How aka/aakkaa/KAiSA pays for his sites
RELEASE DATE: 2017/05/23
Hi Friends Fans!
Better grab some popcorn and a soda, this will be a longer read on how some
sites are being financed. This will contain alot of pictures, text, german logs
and even videos! We will explain the most important passages, for all the
translation, ask your fellow german friend. So lets get started.
The guy we have to talk about is (who would have guessed) aakkaa/aka/KAiSA who
runs the groups NOSCREENS/AN0NYMOUS/FORBiDDEN/ROOR/MELiTE/TVSHiT/iCON and alot
of other crappy groups. He will be addressed as aka in the rest of this
document, to keep things simple.
Not only does he sell a big part of the affil slots of his groups on his and
other peoples sites to random people, he also runs a secret dump, filled with
payleecher. Lets start with that one:
As you can see in the first picture (1), this is his FTPRush, that is being run
on his Windows Shell (yes its 2015 and its still Windows XP without updates or
a password for days after being installed). Now take a good look, on every
site his username is aka, but wait, its not on every site! On something
called NYC, his username is ORGi. Lets take a closer look at NYC. As you can
see in picture (2), the user ORGi is siteop on NYC, added by glftpd almost 2.5
years ago. He is in the groups ORGi, ORGi_FRiENDS and SiTEOP. Remember the
ORGi_FRiENDS group, its essential. Picture number (3) shows you that this ORGi
guy is taking the job seriously, with almost 7 terabyte in uploads. You can also
see that NYC is offering every section a paying user might wish for.
We start with the userdb of NYC. As you can see in picture (4) (5) and (6), the
dump is splitted into several groups, each one represents a siteop and its
customers. We see 7 siteop users, but only 4 are real persons, namely plavix
(groupsPLAViX, PLAViX_FRiENDS etc.), miz (groupsMiZ, MiZ_FRiENDS etc.),
Memphis (groupsMEMPHiS, MEMPHiS_FRiENDS etc.) and last but not least our person
of interest here: ORGi (groupsORGi, ORGi_FRiENDS etc.). The paying users are in
the FRiENDS group of the siteop they pay to. We also see in the same pictures,
that 77 accounts are added to this gl, 73 out of them have leech and 13 are
deleted (probably didnt pay yet).
Picture (7) and (8) show alup/aldn. If you pay attention to the numbers in these
pictures, you will notice some of them are so big, glftpd cant display them
properly. Memphis for example has over 100 TB upload, while the first 3 guys
combined in aldn have more than 100 TB in downloads. Wonder why anyone would
leech such amounts, if not to spread it further on websites/torrents etc., but
thats pure speculation.
So far so bad, now lets move on to his affil slots. The real group member in
the following pictures are cut out, since they dont know anything about the
stuff going on, so no point in harming them. In picture (9) you can see the
ginfo of AN0NYM0US on C**. Out of 9 people added to this group, only 4 of them
are actually in the group, everyone else is paying in some form. Next in line is
the ginfo of NOSCREENS on a site called W** (10). Out of 7 group slots, only 2
of them are filled with group members, the other 5 are suppliers. Next one is
SK (11), a site aka runs himself. Here we have 9 people added to the group
AN0NYM0US, 4 of them are real members, rest is paying. Its the same pattern on
every affil site ...
Now lets get to a very intresting part, an ICQ log, stolen from akas computer.
He talks to a guy named hblock, his IRC nick is h-block, you can find him on
linknet. This is akas main money supply, he is part of the pay-dump staff,
collects the money from the paying users and paypals it to aka. He is the guy
who foots the bill for SK and other aka sites. You can read in this log how h
-block complains about the poor payment morale of his customers, how aka is
offering slots for sale (one time payment or monthly) and how h-block
recruited some random guy from outside the scene, who paid 550 for a leech on
C* and another private dump aka runs). The log shows he was brought to aka
on the 29th of July and he got added to C* and the private dump the very next
day. At some point you could find this guy in almost every sitechan of the
sites aka affils on or ops.
The ICQ logs are only in german and some parts have been redacted to keep
sites and users that are not knowingly involved into this mess private. There
are also two other logs included, one with a customer (TommyHQ) and one with
another pay-dump op, plavix.
Now to the videos:
They are not very extensive, but they show the money influx this guy has on his
paypal (usually from the same people sending). August 15 for example is over
1747 Euro. And paypal is just one part of the money transfer. As you can read in
the logs provided, there is also money being sent directly to his bank account.
v1 - Paypal
v2 - ICQ (to show where these ICQ logs come from)
For the lulz we also included an Excel file when he tried to do some accounting
about his customers. Its old, but it shows how long this guy have been doing
We know this is alot of stuff and some of it is redacted to protect innocents
and hard to proof. We could also include all of his personal info that links the
firstname.lastname@example.org addy hes giving out to customers in picture (12) to the RL
person, including FB photos etc. but no point in exposing this at the moment.
Take the stuff as it is, think thoroughly about it, check out the formerly
released nfo The.Truth.about.KAiSA.aka.KS.aka.K__S_.running.payd.sites-CLEANER
and it will all make sense.
Some people will wonder who around him knows about it, since hes running these
sites together with some well known guys. Sadly, we cant really answer this
question, we assume most of the people who have +1 on his sites dont know or
dont want to know, else he wouldnt hide his customers in his affil groups even
on his own sites. But there must be someone who knows. NYC has to be filled from
somewhere and we couldnt identify the biggest uploader Memphis, but some
tech/op must have installed the mirror scripts and such amounts of download
usually dont go unnoticed...
Notes: - The quakenet tag he has in Mirc is to avoid EFnet/Linknet prefixes.
- We left the first letter of every site in his FTP Rush and the BNC Port so
every siteop can find his site - The IP of the pay dump is real, it has no entry
Update 1: Checked in Dec 2016. if anything changed, but ofcourse not.
Btw the vnet login mentioned in the beginning of the hblock ICQ log
still works. You can see the costs of the SK link there.
Update 2: Some people may think Wow this is old stuff. Why release this just
now? You are absolutely correct, we should have made this public right away,
but we tried to avoid the drama following all this and tried to avoid hurting
innocent people. We also confronted aka, hoping it would make him stop. But he
doesnt see anything wrong in all of this, so instead of stopping, he went ahead
to open more and more sites, dragging more and more people into this shit, even
supplying his dirty money to well known game groups.
Some sites and IPs may have changed over the 1.5 years, the issue didnt.
Lets hope some people who know about this and still associate with him, will
wake up now instead of swallowing the every site needs suppliers crap! Non-
scene users moving to p2p and god knows where else are not legit suppliers! But
knowing the scene, things will go on as usual, you just wont be able to say
I DIDNT KNOW ABOUT THIS, I SWEAR!! anymore...
We are Legion!
We do not Forgive!
We do not Forget
.:.MisterX MisterY.:.:.. \/ // / ::.::.:::.Site Scripts V2.0: