouldn't admit to it and rather just wanted to go in circles with me. It's also important to note this is a 'DMCA Notice' that is not filled out in the proper DMCA format, good job. I'm done narrating this shit, just look at the convos below:

Regina starts talking out of her loose Lithuanian asshole

Oh no, what will I do without Lithuanian services ??? :(

My dog typed this, I take no responsibility.

Not refundable is important to note here, because I did get my money back.

Two can play the game of time constraints.

Lol, not refundable huh? I have a U.S. Paypal Business account with $5,000+ (avg) in monthly spending, do they honestly think PayPal would side with them over me?

Yeah, good luck with that refund policy in the future.

Following the tradition of using faces of people that did not agree to it, enjoy my amazingly edited image below which includes a random whore from Time4VPS.

Time4VPS staff being shot

So now that we have all that out of the way, storage.ey.md found a new home and will continue to host the New Zealand shooting videos, amongst other things.

I recommend you stay away from these providers, outside of Servarica as they've actually been pretty cool for the most part. As for Time4VPS specifically, I hope they kill themselves.

Thanks for reading the diary of a paraplegic African American man.

George Milnes AKA Emery

Mike Jones — Wed, 12 Jun 2019 03:13:54 GMT

George Milnes AKA Emery

George Milnes is a youth currently residing in the United Kingdom who has severe mental problems as well as a fetish for hairy Muslim men. He has failed throughout his life, most notably: keeping his fetish secret. Him and his brother (Harry Milnes) were most likely engaged and charged with incest on August of 2015 but my sources tell me they've continued down that bacteria-ridden road of incestuous sexual gratification at their father's satisfaction.

Update: As of 4/30/2020 GeorgeMilnes.com now redirects to this blog post.

George Milnes, Kev Milnes, Harry Milnes (from left to right) - Photo credit: Shalom Handjoberg

George was attempted to be educated by the government at South Wirral High School, and took on a role of a Laboratory Assistant from April 2011 to March 2012 in order to perform free tests to determine the type of venereal diseases he had.

As a matter of public record, he has maintained the following email addresses:

georgemilnes1@outlook.com

kingofnynex@live.com

Mail archive from OpenIndiana confirming identity of Emery (George Milnes)

Both George Milnes and Harry Milnes have previously resided in Huddersfield, Lepton and Harrogate. If you come across any members of the Milnes family tree, we urge you to pop an anti-autism pill and ensure you carry sufficient proof that you are not related to them. Only the non-related are safe from sexual encounters.

The images below were sent over to me by an anonymous party using a throwaway email address. I've attached them here for your enjoyment :)