A new search engine, which aims to be the Google of underground websites, has opened its doors promising to find punters shops that offer an array of dodgy goods and services, from stolen credit card numbers to identity information and anonymity tools.
While such search sites exist, they usually require users to create accounts and sign in before they can search for stolen credit cards and other illegal activities.
MegaSearch.cc wants to allow buyers to find the fraud shops holding the cards they’re looking for without having to first create accounts at each store. It will aggregate data about compromised payment cards, and points searchers to various fraud shops selling them.
Security blog Kreb On Security spoke to the site’s creator who said that the search engine does not store the compromised card numbers or any information about the card holders.
What it does is work with card shop owners to index the first six digits of all compromised account numbers that are for sale.
These six digits are the “Bank Identification Number” — or BIN — which identify which bank issued the cards. Searching by BIN, MegaSearch users are given links to different fraud shops that are currently selling cards issued by the corresponding bank.
The unnamed site owner said that users spend a lot of time looking through shops, and he thought it would be a good idea to make that more convenient.
He makes his money from a small advertising fee from the stores. Both sides benefit because stolen card data grows less reliable with age, and fraud shops that are indexed by MegaSearch stand a better chance of clearing their inventory faster.
The site shows that Citibank cards are the most sought-after, followed by cards issued by FIA Card Services, Capital One and Chase.
Over the next few weeks, the site will offer things like social security numbers and the addresses of hacked PCs that paying clients can use as a relay to anonymise their online communications.