Started from buyfakepassports.com re-directing to fakepassportsale.cc.
Hmmm. Country domain “cc” = Cocos Islands.
buyfakepassports.com whois registration date:
Created: 2010-04-26
Expires: 2011-04-26
The sites are together in the same IPs with the FakeVimes rogues and other exploits and malware.
“For entertainment only…” Right.
Thanks Patrick Jordan
Tom Kelchner