Both <a href="https://white.ly" rel="nofollow">https://white.ly</a> and <a href="https://zz.cx" rel="nofollow">https://zz.cx</a> redirect redirect to <a href="http://liz.tm/ginger/index.html" rel="nofollow">http://liz.tm/ginger/index.html</a>. The certificate is self-signed by ginger@liz.tm of the organization TFB Technology Ltd (CN=ginger.liz.tm)<p>A whois of liz.tm reveals similar information to before:
Owner : Nicola Worthington<p>More interesting is that all three domains (white.ly zz.cx liz.tm) host an Icecast media streamer on port 8000.<p>Also found this: <a href="http://www.tfbtechnology.ltd.uk/" rel="nofollow">http://www.tfbtechnology.ltd.uk/</a>
Ok, so in the MP3s folder under data, Air - Sexy Boy wasn't the song I was expecting, instead it was "Never Going to Give You Up".<p>I suspect some sort of marketing ploy...
A whois lookup says that this is registered to a Claire Whitley. I sent her an email asking what the deal was.<p>EDIT: Upon further investigation, this thing is filled with rickrolls
<a href="http://www.psmon.com/" rel="nofollow">http://www.psmon.com/</a>
this one is the same one i guess
and the email address of p1x3L5H4gg@hotmail.com on
<a href="http://bb-105-33-186-93.fallbr.tfb.net/Logitech%20Webcam/index.html" rel="nofollow">http://bb-105-33-186-93.fallbr.tfb.net/Logitech%20Webcam/ind...</a>
I scraped a file list if anyone's curious: <a href="http://bochs.info/~aegis/files.txt.bz2" rel="nofollow">http://bochs.info/~aegis/files.txt.bz2</a>