< Survival of the Fittest | Fast-Flux Data >

#CCpower Only Scam?

Several days ago I blogged about a compromise of our honeypots in which the attacker joined the IRC channel #CCpower. Such a channel is commonly used by attackers to trade stolen credentials like credit cards, ATM pins, social security numbers, or similar things. Again, a small excerpt from within this channel:

- USA-DUMPS: I HAVE VIRGIN USA DUMPS FOR SHOPPING (WITHOUT PIN). LOOKING FOR REAL US CASHIER FOR LONG TERM RELATIONSHIP. MY YAHOO MESSENGER ID IS : DUMPS_SELLER ! RIPPERS DON'T WASTE MY TIME! CONTACT ME ONLY IF YOU'RE FOR REAL. THANK YOU!.

- cards: Selling USA dumps for shopping /msg cards- for details..

- User2: Carti Fullz,Paypal Fullz,user eBay, Root,Remote Desktop, Loginuri Wells si boa Sockuri ...etc..Care esti afara sau ai ceva point de facut bani prv me!!POt sa dau Spam pe oRice BAnca NUMAI DE STATE inclusiv eBay si Paypal daca ai pont!!!.

- vendors: Spamming for HSBC, Halifax, CIBC. e-trade bank logins. Selling UK, USA, Swedish, Australian cvvs..

- HenryMtcn: Cashouting Uk BanK Logins Halifax Abbey and Natwest Share Guarranted..

- zoRnking: I searching good deals.. with sure (100%) cashout - out rippers - because i work with money upfront on the first deal and the get back after cashout - /msg zoRnking if you accept my rules or add my YM: zornunhackXXX@yahoo.com.

- MSR206: Selling atm skimmer + MSR206 with 5 blank magnetic cards , video available for checking the items pvt me for info.

- Zenq: Vand Carti Fresh Full Info & Cvv2 (AU,CA,UK,US,IT,SP,EU),Dumpsuri With Pin and Track1,Track2 and Track3 Luate Cu Cipul sau cu Gura de Skimmeri.........Logine Full (Carte + user & password) (BOA,RBC,Desjardins,Paypal,Intesa,Poste.it,Wamu,Wachoavia,Chase,MoneyBookers),Usere Ebay(Seller & Buyer)..RIPPERS OUT (My Contact ICQ = 3972973XX)

Two comments on the previous blog entry pointed out that these channels are commonly used for scams. The first one:
And for the article, I was hanging around on different ccpower networks since the beginning, 90% of these deals are ripoffs. Poor scum nigerians and romanians try to make 20$ deals by ripping eachother off. This is just a PUG what you find on undernet and different networks like unixirc, linuxirc. These people not even criminals just losers in life. I wouldn't bother wasting too much time for watching them. Won't do any good. You will never find any serious criminal group on the internet, since their trust builds in real life.

And the second one:
lol he said the truth!! most of them are rippers and scum bags..and yes, trust is built in real life not on internet!

Does anybody have more information on this topic, for example evidence that the trading activity in these channels is commonly scam and also some kind of proof? I am interested in this topic since the implication would be that the paper by Franklin et al. on the underground economy ("An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants") is not completely right - it would greatly overestimate the real size of the underground economy. Please leave a comment or send me an e-mail to thorsten.holz [at] gmail.com.
This entry was posted by Thorsten Holz on Tuesday, July 15. 2008 at 10:32. and is filed under malware. You can leave a response, or trackback from your own blog. All new comments are subject to moderation before being displayed.

Trackbacks

Trackback specific URI for this entry

    No Trackbacks

Comments

Display comments as (Linear | Threaded)

  1. katsumi says:
    #1 2008-07-16 07:35 (Reply)

    Thorsten,
    they use honeypots as we do,
    they will run your "malware" on virtual environment, as we do,
    they will sniff your details and at least will join your C&C, as we do.
    they will have a deal for you,
    if there's a chance to make some money
    (provided by rbot-kiddies ;))
    they will come and ask for.
    build it and they will come.
    may be [times] changed,
    things,
    but if your looking for carders you need them to find you.
    so never ask for something anywhere,
    just hit the carders honeypots and wait.
    But there'S a problem, cos the way your forcing yourself to become a interesting target for the carders could be illegal in some countries.

    greets,
    kat

    p.s.
    IMHO it's a bad idea to act in #CCpower or #carding or however you would like to name it.
    rippers?
    FEDs?
    may be it was just made of milk and honey. ;)

  2. p5yk3r says:
    #2 2008-08-05 11:56 (Reply)

    hit the nail on the head.
    the same $50USD has been going around that channel for many years.

    LOL!


Add Comment


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
Submitted comments will be subject to moderation before being displayed.