XyliBox

Off-sho.re and Darkode

noreply@blogger.com (Steven K) — Tue, 21 May 2013 16:16:00 +0000

In April i got a DDoS attack (lol, good luck to take down google)
Nothing really high on my site, temari.fr suffered a bit, and i grabbed alot of weird referrers.
Fun things: some pointed to winlocks system like Multi Locker 3 on 212.2.227.88 and some other shits i've hacked the same day)
Brian have do an article recently about his DDoS http://krebsonsecurity.com/2013/05/conversations-with-a-bulletproof-hoster/
And because i'm concerned, many asked me explanations or sent me Brian article link via mail.
I've also entered in contact with off-sho.re.
Not directly, i told someone to talk him and see where he can go on the conversation, i was just intrigued by the price off-sho.re can do.
Here is the chat log:

Jorik  4/10/2013 6:36 PM
 sup 

Off-sho.re Hosting  4/10/2013 6:36 PM
 Away message: Away 

Jorik  4/10/2013 6:37 PM   
 Code: "STOPHAUS" 

Off-sho.re Hosting  4/10/2013 6:42 PM  
 hello, your nickname on DK?             

Jorik  4/10/2013 6:43 PM  
 gofuck 

Jorik  4/10/2013 9:20 PM  
 hi there now 

Off-sho.re Hosting  4/10/2013 9:20 PM  
 hi 

Off-sho.re Hosting  4/10/2013 9:20 PM  
 please name the domain you want 

Jorik  4/10/2013 9:20 PM  
 so what i need to give for domain reg 

Jorik  4/10/2013 9:20 PM  
 ok wait 

Off-sho.re Hosting  4/10/2013 9:20 PM  
 it in .ru zone 

Jorik  4/10/2013 9:21 PM  
 .ru domains? 

Jorik  4/10/2013 9:21 PM  
 ok 

Jorik  4/10/2013 10:15 PM  
 madtrade.ru 

Off-sho.re Hosting  4/10/2013 10:15 PM  
 Away message: Away 

Jorik  4/10/2013 10:15 PM  
 or h4cky0u 

Off-sho.re Hosting  4/10/2013 10:16 PM  
 and NS or IP? 

Jorik  4/10/2013 10:16 PM  
 wait 

Jorik  4/10/2013 10:16 PM  
 i will not get domain panel etc? 

Jorik  4/10/2013 10:16 PM  
 to change ns/ip 

Off-sho.re Hosting  4/10/2013 10:17 PM  
 no, its a BP registrar 

Off-sho.re Hosting  4/10/2013 10:17 PM  
 you can give me NS and manage the domain yourself 

Jorik  4/10/2013 10:18 PM  
 ok ns2.he.net , ns3.he.net , ns4.he.net ns5.he.net 

Jorik  4/10/2013 10:27 PM  
 also need to ask, if i buy hosting, how to configure it for tor site 

Off-sho.re Hosting  4/10/2013 10:27 PM  
 done 

Off-sho.re Hosting  4/10/2013 10:27 PM  
 i do that for you for free when you buy a server 

Jorik  4/10/2013 10:27 PM  
 ok 

Jorik  4/10/2013 10:28 PM  
 btw domain done and which one? 

Off-sho.re Hosting  4/10/2013 10:28 PM  
 madtrade.ru 

Jorik  4/10/2013 10:28 PM  
 ok 

Jorik  4/10/2013 10:31 PM  
 price of server? 

Off-sho.re Hosting  4/10/2013 10:31 PM  
 Away message: Away 

Jorik  4/10/2013 10:31 PM  
 just need to run carding forum, blackmarket type 

Off-sho.re Hosting  4/10/2013 10:32 PM  
 that is likely to get abuses 

Off-sho.re Hosting  4/10/2013 10:33 PM  
 and what server specs do you look for? 

Jorik  4/10/2013 10:33 PM   
 don't know, any kind of server or vps, just no logs and secure 

Off-sho.re Hosting  4/10/2013 10:34 PM  
 my dedicated ones start from 100 

Off-sho.re Hosting  4/10/2013 10:34 PM  
 that means the server is only yours and you can even encrypt the /var partition with your web data 

Jorik  4/10/2013 10:35 PM  
 ah great, i'll contact you soon 

Off-sho.re Hosting  4/10/2013 10:35 PM  
 great, thanks for contacting

Now about the madtrade.ru domain, the weird things come from the whois.
http://who.is/whois/madtrade.ru

Off-sho.re is probably selling his bulletproof domains via webnames.ru and i think he's not reseller.
He just buy domains via his webnames.ru account and sell them by setting up customers nameservers.
He don't give them domain panel or anything, so he can do changes anytime.
For information, webnames reseller list is available here: http://www.webnames.ru/en/scripts/resellers_list.pl
I was little bit confuse as domains registered with webnames doesn't show reseller name, but off-sho.re's name is not in reseller list so likely he's not reseller.
He also sells domain via naunet.ru probably
Naunet is the actual domain provider for darkode and naunet is also famous for bulletproof domains.

When 'gofuck' got darkode domain suspended, they contacted naunet and naunet contacted pdr (PublicDomainRegistry) and told them to unsuspend domain:

Turnaround situation:

darkode 'suspended' NS:

Fun datas, darkode belong to briankrebson@gmail.com:

gofuck got their domain suspended by giving them screenshots of posts in darkode, the mywot scoreboard also helped according to him. (http://www.mywot.com/en/scorecard/darkode.com)

They cleaned it now, it was red before and off-sho.re helped them to make it in yellow zone he provided fake ratings and stuff.
darkode got suspended on 15th april and they got it fixed on 17th.

off-sho.re is also obviously listed on SpamHaus (http://www.spamhaus.org/sbl/query/SBL182932)
And member of the StopHaus project but i don't need to explain that.
off-sho.re seem to use mainly the e-mail "admin@off-sho.re" as contact, a simple search in Google and you will find alot of information regarding whois and domains details
You can even find his Webmoney, Liberty Reserve, email addresses, ICQ, forum profiles etc...
Some examples:
http://passport.webmoney.ru/asp/CertView.asp?wmid=180676440296

http://www.icq.com/people/10444/

Some whois:

Also congrats for your level 2.

And about darkode, here we go...

hotcoffeecup@jaim.at Acidcoffee
s3x@neko.im specialist
Arcore@jabber.org Arcore
sana@thesecure.biz Sana
silic0n@jabber.org  Craig
split@thesecure.biz SpliT
ihack@thesecure.biz  hen
systro@jabber.org systro
mafioso@xmpp.jp Mafi
zer0day@xmpp.jp  zer0
c4rl0s@jabber.ru  Carlos
ipwn@cih.ms  ipwn
g0dlike@jabber.org  g0dlike
h0tsh0t@jodo.im h0tsh0t
jumbie@jabber.ru  Jumbie
off-sho.re@jabber.vc off-sho.re
x0x@jabba.biz nibo
bestkrypt@rkquery.de bestkrypt
elzig@exploit.im elzig
na@exploit.im specialist
m3gatr0n@jabber.ru  m3gatr0n
nassef@thesecure.biz  nassef
teardrop@swissjabber.ch  g0dlike
gamoonty@xmpp.jp yegor  (carder) new non accepted
mojitka@jabber.org  Mojikta
the_bond@jabber.org   thebond
rzor@jabber.org rzor
x47@xmpp.jp  x47
mrborisb@xmpp.jp borisb
RG.JR9@thesecure.biz J.P MORGAN
zigma@jabber.org zigma
propack@neko.im propack
dilibau@qip.ru dilibau
r3vproxy@jabber.org  r3vproxy
synthetic@exploit.im  synthetic
ling0@jabber.ru  K!NG

Here are some jabbers, of course just a small part, my listing is more long than that.
And i don't see the point to release my lists of icq/jabber/lr/wmz/aliases etc...

For me, darkode is just another wannabe private forum i've exposed, and when i do re-post like this, i don't do it because i care of this forum but due to an answer (on this case: off-sho.re).
That will annoy some people listed here to re-create a new address, but who gave me the stick to be beaten with ?

And about bulletproof hosting, here is an old conversation between GrandHost and Nassef, may that can interest someone.

As usual there is a lot of things to say, but i will stop here.

Liberty Reserve Curl Scam script

noreply@blogger.com (Steven K) — Sat, 18 May 2013 15:38:00 +0000

Since i started to speak about fake carding shops and LR phishing, many requested me the scam script who start to become popular for an unknown reason.

Alright... let's make it public.
http://temari.fr/LRcurlScamScript.zip

Thanks for the Evangelion gift @unixfreakjp, appreciated :D

Picebot pharming botnet

noreply@blogger.com (Steven K) — Sat, 18 May 2013 15:21:00 +0000

Nothing new here, just got the oportunity to force a Picebot panel recently.
At MalwareIntelligence, Picebot was identified the 19 January 2013 by Ernesto, he have do later a post on his personal blog: http://oberheimdmx.blogspot.fr/2013/01/qhost-picebot-nueva-botnet-en-latman-el.html

And recently still in internal, Ernesto have found another location of a Picebot panel, this botnet is not really interesting due to the lack of feature and the programing language used but some screenshots are always cool.

Adv:

Dashboard:

Update:

Host:

Password:

'Actualizar' refresh the panel and 'Limpiar' clean the stats.

Cardingmaster.com carding shop

noreply@blogger.com (Steven K) — Fri, 10 May 2013 09:16:00 +0000

• dns: 1 ›› ip: 174.136.55.117 - adresse: CARDINGMASTER.COM

Mail:

Let's destroy another shop...
/home/cardingm/.lastlogin: 41.225.221.30
Admin IP used on shop: 41.227.48.25

Admin login:

Dashboard:

Edit news:

Ads manager:

Categories:

Edit category:

View cards:

Edit card:

Import card:

Export card:

Paypal:

Accounts:

Users:

Deposit history:

Order history:

Search card:

Send PM:

User edit:

Add user:

Send email to users:

Group manager:

Shop statistic:

Seller statistic:

Upgrade history:

Deposit history:

Order history:

Check history:

Shop settings:

Bonus manager:

Tools manager:

Spam tool:

The server was also used for phishing:

In 'normal' mode the shop look like this:

And yes it's déjà vu all over again, they use the Vampire.Vn Shop

Want a dump ? sure.
http://temari.fr/cardingmaster.com.zip
As this shop is new they have not alot of users, so i've included the php and shit to compensate.
credit card details are not included.

getdumps.com Fake Carding shop and LR Curl scam script

noreply@blogger.com (Steven K) — Sun, 05 May 2013 13:43:00 +0000

Another (lame) and fake carding shop:

• dns: 1 ›› ip: 94.215.213.31 - adresse: GETDUMPS.COM

Spam:

Dashboard:

Paypal:

Dumps:

Cards:

Ebay:

Western Union transfer:

SSH Server:

RDP Server:

SMTP:

VPN:

Tools:

cPanel:

c99 shell:

Balance:

My products:

VIP:

If you try to add funds on the shop with your Liberty reserve account, a script will wipe all your money.
people looking for LR Curl script:

People selling the script on carding forum

Scam site example:

LR Curl script in action, detail of victims are saved into text files

More than 1000 carders got scammed by this, jackpot for the guys behind.

Someone who card:

Declined payement for Avira:

Another guys:

Another..:

Want have fun too ?
http://temari.fr/getdumps.com-users.txt

passwords in plaintext, happy lurking.

Fake carding shops

noreply@blogger.com (Steven K) — Mon, 29 Apr 2013 10:04:00 +0000

Nothing new here, just three forums used to scam stupid people like carders.
It's always the same method: advertising via spam and to view the content you must pay a fee.

Our first forum is a phpbb with fake statistic.
• dns: 1 ›› ip: 50.7.199.110 - adresse: FORUMSCC.COM

Forum look's huge:

Users are charged a $0.5 LR fee to view forums:

Fake online users:

Second example, fake carding shop:
• dns: 1 ›› ip: 96.125.170.142 - adresse: MARALIMACLASSIC.COM.BR

The captcha is iframed:

When you complete the name field and click login you are redirected always to register.html

The site index is defaced by a random lammer:

When you click to register you are redirected on a fake Liberty Reserve page:
• dns: 1 ›› ip: 198.24.144.50 - adresse: SCI.LIBIRTYRESERVES.COM

Another fake site, probably do by the same guys:

Mailer:

Some other files found on the compromised server, cPanel bruteforcer:

Another cPanel bruteforcer:

Ac1db1tch3z x86/x64 Linux kernel exploit (EXP/Linux.Small.AU):

The mail lead here:
• dns: 1 ›› ip: 199.79.62.93 - adresse: ZCB.CO.IN

And when you click on register...
• dns: 1 ›› ip: 50.28.73.7 - adresse: SCII.LIBERTYERESERVE.COM

PHP stuff can be found here: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2410&p=19111#p19111
EXP/Linux.Small.AU here: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2697#p19112

Phish a phisher

noreply@blogger.com (Steven K) — Mon, 22 Apr 2013 18:41:00 +0000

Everything started from a simple phishing mail as usual...
And some traps who have do all the magic... i've phished the phisher.

Some phishing pages on a compromised server:

The guys behind these fishs is know as 'Tonix', here is a screenshot of his mail adress:

Here, Tonix test his fake paypal template, the link lead on a phishing redirector.

The server was hacked due to a vulnerability with 'lang_wmps' the hacker have uploaded a well know backdoor: WSO

Paypal Phishing:

After re-hacking the compromised server and changing the pass of the backdoor we got the mail adress:

tonijuve10@inbox.com... let's have a look now:

256 mails (without mails inside the junk folder and deleted folder) this email is used only for his phishing activities.

On the 'sent mail' folder there is mails of 2012 with phished datas.

The case of Phyllis Stevens, datas phished the 14 april 2013:

Phyllis Stevens credit card used to buy a server the 15 april 2013:

Tonix leaved several trace of him, example here testing his phishing page:

Same IP found on access log who connect to the backdoor:

216.104.32.43 is a ExpressVPN IP:

And of course, Tonix use/carded this service:

On another compromissed server, you can clearly see another IP exploiting and 216.104.32.43 login.

SQL injection used:

71.187.243.7 is a VPS IP and the user-agent on access logs tell us that he used Havij to exploit the SQL vulnerability:

The phishing spam is also sent from this machine.

Having fun with metasploit and the good MS12-020

not worked here but i should do that more often on carded vps :)

Tonix have access to several compromised VPS, some even warn you:

He have also some compromised POS:

Brute force attack on another compromised server:

Failed exploitation for a plugin who don't exist:

Bank Of America phishing:

The phishing kit used for Bank Of America is even backdoored, did Tonix know that ?

And also $remote = $_POST['REMOTE_ADDR'];
MR.M1ND.php?REMOTE_ADDR=./../../../../../etc/passwd
Paypal and Bank Of America phishings can be downloaded here: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2431&start=10#p19028

The attacker (91.187.125.189) according to log files used the edit template feature of Joomla to upload a backdoor.
Also seem someone tryed to find a phishing kit archive, here is what i've found inside the log file: http://pastebin.com/XWx8DXuZ

Another example:

Tonix seem Albanian and have did several orders with his real identity.
I've found various SMS in Albanian with his phone number, most of messages are about chilling with friends.

On another email the phone number is the same for shipping information of 'Faton':

Tonix is a big fan of Juventus, some of his passwords are even related to this club.
He have do many sites related to Juventus, like grandejuve.com
A whois give us an ytahoo adress 'rodrigue123456789' registered by Tonix.

On another order, same shipping information:

Beats by dr.dre registration to 'faton':

DHL tracking for a product:

Apple store carding:

Order to Arben (a friend of him?):

Another order to Arben:

Failed order to Adnan:

Although one order seem not carded:

Seems like he's been doing phishing/carding since 2011:

Visual map based on shipping details:

Faton selling stuff, the phone number is the same for carded stuff.

Facebook profile:

I got the confirmation that it's him on facebook via his twitter profile

Same head, same interest in Juventus, same location but the website link have not the same gTLD.
After searching a whois, the email is registered to Toni and registrant details make me think he carded the domain.

He even carded a domain for a member of his family

Anyway with everything here i'm not going to give his details to authority, but he should take care and leave the business, carding and phishing is definitely not for him.

System Care Antivirus

noreply@blogger.com (Steven K) — Fri, 12 Apr 2013 21:08:00 +0000

System Care Antivirus is a fake anti-spyware tool. It displays fake alert messages, prevent execution of legit programs and detects inexistent infections to scare users.
It is a clone of AVASoft Professional Antivirus, Disk Antivirus Professional, System Progressive Protection, Live Security Platinum, Smart Fortress 2012, Smart Protection 2012, Personal Shield Pro.

To register (and help removal), copy paste this code: AA39754E-715219CE

Note for reverse engineers ~

systemcare-antivirus.org:457 - 62.75.235.70

Payement processor for FakeAV
smt-sps.com.tn/ClickToPay/Avasoft/pay.aspx - 193.95.113.157

https://www.virustotal.com/fr/file/ef2cc38c419000cc38982f65a160ffb2158a9136a6e72e055aa6f0856dd095e2/analysis/1365800945/

Skimmers: NCR/Diebold/Wincor

noreply@blogger.com (Steven K) — Sun, 07 Apr 2013 22:01:00 +0000

Advert:

Pictures:

Some picture from the youtube video:

Also remember this guys 'pUre' ?
He published a photo of what he do:

Phishing made easy, way too easy...

noreply@blogger.com (Steven K) — Sun, 07 Apr 2013 07:09:00 +0000

You just have to type 'scam pages' in Google and the first result is cool.

Phishing, phishing!!
See them everywhere.. Mr. HItman is well famous for making them..

Paypal pack 'private'

Letter templates:

Backdoors:

A simple google search...

Also, a small trick to find compromissed server used for mailing:

---

For the phishs, it's some lame Amazon:
http://www.phishtank.com/phish_detail.php?phish_id=1783326
kernelmode thread: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2431&start=10

Elite VPN Service

noreply@blogger.com (Steven K) — Sat, 06 Apr 2013 16:25:00 +0000

Elite VPN Service is a service advertised on underground forum

Subscription list:

Subscription configuration:

VPN certs:

ppc.su Affiliate

noreply@blogger.com (Steven K) — Wed, 03 Apr 2013 12:05:00 +0000

Advert:

I thought it was related to Beecoin, due to the design (know for FakeAV)

According to TrendMicro BeeCoin generated US$123,475 in profit.
But after some talk with the Affiliate owner seem ppc.su is clean, anyway here is some screenshots if you want see the 'inside'

Login:

Stats:

Account:

Payement:

XML Feeds:

Contact:

Tickets:

On the last screen:
Partner: Hello, how can i get ID?
Admin: Tell me about your traffic, thanks
Partner: Traffic comes from search engines results substitution pages
Admin: Account had been activated
Parter: Thanks
Admin: We are welcome to any questions

PPC:

All links lead to 95.211.193.15/?clid=xxxxxxxxxxxx

I Accidentally…

noreply@blogger.com (Steven K) — Tue, 02 Apr 2013 16:59:00 +0000

Another things, not new but don't want publish that.. till now...

My first post was not an april fool, and not only 'nassef' was compromised

Since Brian burned the covers (http://krebsonsecurity.com/2013/04/fool-me-once/), seem it's ok to post.
I really hope people take the time to click the screenshots linked in the story
For level 2 private messages and stuff... this time i keep this version for me, end.

Darkode KeyGenMe #1

noreply@blogger.com (Steven K) — Mon, 01 Apr 2013 16:36:00 +0000

b09910eb1f7a6a86769e0fcdbeb7d694

Just for fun.

Darkode leak

noreply@blogger.com (Steven K) — Sun, 31 Mar 2013 23:22:00 +0000

And you can thanks Nassef.
http://lists.emergingthreats.net/pipermail/emerging-sigs/2012-August.txt

I don't know if it's you who did this shit

upaskitv1.org 
xylibox.biz 
krebsonsecurity.biz 
upaskitversion1.biz 
stevenk.biz 
briankrebs.biz 
upaskit1.biz 
researchsecurity.biz 
securityresearch.biz 
amatrosov.biz

But seems you are related to this so i gave a fuck.

Also i can thank you for this:

Got your Builder from Darkode and made my keygen.
I also grabbed alot of other things but it's another story.

Nassef is also involved into POS sniffing.

Trying to deal with carder shops:

But i will not talk of Nassef here, but of 'darkode'
This forum is know to be a 'elite' community of black hats, there is alot of (in)famous actors inside.
Some are already jailled and some are still on business.

Darkode login with a really gay captcha.

And about the captcha they added it due to me:

I don't live in Lyon and i never walked with you, get a life man.

About the captcha something worry me:

Seem he sniff passwords, i'm sure the login form is even backdoored to know passwords of his users.
Also this is not my bruteforce, when i bruteforce it's more hardcore than this shit.

Darkode, on a short period even asked a private SSL cert to avoid unauthorized people:

They removed it for an unknown reason, (probably due to the skid wave end), admin of DK gived invite to everyone recently (i even received one without doing nothing, i'm not sure if it's black hat humor or if someone posed on dk and gived my mail)

Anyway i don't need this invitation.

Now, let's have a look on who's inside darkode...
symlink:

Paunch:

TinKode:

bx1:

BestAV:

Severa:

Exmanoize:

alexudakov:

Carberp

J.P.MORGAN

Even Slavik according to admin:

Some members listed here are already jailed, e.g: bx1, TinKode.

A member who show off his money done with SpyEye ($11,404,34 USD):

Another DK member who have launder 20k LR with members of this forum:

Sweet orange stats of a guys:

Coder of crimepack angry for the leak:

Presentation of cr33k, coder of “Open Source Exploit Kit”

"I skimmed Diebolds", "as a mule i cashed out WU payments with fake IDs"
There is some nice people on darkode...

Presentation of Egypack exploit kit:

Business advice from a darkode admin:

Now about darkode you will says "wow, this board is hardcore" but no... not really
Maybe this forum was cool in 2009 with Gribodemon and shit's but actually it's look like hackforums.
And about hackforums even admins are on it:
mafi (www.hackforums.net/member.php?action=profile&uid=82912)
Selling crimepack:

sp3cial1st (hackforums.net/member.php?action=profile&uid=666599)
Recruiting hackforums people for darkode:

Fubar (hackforums.net/member.php?action=profile&uid=83826)
HF Leet:

(and they are all admins on darkode)

profile of mafi on malwareview (a kernelmode.info like but with idiots):

oh wow they use even hackforums products and resell them.

ngrbot, is this the scene ?

Also remember this ?

Maybe in another post i will explain the dramascene between uNkn0wn and darkode...

At darkode they will probably calls 2,3 screenshots a 'leak'
so... i took around ~4500 screenshots:

I know it can be hard for white hat to enter on community like darkode for do researchs.
So enjoy 763 Mb of screenshots, not a full dump but almost a full dump.
I have a full dump of course with each threads, pages fetched via wget but i keep this version for law enforcement guys (and some have already the darkode account and my regulars dump in hands since a long time, just saying..)
Anyway even with this 'public' screenshots dump anyone have enough to launch indictments and shit.

Oh.. it's really fun dude.

Also took a screenshot of maza for the glory... (I must admit i miss malwares of 2010/2011)

Gribo talk that Slavik is completely left from bussiness and he transfered everything related to Zeus 2.0 to Gribo, so he can continue work on this bot, including customers technical support. Slavik said to tell that he was happy to work with all the guys and other shit.

You can download the public dump here:
http://temari.fr/darkode.rar
http://trollkore.fr/darkode.rar
http://yandere.fr/darkode.rar
After 24 hours i will remove the archive from my server so fetch it fast.
http://www.multiupload.nl/EXNPMTB4XU

To conclude:
This post about darkode is exceptional i usualy leave these forums alone and don't blog about it.
I receive a lots of emails requesting me to give a fuck about theses boards, but since some days for an unknown reason some guys of darkode started to seriously annoy me (adding me on skype and mailling me with shits), this is just my response to them.
cb0f0ef62585ef7484d3582f3caf4ccf
Have a nice day and good advice: stay away of darkode if you don't want someone to knock at your door
Also don't ask me to do the same type of post about mazafaka, or other forums (i see already mails coming)
If you want some infs http://trojanforge.com/showthread.php?t=2391 is a good start, i will not help.

Embosser and BSR

noreply@blogger.com (Steven K) — Sat, 23 Mar 2013 14:04:00 +0000

You guessed it i bought some new toys for my cybercrime object collection...
The first is a PVC ID Credit Card Embossing machine, who costed me 275,48 EUR:

Manual:

Tools:

Demo-card:

Machine:

And A barcode badge card reader who costed me 158,51 EUR

Who can read unprotected and protected barcodes

Utility:

And a small video, (in french sorry)

VMADUMPS (Carding shop)

noreply@blogger.com (Steven K) — Wed, 20 Mar 2013 19:41:00 +0000

Another carder shop, similar to dumpslogs, they sell track2.

vmadumps.cc - 80.82.64.21
Registrant Contact:
none
onofrio castaldi ()
Fax:
via DOMENICO CUCCHIARI nr.60
rome, rome 00159
IT
Creation date: 20 Sep 2012 10:20:00
Expiration date: 20 Sep 2013 07:20:00

Banner:

Advert:

News:

Find cards:

Client area:

Credit history:

Reload credit:

Ticket:

Buy dumps:

Buy bulk:

Track2 checker:

Help and FAQ:

Some weird urls:

vmadumps.cc/Mail.php
vmadumps.cc/activ.php
vmadumps.cc/PEAR.php

lol:

Admin panel:

News:

Add product:

Stats (some will be interested by numbers i thinks)

The 17 march california has 1580 products. 
From the 17 march california there are 234 meaning 14.8% products bought. 
Total products that wore checked 66 and 36 (54.5%) passed the check meaning 2.3% from the total of base products
People spent a total of 3055$
---
The 17 march massachusetts has 2149 products. 
From the 17 march massachusetts there are 483 meaning 22.5% products bought. 
Total products that wore checked 99 and 53 (53.5%) passed the check meaning 2.5% from the total of base products
People spent a total of 7820$ 
---
The bulk no replace has 33323 products. 
From the bulk no replace there are 112049 meaning 336.3% products bought. 
Total products that wore checked 13238 and 8065 (60.9%) passed the check meaning 24.2% from the total of base products
People spent a total of 320123$ 
---
The 12 march california has 530 products. 
From the 12 march california there are 482 meaning 90.9% products bought. 
Total products that wore checked 195 and 126 (64.6%) passed the check meaning 23.8% from the total of base products
People spent a total of 6965$ 
---
The 17 march mix 201 has 1699 products. 
From the 17 march mix 201 there are 382 meaning 22.5% products bought. 
Total products that wore checked 84 and 55 (65.5%) passed the check meaning 3.2% from the total of base products
People spent a total of 15445$ 
---
The 17 march new york has 2475 products. 
From the 17 march new york there are 366 meaning 14.8% products bought. 
Total products that wore checked 82 and 38 (46.3%) passed the check meaning 1.5% from the total of base products
People spent a total of 5275$ 
---
The 17 march florida has 4032 products. 
From the 17 march florida there are 558 meaning 13.8% products bought. 
Total products that wore checked 115 and 72 (62.6%) passed the check meaning 1.8% from the total of base products
People spent a total of 8215$ 
---
The 12 march florida has 2642 products. 
From the 12 march florida there are 1405 meaning 53.2% products bought. 
Total products that wore checked 520 and 324 (62.3%) passed the check meaning 12.3% from the total of base products
People spent a total of 17810$ 
---
The 7 march massachusetts has 727 products. 
From the 7 march massachusetts there are 877 meaning 120.6% products bought. 
Total products that wore checked 276 and 135 (48.9%) passed the check meaning 18.6% from the total of base products
People spent a total of 11760$ 
---
The 12 march new york has 661 products. 
From the 12 march new york there are 859 meaning 130% products bought. 
Total products that wore checked 287 and 160 (55.7%) passed the check meaning 24.2% from the total of base products
People spent a total of 11345$ 
---
The 12 march east coast mix has 827 products. 
From the 12 march east coast mix there are 715 meaning 86.5% products bought. 
Total products that wore checked 215 and 115 (53.5%) passed the check meaning 13.9% from the total of base products
People spent a total of 9440$ 
---
The 7 march florida has 2788 products. 
From the 7 march florida there are 578 meaning 20.7% products bought. 
Total products that wore checked 223 and 146 (65.5%) passed the check meaning 5.2% from the total of base products
People spent a total of 8245$ 
---
The 7 march new york has 988 products. 
From the 7 march new york there are 1001 meaning 101.3% products bought. 
Total products that wore checked 400 and 260 (65%) passed the check meaning 26.3% from the total of base products
People spent a total of 12535$ 
---
The 7 march new jersey has 591 products. 
From the 7 march new jersey there are 625 meaning 105.8% products bought. 
Total products that wore checked 244 and 138 (56.6%) passed the check meaning 23.4% from the total of base products
People spent a total of 7040$ 
---
The 28 february florida has 2256 products. 
From the 28 february florida there are 1781 meaning 78.9% products bought. 
Total products that wore checked 682 and 447 (65.5%) passed the check meaning 19.8% from the total of base products
People spent a total of 21565$ 
---
The 7 march california has 1114 products. 
From the 7 march california there are 886 meaning 79.5% products bought. 
Total products that wore checked 408 and 248 (60.8%) passed the check meaning 22.3% from the total of base products
People spent a total of 11450$ 

admins:

Clients:

Track1 bin:

Track2:

Transactions:

Sold:

Bins:

Settings:

database:

3k clients, i've broke ~55% of passwords with a simple brute force and a basic dictionary.
You want a copy ? oh... ok.
http://temari.fr/vmadumps.cc.zip

PHP+SQL, tracks2 and credit cards are not included of course
Happy hunting.

Storm 3 is awesome.

Kawaii Security (カワイイセキュリティ)

noreply@blogger.com (Steven K) — Thu, 14 Mar 2013 20:50:00 +0000

I recently came across a book called Kawaii Security
http://pandalabs.pandasecurity.com/kawaii-security-japan-is-different/

I don't understand Japaness but the book is quite nice, paper quality is very good, illustrations are superb, and all have a manga book size.

I don't know what's inside the CD, probably Panda Security

Malwares illustrated:

The book have plenty of other malware illustrations.
Trojan/Bot:

SpyWare/FakeSoftware:

Small story splitted in 4 parts inside:

AV-tans:

Attack scheme of an exploit pack:

HS: I'm back !

Liberty Reserve phishing

noreply@blogger.com (Steven K) — Fri, 08 Mar 2013 14:38:00 +0000

Since some days i receive Liberty reserve (a Costa Rica-based payment processor) phishings, i usually don't see LR phishs.

no_reply@libertyreseve.com
Recevied yesterday, 13.3.7 (07/03/13)

Leading on a legit liberty reserve payement page

https://sci.libertyreserve.com/?lr_acc=U2909099

And today, leading on phishing, still same sender:
no_reply@libertyreseve.com

The hyperlink lead to 64.32.10.171 who lead on libretyeserve.com (204.188.221.238)

http://libretyeserve.com/start.php
http://libretyeserve.com/a.php
http://libretyeserve.com/logipin.php
http://libretyeserve.com/welcome.php
http://libretyeserve.com/start.php
http://libretyeserve.com/captcha.php
http://libretyeserve.com/transfer.php
http://libretyeserve.com/index_old.php
http://libretyeserve.com/curl.php
http://libretyeserve.com/cookies/
http://libretyeserve.com/temp/
http://libretyeserve.com/logs/

https://www.virustotal.com/fr/url/729a0778a90efa48b4508661cd1fad4c140e7ee9ded8c5a56f89f3b6c754212b/analysis/1362751719/

64.32.10.171 ~

http://64.32.10.171/index1.php
http://64.32.10.171/config.php 
http://64.32.10.171/js/core.js
http://64.32.10.171/logs/welcome_lpin.html 
http://64.32.10.171/templates/welcome.html
http://64.32.10.171/templates/transfer.html 
http://64.32.10.171/templates/login.html
http://64.32.10.171/templates/success.html
http://64.32.10.171/templates/cancel.html
http://64.32.10.171/templates/purpose.html
http://64.32.10.171/templates/index_old.html
http://64.32.10.171/templates/confirm.html
http://64.32.10.171/en/ 

https://www.virustotal.com/fr/url/3d50e4b5072439be2f4537825a99014dbfa75d8c980c1abdcb664cee58a7ae2e/analysis/1362751808/
Beware, they are not yet detected by Google Safe Browsing and shit's

Also, I currently work on a huge project who take all my attention for the moment (that the reason of my inactivity here)
i'll be back in ~1 week.

octavian.su (carder shop)

noreply@blogger.com (Steven K) — Tue, 26 Feb 2013 10:35:00 +0000

Adv:

domain: OCTAVIAN.SU
nserver: fns1.dnspark.net.
nserver: fns2.dnspark.net.
state: REGISTERED, DELEGATED
person: Private Person
e-mail: fpolev@mail.ru
IP: 186.2.160.6
inetnum: 186.2.160/22
status: reallocated
owner: DDoS-Guard.net
ownerid: BZ-DDOS-LACNIC
responsible: Alexander Golovin
address: 1/2Miles Northern Highway, Belize City, Belize, , 
address: - Belize City - BZ

News:

Buy CC:

CC orders:

Buy dumps:

Dump orders:

BinLookup:

Checker:

Tickets:

Edit account:

View cart:

Add money:

Terms (?!):

FAQ:

Bug report:

Phish-BankFraud EDF again and again

noreply@blogger.com (Steven K) — Sat, 23 Feb 2013 10:07:00 +0000

Small fast post.

EDF phishers are still active.

http://www.phishtank.com/phish_detail.php?phish_id=1744379

chichi.php:

$send = "vbv.se2013@gmail.com,x-vbv2013@voila.fr"; 

Dump: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2431&start=10#p18316

Carding on compromised RDP

noreply@blogger.com (Steven K) — Sat, 23 Feb 2013 08:51:00 +0000

I don't think i need to explain the screenshots.

---

No mail found on this one:

---

And too many others, logs are full of mails adress and credit cards informations...

Spamming on compromised RDP

noreply@blogger.com (Steven K) — Sat, 23 Feb 2013 08:50:00 +0000

Sometime hackers lock the compromised RDP to avoid others hackers to use it,
on this screenshot: 497400 emails sent.

Subject: Director Telex/Foreign Operation (OB)
Attn: ,

Sometimes, I do wonder if you are really, really with your senses. How
Could you keep trusting people and at the end you will loose your hard
Earned money, or are you being deceived by their big names? They
Impersonate on many offices, claiming to be Governors, Directors/Chairmen
of one Office or the other. Their game plan is only just to extort your
hard Earned money. Now, the question is how long you will continue to be
Deceived? Sometimes, they will issue you fake check, introduce you to fake
Diplomatic delivery, un-existing on-line banking and they will also fake
wire transfer of Your fund with Payment Stop Order  and even send you fake
atm cards etc.

Anyway, by the virtue of my position I have been following this
Transaction from inception and all your efforts towards realizing the
Fund. More often than not, I sit down and laugh at your ignorance and That
of those who claim they are assisting you, it is very unfortunate That at
the end you loose. Although, I don't blame you because you are Not here in
Nigeria to witness the processing of your payment in Nigeria.The problem
you are having is that you been told the whole truth About this
transaction and it is because of this truth they decided to Be extorting
your money. The most annoying part is even fraudsters Have really taken
advantage of this opportunity to enrich them selves At your expense. Those
you feel are assisting or working for you are Your main problems. I know
the truth surrounding this payment and I am The only person who will
deliver you from this long suffering if you will abide  by my advice.

I also know that recently you have been dealing with people claiming to be
the EFCC. They claim that they are helping you and you forward all the
fraudulent e-mails you receive to them. At the end they do nothing about
the fraudsters.Do not pay any money to them because they are only
interested in your hard earned money and you will never receive any
compensation in return, they will always keep coming back to ask for more
money.

Please I beseech you to stop pursuit of shadows and being Deceived.Feel
free to contact me immediately as you receive this mail so that I can
Explain to you the modus-operandi guiding the release of your Payment. Do
not panic, be rest assured that this arrangement will be Guided by your
Embassy here in Nigeria.

N/B: You are urgently requested to provide me with the following information


Full Name
Address
Age
Telephone Number
Occupation


Contact me upon the receipt of this mail if you wish to receive your fund
and stop wasting your hard earn money.


Thanks and remain blessed.

Yours faithfully,

Mohammed Sani.
Director Telex/Foreign Operation (OB).
contact mrbendavid@yahoo.com

---

Subject: FROM THE ATM CARD OFFICE
COMMENT>This is HTML source of message you composed. Do not modify here.</COMMENT>
To modify this message press HTML Messages Editor button.</COMMENT>
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
<FONT size=2 color=#000000 face="Arial">
<DIV>
<FONT size=3 face="Bookman Old Style">CONGRAT</FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style"> </FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style"> </FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style"> </FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style"> </FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style">A cash grant award of $5.2M from our Atm Card Award Promo has been awarded to you. Re-confirm your Full Names, Address ANY OF YOUR ID CARD, TELEPHONE NUMBERS. for the issuance and delivery of your Card. You can call me on my number +234-8088011161</FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style"> </FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style"> </FONT></DIV>
<DIV>
<FONT size=3 face="Bookman Old Style">George Williams.</FONT></DIV>
</FONT>
</BODY></HTML>

---

Subject: Hello Friend!!!
This is HTML source of message you composed. Do not modify here.</COMMENT>
To modify this message press HTML Messages Editor button.</COMMENT>
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
<FONT size=2 color=#000000 face="Arial">
<DIV>
<FONT size=3 face="Times New Roman">Hello Friend,</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">I sincerely apologize for contacting you without due permission or under-going due process. I was left with no choice that to contact you immediately because I consider this information very Urgent and Emergency. You will agree with me that experience is the best teacher as we say. I have had alot of bad and hurtful experiences from those Fucking Internet Scammers. I received over 50 mails each day telling me to claim by Inheritance Funds worth Eight Hundred and Fifty Thousand United Stated Dollars. I fell to this trap and I lost alot of money. I will never forgive those Bastards from Africa to be specific Nigeria.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">I am pleased to inform you that i am one of the must happiest women on earth now because I was contacted by the Federal High Court Officials who directed me to the Real Organization in charge of my Funds. Now I have my funds directly transferred to my Bank Account. I will have to enjoy the rest of my life and family with this Fund as I resign my job on the 7th May, 2013. I have no reason to keep working when i have enough Funds to set up my own establishment.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Now you will be surprised how I got to know you. I was with the Federal High Court Official to sign and approve the Transfer of my Funds to my Bank (Bank Of America). I saw your name and e-mail address among the Beneficiaries of this Funds. I felt very sorry for those names and e-mail contacts because I know they might have been scammed by those Bastard. I quickly write out your email address. This is why I am contacting you today.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">If you have received any mail asking you to make any form of payment to get your Funds. I advice you to ignore such mail now and contact the Federal High Court Official in charge of the Release of your Funds. If you can contact him now, he is going to process your Funds Papers immediately and you will have your Funds transferred to your Bank Account within the next 24-48hours. But you will be required to provide your information to prove that you are the real owner and Beneficiary of this Fund. You can contact Barrister Jim Jones's via e-mail as stated below:</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Federal High Court Of Justice (United Kingdom)</FONT><BR>
<FONT size=3 face="Times New Roman">Name: Barrister Jim Jones's (Federal High Court Official)</FONT><BR>
<FONT size=3 face="Times New Roman">E-mail: barristerbimjones@yahoo.com </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman">Tel: +447024054197</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">My Dear Friend, I hope I have been able to help and prevent you from falling a scam victim to those insolent bastards. Please feel very free to get back to me if you need more information on this, i will be willing to help. Bye for now.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Utmost Regards,</FONT><BR>
<FONT size=3 face="Times New Roman">Mary L. Wells.</FONT></DIV>
</FONT>
</BODY></HTML>

---

Subject: RE-COMPENSATION WITH THE SUM OF $500,000.00 (FIVE HUNDRED THOUSAND UNITED STATES DOLLAR ONLY)
This is HTML source of message you composed. Do not modify here.</COMMENT>
To modify this message press HTML Messages Editor button.</COMMENT>
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
<FONT size=2 color=#000000 face="Arial">
<DIV>
<FONT size=3 face="Times New Roman">RE-COMPENSATION WITH THE SUM OF $500,000.00 (FIVE HUNDRED THOUSAND UNITED STATES DOLLAR ONLY)</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">The United Nations in collaboration with Union Bank Plc is compensating flood Victims and those that were defrauded around the world with the sum of $500,000.00 only.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">With the recent events around the world, the United Nations, after thorough review and evaluation, deemed it fit to compensate those that were financially defrauded and also those that lost huge properties as a result of various natural disasters.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">We therefore, advice you stop further communication with any correspondence outside this office as you do not have to pay money to anybody or officer of this Bank or Organisation to receive this compensation Fund.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Furthermore, should you by any way receive this message, you should be required to present to us, an affidavit and a valid tax clearance certificate as to make claim for this noble compensation.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Finally, we once again congratulate you and wish you to send to us the following information:</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Name</FONT><BR>
<FONT size=3 face="Times New Roman">Contact Address</FONT><BR>
<FONT size=3 face="Times New Roman">Occupation</FONT><BR>
<FONT size=3 face="Times New Roman">Age</FONT><BR>
<FONT size=3 face="Times New Roman">Sex</FONT><BR>
<FONT size=3 face="Times New Roman">Country</FONT><BR>
<FONT size=3 face="Times New Roman">Telephone number.</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Yours Sincerely,</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
<DIV>
<FONT size=3 face="Times New Roman"> </FONT><BR>
<FONT size=3 face="Times New Roman">Joseph Ginear</FONT><BR>
<FONT size=3 face="Times New Roman">Head, Coordinator,</FONT><BR>
<FONT size=3 face="Times New Roman">Compensation Unit</FONT><BR>
<FONT size=3 face="Times New Roman"> </FONT></DIV>
</FONT>
</BODY></HTML>

---

Subject: YOU HAVE BEEN AWARDED A NEW ATM CARD!!!!!
This is HTML source of message you composed. Do not modify here.</COMMENT>
To modify this message press HTML Messages Editor button.</COMMENT>
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
<FONT size=2 color=#000000 face="Arial">
<DIV>
<FONT size=3 color=#000000 face="Georgia">YOU HAVE BEEN AWARDED A NEW ATM CARD!!!!!</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">Due to your long over-due fund which you have been finding it difficult to receive via a Certified Bank Draft issued by Deferent organization, We have arranged your payment through our International ATM CARD PAYMENT CENTRE in Europe, America, Africa and Asia Pacific, this is part of an instruction/mandate passed by the Senate in respect to overseas contract payment and debt re-scheduling.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">We will send you an International Swift ATM CARD ( Master Card) which you are to use in accessing your fund via in any ATM MACHINE location any Where in the world, and the maximum daily limit is Four Thousand United States Dollars ($4,000.00) valued sum at Two Million Five Hundred thousand United States Dollars {$2,500,000.00}. If you desire to receive your fund this way kindly contacts the ATM officer via email: atmpaymento@yahoo.fr</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">NOTE: you are to re-confirm your details so as to facilitate the immediate release of your ATM CARD immediately.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">(1) Your Full Name.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">(2) Full Residential Address...</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">(3) Direct and Current Phone:</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">(4) Nationality.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">(5) Present Country.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">Please Note: As soon as your details have been received here by the SWIFTATM CARD CENTER, you are therefore advised to stop any further communications with All other bodies such as the Compensation and Finance House, Lottery Organizations etc....</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">You have to act fast so as to facilitate the immediate release of your ATM Card and more so as to avoid miss-appropriation of your Card. Please be aware that you are the only person Left to receive your ATM Card out of the three beneficiaries. Please note our ATM CODE of conduct is (ATM 007) as this is to be your subject when responding to our email to prove that truly, you received our email.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">We shall be expecting to receive your information as you Have to stop any further communication with anybody or office.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">Thanks for your co-operation.</FONT></DIV>
<DIV>
<FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">International ATM CARD PAYMENT CENTRE.</FONT><FONT color=#000000> </FONT></DIV>
<DIV>
<FONT color=#000000> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Georgia">MR.BEN MARTINS.</FONT></DIV>
</FONT>
</BODY></HTML>

Edit 23 Feb:

http://pastebin.com/bWYfgz5D

Phish-BankFraud: RDP Spam

noreply@blogger.com (Steven K) — Sun, 17 Feb 2013 00:42:00 +0000

I've already do severals posts about EDF phishings:
Phish-BankFraud/PHP.Mailer/PHP.Shell
Phish-BankFraud (EDF+CAF)
Phish-BankFraud (EDF, CAF, and now Carrefour)

Still active:

But this time let's see one source: a compromised french machine...

HTML body:

SMTP:

The machine was also used to search other machines with weak passwords

For example, another French compromised machine used for spam:

This is HTML source of message you composed. Do not modify here.</COMMENT>
To modify this message press HTML Messages Editor button.</COMMENT>
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
<FONT size=2 color=#000000 face="Arial">
<DIV>
<FONT size=3 color=#000080 face="Comic Sans MS"><B><I>From: National Security Agency (N.S.A)</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000080 face="Comic Sans MS"><B><I>United State of America</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000080 face="Comic Sans MS"><B><I>Crime Fighters</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#800000 face="Comic Sans MS"><B><I><U>This is Official advise From U.S. Department of Justice NSA</B></I></U></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>National Security Agency, American's alliance prospect, we work in line with CIA and Federal Bureau of Investigation F.B.I to fight and minimize crime globally.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Be informed that you have given three working days extension to provide the required documents needed by Federal Reserve Bank to released the deposit of us$10.5million in your account, We work in affiliation with FBI and Homeland Security to carried out the required duty as mandated. we need mentioned document as soon as possible to enable all concern agency to perform the ratification of the transfer you are about to received from Federal Reserve Bank to your account.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>A proper documentation of this transfer is important for security of our country and world at large.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Original Fund Identification Record Certificate (O.F.I.R.C} is only proof Requested by Federal Reserve Bank to released the Deposit of US$10.5M in your account.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Listen very carefully If after this Three Days grace you did not get back to us with the mentioned document National Security Agency shall consider this money as an act of terrorism, money laundering . then Our security men will head to your City to apprehend you and bring you in for further interrogation.for you to have the mentioned documents Contact Mark Kojo on Tel +234-8169609435 or email markkojo2@yahoo.com for acquisition of mentioned Document which will facilitate for immediate release of the us$10.5million in your bank account.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Contact Person: Mark Kojo</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>E mail.address: markkojo2@yahoo.com</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Telephone: +234-8169609435</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Office Address: 15A Awolowo !Road, Ikoyi, Lagos.Nigeria.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>This US$10.5Million will be transferred into your bank account within two working days you secure FUND IDENTIFICATION RECORD CLEARANCE CERTIFICATE from Nigeria where the US$10.5M was originated.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>After providing the document National Security Agency will authorize Federal Reserve Bank to transfer us$10.5million into your bank account because with provision of this required document we shall clear the fund to be released in your account.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>We need this Fund Identification Record clearance Certificate as a proof to the below frozen wired transaction ID : 1010253822148 and Be informed that You do not have any rights to receive these US$10.5Milion UNTIL YOU SECURE Fund Identification Record clearance Certificate from our payment coordinator Mr Mark Kojo .</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Note you don't have all the time in the world and delay is dangerous.</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>Mr. Brian Bluckwall</B></I></FONT><FONT size=3 color=#000000 face="Comic Sans MS"> </FONT></DIV>
<DIV>
<FONT size=3 color=#000000 face="Comic Sans MS"><B><I>For: National Security Agency (NSA)</B></I></FONT></DIV>
</FONT>
</BODY></HTML>

French doctor compromised:

Citadel cracked builder ?

noreply@blogger.com (Steven K) — Fri, 15 Feb 2013 10:32:00 +0000

Found recently this on a carding forum.

No idea if it's true or...

Многие тут знают историю того, как создатель цитадели AquaBox киданул меня и лишил поддержки по причине того, что я задолбал обращаться в саппорт. И это после того, как я заплатил $5000 за его продукт.
Больше информации есть в этой теме.
Поэтому теперь моя версия цитадели сломана и готова перейти в ваше пользование.

Цена $500 за билдер, который обошёлся мне в $5000.

Данная версия поддерживает все фишки цитадели кроме FTP-ифреймерa.

Инструкцию (которую делал я) можно скачать ЗДЕСЬ.
Помогу на начальном этапе, объясню некоторые моменты, но вы должны понимать, что это всё без поддержки от создателя троя.

Билдер полностью рабочий, админам предоставлю всё для проверки.
Продаётся с привязкой к вашему железу.

I've no idea if it's true or just a fake ad for steal money.
I don't get it why they worked on the 1.3.4.5 if they have original lic.
And weird things: the forum is private and only for trusted people (need to know the good port and shit's just to connect)
w8 & see...

and about private community... have a look on the index page of darkode.