I was wondering if the payment processor would block the ridiculous number of transaction coming from the scam site.
The requests aren’t sent through the scam website.
The guy wrote a python script that impersonates the requests sent by the scam website. So what they will see in their logs is his current IP
I understand what you mean now. The payment processes would surly block that IP, but he was getting reference numbers for each request.
Would the request not need some kind of access id of passphrase to associate the charges with the account? He copied a slew of variables that we didn't see. They can't bill for transactions by IP.
Vendor and transaction IDs (and other irrelevant keys/values) seem to be the way he thinks a declined payment is logged/charged. My guess is that it’s also linked to a fixed IP.
I’ll take a deeper look at it later.
Could be the guy just set that all up to make a video.
(post is archived)