📸 Photo

KINGPIN

plates carried the logo for an organization called the National Cyber Forensics and Training Alliance in Pittsburgh. Max looked them up; it was a fed shop. Someone connected with DarkMarket was working for the government.

Determined to investigate, Max breached DarkMarket again through his back door. This time, it was a reconnaissance mission. He dropped into a root shell and entered a command to bring up the recent login history and then started down the list in another window, checking the public registration records for each of the Internet IP addresses used by the administrators. When he got to Master Splyntr, he stopped. The supposedly Polish spammer had connected from an IP address belonging to a private corporation in the United States called Pembrooke Associates.

He pulled up the Whois.net registration records for the company’s website, Pembetal.com. The mailing address listed was a PO box in Warrendale, Pennsylvania, twenty miles north of Pittsburgh. There was also a phone number.

Another click of his mouse, another browser window—the reverse white pages at Anywho.com. He entered the phone number and this time got a real street address: 2000 Technology Drive, Pittsburgh, Pennsylvania.

It was the address he’d already found for the National Cyber Forensics and Training Alliance. Master Splyntr was a fed.