Offensive OSINT s04e01 – Drugs, firearms, exotic pets, fake documents and other scams part 1

This is how it looks in majority of the boards I reviewed, however on all of them these same links were posted. It means, someone might use automation script to publish the content.

At the end, urls bring us to the variety of shops. They all are very similar, same wordpress template, themes and photos. You can buy heroin, passports, counterfeit bills, firearms, OSCP certificate or exotic reptiles.

It’s obvious non-delivery scams offering illegal goods, you can spot plenty of them in clearnet as well as in darknet. It’s a good tactic for scammers because victim won’t go to police and admit he tried to order heroin from some shady store, but unfortunately many people still fall for it.

Do all of the websites have something in common? We will try to answer this question at the end of the article, but first things first – we have to collect as many links, to fraudulent sites, as possible.

To achieve this, we need to build a crawler for each board and later grab only external links posted by scammers.

We will use Python and we need:

Modules

import requests
from bs4 import BeautifulSoup
import re
from urllib import parse

Url of the board

url = "http://www.voy.com/182192/"

After getting familiar with structure of the website, you can find that each topic in board contains href parameter that ends with [digits].html. To extract only these values, we write something like below

url = "http://www.voy.com/182192/"

req = requests.get(url)

soup = BeautifulSoup(req.content)

# looking for topic link
for link in soup.find_all('a', href=True): 
    href = re.match(r'^([sd]+).html', link.attrs['href'])
    if href:
        domains = scrape_content(url + href.string)
        for domain in domains:
            print(domain)

Urls of the topics are passed here to the function ‘scrape_content” which is responsible to extract only links to the fraudulent shops. I discovered that every link posted have “rel” attribute, so it was easy to distinguish them and fetch quickly.

def scrape_content(link):
    unique_domains = set()
    req = requests.get(link)

    soup = BeautifulSoup(req.content)

    for url in soup.find_all(rel=True): # find links twith "rel" attribute
        domain = parse.urlsplit(url.string)
        if domain.scheme:
            unique_domains.add(domain.netloc)

    return unique_domains

We also create a set to keep only unique domains and return only these ones. At the end we should save it to the txt file by adding to the for loop below code.

with open('domains.txt', 'a+') as f:
	for link in soup.find_all('a', href=True): 
...
            for domain in domains:
                f.write(domain + "n")

This way we have collected all posted links in one board, which includes many topics. To scrape from other boards, just change url from the beginning.

I did this for many of the boards on the website and obtained 170 domain names providing potentially fake services. I uploaded it to Pastebin and you can find it below

https://pastebin.com/p1NeSGKe

pass: cVZ76YNnpU

Making connections

If you google these domains you can see that some of them were also shared in other message boards or in comments of old blogs and outdated WordPress sites, however most of them appeared only in Voy. Posts and topics are very similar to each other – same format and way they are advertised.

So, what we can check to establish connections between our domains?

First thing that comes to mind is infrastructure, we can look where they are hosted and what registrar was used. Then, it’s worth to dig deeper into IPs to see what else is using this same IP address. This way we can probably find more and more domains.

Second idea, which I will focus on, is using WHOIS records for each domain and draw connection based on email address and phone number, when available. Having such information, we can check who is behind particular shop and establish clusters of the ownership.

But, first we actually have to run our domain list against some WHOIS API. I choose, WHOISXML API which gives you 200 free credits after registration.

import requests
import json


return_dict = []

with open('domains.txt') as f: # read out domain list
    for domain in f.readlines():
        print(domain.rstrip())
        try:
            url = "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=[APIKEY]&outputFormat=json&&domainName=" + domain.rstrip()
            r = requests.get(url)
            r_json = json.loads(r.text)
            return_dict.append({"name":domain.rstrip(), "registrar_name": r_json['WhoisRecord']['registrarName'],
            "created":r_json['WhoisRecord']['createdDate'], "registrant":r_json["WhoisRecord"]['registrant']})
        except Exception as e:
            print(e)


print(json.dumps(return_dict, indent=4))

It loads our lists and access WHOISXML API to collect information about domain owner. At the end it gives json as below

{
        "name": "legitchemshop.com",
        "registrar_name": "NetEarth One, Inc.",
        "created": "2020-01-06T18:20:36Z",
        "registrant": {
            "name": "james mullah",
            "street1": "Southview, 73 stopford road,, flat3 st saviour,",
            "city": "california",
            "state": "California",
            "postalCode": "94203",
            "country": "UNITED STATES",
            "countryCode": "US",
            "email": "legitchemstore12@gmail.com",
            "telephone": "12158398130",
            "rawText": "Registrant Name: james mullahn
            Registrant Street: Southview, 73 stopford road,, flat3 st saviour,n
            Registrant City: californian
            Registrant State/Province: Californian
            Registrant Postal Code: 94203n
            Registrant Country: USn
            Registrant Phone: +1.2158398130n
            Registrant Email: legitchemstore12@gmail.com"
        }
    },
    {
        "name": "buyoxycodoneusa.com",
        "registrar_name": "NAMECHEAP INC",
        "created": "2021-01-17T17:11:33.00Z",
        "registrant": {
            "name": "REACTIVATION PERIOD",
            "organization": "Withheld for Privacy Purposes",
            "street1": "Kalkofnsvegur 2",
            "city": "Reykjavik",
            "state": "Capital Region",
            "postalCode": "101",
            "country": "ICELAND",
            "countryCode": "IS",
            "email": "reactivation-pending@mail.withheldforprivacy.com",
            "telephone": "3544212434",
            "rawText": "Registrant Name: REACTIVATION PERIODnRegistrant Organization: Withheld for Privacy Purposes"
        }
    }

We have to accept that lot of domains use WHOIS protection, which means we cannot get any information out of them.

Moreover, I checked each domain separately and looked for contact details posted on the website – phone number and email address, some of them use gmail or protonmail.

Googling these phone numbers will show that they are used in variety of scams. Different service, website, email but same phone number. Below is example, where you can buy a sex doll and contact Illuminati with only one call.

Also, glockgundealers.com and exoticpets.com, self explanatory domains, share same phone number.

All of such manually established connections are also taken into account during investigation and visualization.

Visualization

As mentioned at the beginning, we will use Maltego to put it all together. It will allow us see the whole picture, what domains are owned by whom and if there are additional connections between them via phone number or email address.

So, I manually put the domains, that expose email address and phone number in WHOIS (from previously created json) to Maltego and run WHOISXML API transform again to show the connection. For the rest of the domains where email was found manfully on contact page, edge colour was changed to green.

Let’s take a look on some of the clusters that appears based on WHOIS information.

Here is the basic association, domain omcpharmacy.com, advertised on the forum, was registered to johnlewisplcuk1[at]gmail.com. This email address is also used in more suspicious domains and poorly tries to impersonate John Lewis & Partners.

Next case is where domains have different email address but same phone number.

Below, two domains that allegedly provide fake documents, have same phone number but emails are completely different.

It does not end here, what brought my attention was that scammers reuse phone numbers in WHOIS and contact pages. I often see they give same email address but not the phone number, there is something phishy going definitely.

So far, we went from spam posts on some old message boards to connection graph based on WHOIS and information on the websites. The most intriguing thing are repetitive phone numbers, and in next part we will focus specifically on this matter. Will try to deanonymize people behind the numbers and look for more connections to feed our investigation.

Summary

Non-delivery scams still work, no matter what products are offered, even illegal ones, from exotic pets to counterfeit money. Beside spam post, some of the shops also appears in the darknet, which one can think it give them more “credibility” because of that.

These kind of scams are more common than you think and many people fall for it. Interpol and FBI posted recommendation how to protect yourself.

5 reasons non-delivery scams work

Here’s how you can avoid becoming a victim.

https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/non-delivery-of-merchandise

This scams work even when illegal goods are being sold, they are less likely to be reported due to the person that purchased something he shouldn’t, in the first place, might be in serious trouble.

From client perspective – buy such services/items in darknet from reputable vendors on legitimate marketplace. Try to verify every seller, use encryption and care of your OPSEC.