Sunday, July 19, 2015

FatherDeal Carding Shop

This site has been on my carding shop list. According to whois records, the site was registered: 27-mar-2012. I recently had the opportunity to revisit the site one last time. While it was still online I gained administrative access to the site and had a look at the internal workings. 

Online reviews and more recent admin support tickets of this carding shop are littered with complaints from criminal customers about this being a "ripper" shop: scammers scamming scammers.

While this shop is clearly not the work of a skilled mastermind and whatever the complaints might say, a look at the data reveals a few thousand users, plenty of stolen information, and that at one time this shop produced a bit revenue for the criminal admin running the operation.
fatherdeal.com. We sell 100% Dumps, Tools. BankLogins, Paypal verified, Credit Cards. Members Login. Create Account Forget Password. Email Address:.

Admin Panel:



2774 users
Passwords stored in plain text. Awesome.

Paypal sold


Bank logins sold


Support Tickets


PayPal   $104
Tools     $882
Dumps   $1028
CC      (1996 * ~2.50 =) ~$4990
bank logins $1517

Revenue ~$8500



Each user must select a country of origin when they register. 

Frequency of countries selected by users: 
   1442 'Russia',
    328 'United
    121 'Ghana',
     94 'Nigeria',
     47 'France',
     40 'China',
     37 'India',
     34 'Canada',
     31 'Malaysia',
     31 'Algeria',
     30 'Italy',
     29 'Afghanistan',
     28 'Pakistan',
     26 'Angola',
     25 'Albania',
     23 'Spain',
     23 'Brazil',
     22 'American
     

Shelled it



Lots of juicy database


Database names: 
xchangerfriend
ccbox.cc
softlogin
nscontra
mafiafu
ccshop
mixcc
paysafe
worldexc
swipe
ccsellz
autofair
try2buy
ccdumps
cashout
buy2real
The following A records are set to 192.64.115.10:
(http://bgp.he.net/ip/192.64.115.10#_dns)
asmarexchange.com, asmarwebhost.com, buy2real.com, ccshops.org, cvv2dumps.com, cvvhost.com,famsevent.com, fatherdeal.com, lrbuy.org, ns1.buy2real.com, ns2.buy2real.com, paysafehost.com,paysafemoney.com, softlogin.com, t2cvv.com, try2check.com, xchangerfriend.com, xperiasol.com

Notes:
$con = mysql_connect('localhost', 'fatherdc_top2', '1122334455');
mysql_select_db('fatherdc_top1', $con);

lastlog
182.191.192.248 (Pakistan)

.cpanel/contactinfo
cvvtop@yahoo.com