(02 December, 2024 - 06:58 PM)Liars Wrote: Show MoreIntroduction: 

I’m writing this thread to expose a long-running scam operation within our community. For approximately two years, a member known as @SANTA has been operating a fraudulent shop. This shop has generated a staggering $81.95k in revenue since 2022 by exploiting unsuspecting individuals.

We have gathered compelling evidence from the shop itself and complaints from other members, which collectively reveal the extent of this scam. As a team, we’ve decided to bring this information forward to warn others and prevent further harm.

 

Stay tuned as we break down the evidence and explain how @SANTA has deceived so many.

Part 1 - How did we get here?:  

  Our team at ownd.sh was first alerted to the suspicious activities of @SANTA by a few concerned members of the public. They reported numerous issues with @SANTA's shop, and upon further investigation, we discovered a pattern of fraudulent practices. The shop itself, which operated under logfo.sellpass.io (known as plug.su), appeared inactive or "dead."

 

Reviews of the shop highlighted several alarming problems:
- Dead download links.

- Accounts that didn’t match the descriptions sold.

- Duplicate logs being distributed to multiple buyers.

One particularly odd observation was the stock levels—many items showed identical quantities, raising further suspicion. To dig deeper and gather concrete evidence, we decided to investigate firsthand.

 

Testing the Waters: 

As part of our investigation, I purchased two logs labeled as “LOG WITH BINANCE ACCOUNT” from @SANTA's shop. Here’s what we found:

- First Log:

Instead of anything related to Binance, the log contained files about someone’s SAT scores and college grades. This had nothing to do with the advertised product and was completely unrelated.

- Second Log:

Instead of anything related to Binance, the files raised even more concerns. Embedded within the downloaded content, I discovered malware and a set of instructions pointing to another entity. Included was a cloud link with the following details:
- https://t.me/+iQ09opr7SINlNDk6

- Join to us | https://t.me/SlimyCloud - Main channel | @SlimyAdmin - TG for buy

- This discovery piqued my curiosity, prompting me to investigate further.

Connecting the Dots: I opened Telegram to trace the origins of these files. The linked Telegram account had been deleted, but I found a group called SlimycloudRipper. This discovery led me to suspect that all the logs sold by @SANTA originated from this person or group. Interestingly, their last activity was only a month ago. 

At this point, I started questioning the authenticity of these logs. Were they genuine private data or just recycled public data? To confirm, I analyzed the files in-depth and compared them to known public records. The results? Most of the logs or if not all of the logs turned out to be publicly available information.

Part 2: The Confrontation – Gaining Access to @SANTA’s Shop 

After compiling the evidence that many of @SANTA’s logs were public or mislabeled, we sought to investigate further. With permission from @KSZ, our team directly contacted @SANTA to request access to his shop. Our suspicions were clear: the shop appeared to be using duplicate stock and selling publicly available logs under the guise of premium content. Additionally, it came to light that @SANTA had not responded to support tickets for over two years, leaving numerous customers without assistance or recourse. This lack of accountability only reinforced our concerns about the integrity of his operation.

 @SANTA’s Initial Response: Raising Red Flags

When approached with our request, @SANTA initially refused to cooperate, stating that he was "out of the city for 4 days" and unable to provide access. This response immediately raised alarm bells within the staff team. His reluctance to assist in resolving the matter, combined with the mounting evidence against him, led us to take decisive action:
- @SANTA was banned, with the reason listed as: "Refused to cooperate in a report."

- This preventative measure was necessary to protect the community from further harm or potential fraudulent activity.

We made it clear to @SANTA that his ban would remain in place until he provided full access to his shop, allowing us to thoroughly investigate his practices.

 

The Turnaround: Gaining Shop Access

Approximately an hour later, @SANTA contacted me via Telegram, sharing the login credentials for his shop. However, the shop was protected by a two-factor authentication (2FA) system. Due to time zone differences, I could not retrieve the 2FA code immediately, and he needed help from someone at his home to assist in getting the 2FA . 

After some delay, @SANTA eventually provided the 2FA code, and we successfully logged into his shop.

 

Part 3: Inside the Shop

After finally gaining access to @SANTA’s shop, our investigation began in earnest. What we uncovered confirmed our worst suspicions and revealed the full extent of the fraudulent practices taking place.

Revenue and Stock IssuesThe shop’s revenue, displayed on its dashboard, was an eye-opening $81.95k. This substantial income had been generated through deceptive practices over the past two years.

When we began examining the products listed in the shop, several red flags emerged:

- Duplicate Stock Across Multiple Products
- Many products had identical stock levels—7,152 items across listings for entirely different services, such as Uphold logs and Crypto.com logs.

- Upon closer inspection, we discovered that these products shared the exact same stock. Despite being labeled as distinct products, they contained identical links.

-

- Massive Duplication of Links
- To quantify the scale of the issue, I ran the links through a duplicate remover. Out of the total entries, 4,769 duplicate links were identified and removed. This confirmed our suspicions: @SANTA’s shop was recycling the same content across multiple listings.

-

Testing the Logs

To validate the quality of the logs, I downloaded a few samples:

- Coinbase Logs
- Advertised as containing Coinbase account information, these logs contained no relevant data. They were entirely unrelated to Coinbase.

- Italy & Turkey Logs
- I tested several links within logs labeled as Italy and Turkey accounts. Not a single one worked—they were all dead links

- Twitch Logs
- Surprisingly, logs labeled as Twitch accounts were identical to the Coinbase logs. The shop was blatantly recycling stock across completely unrelated products.

 

Unresolved Complaints and Support Tickets

Next,we reviewed the shop’s reviews and customer support history:

- Negative Reviews
- The shop had numerous unresolved negative reviews, highlighting issues such as dead links, mislabeled products, and poor quality.

- Unanswered Support Tickets
- The ticket system revealed that no support tickets had been addressed since May 2022. Customers had been left entirely in the dark for over two years.

Could @SANTA have been resolving issues on external platforms like Telegram or Discord? Based on the evidence:
- Discord: His Discord account has been terminated.

- Telegram: While his Telegram status is unclear, the sheer volume of unanswered tickets suggests it is highly unlikely that issues were being resolved there.

What’s Next?

In the next part of this investigation, we’ll be diving into one of the key items sold in @SANTA’s store—his refund eBook. After gaining access to a copy, we’ve analyzed its contents to understand exactly what he was selling and whether it aligns with the deceptive practices we’ve already uncovered.

Stay tuned for a closer look at this eBook and how it ties into the broader fraud.

 

Final Evidence and AcknowledgmentsAll Links and Embeds

Below are all the critical pieces of evidence gathered during this investigation:
- Screenshots of the revenue dashboard: https://i.imgur.com/HBuvIL1.png (image #1)

- Duplicate links identified: https://i.imgur.com/p1LJ01H.png (image #2), https://i.imgur.com/MkCIJgk.png (image #3) https://i.imgur.com/ODkROh9.png (image #4)

- Dead links in Italy and Turkey logs: https://i.imgur.com/MSe76aq.png (image #5)

- Mismatched logs (e.g., Coinbase logs labeled as Twitch): https://i.imgur.com/p1LJ01H.png (image #2) & https://i.imgur.com/MkCIJgk.png (image #3)

- Negative reviews and unanswered tickets: https://i.imgur.com/8gcsOKg.png (image #6) & https://i.imgur.com/20A90CF.png (image #7)

- Public logs & more: https://i.imgur.com/Bb5WlVr.png (Image #8), https://i.imgur.com/mF6XL82.png (image #9), https://i.imgur.com/NyZKXYl.png (image #10), https://i.imgur.com/sSJuBja.png (image #11), https://i.imgur.com/7S5VJJD.png (image #12) & https://i.imgur.com/i3i2KR6.png (image #13), https://i.imgur.com/sKJRag2.png (image #14), https://i.imgur.com/rvivbkj.png (image #15) & https://i.imgur.com/pHYPABK.png (image #16)

These files and screenshots provide indisputable proof of @SANTA’s fraudulent activities and confirm the extent of his exploitation.

 

Acknowledgments

A huge thank you to the ownd.sh Administrator Team for their unwavering support and commitment to protecting the community throughout this investigation:
- @KSZ

- @Darkness

- @Liars

Your dedication has been instrumental in uncovering the truth and ensuring the safety of our community members.

Best regards, 

ownd.sh Team.

Click to expand...