---
title: Inside the Cybercrime Supply Chain: What Underground Listings Reveal—and What They Don’t
date: 2026-10-19
excerpt: A role map of the underground market, from tooling to cash-out, using advertised prices and claimed incomes from observed listings.
tags: Cybercrime Research, Underground Economy, Threat Intelligence
canonical: https://sw64.dev/blog/whos-who-in-the-underground-and-what-they-earn
author: SW64
---
# Inside the Cybercrime Supply Chain: What Underground Listings Reveal—and What They Don’t
> [!NOTE]
> Scope is the visible roles, the work each role performs, the services advertised, and the income or price ranges attached to them. I observed these listings day to day.
> [!WARNING]
> Prices taken from listings are advertised prices. Monthly ranges and pay shares attached to roles are claimed earnings. Neither is a verified transaction volume or a confirmed income.
> [!IMPORTANT]
> The listings show the highest income around private tools, large traffic teams, infrastructure ownership, direct insider access, and cash-out infrastructure. The highest stated monthly range is $30,000 to $100,000 or more for owners of top stealers and drainers.
## Executive Summary
I observed a market split by role. Coders, sellers, brokers, traffickers, callers, renderers, carders, stuffers, droppers, cash-out operators, and COM insiders each take one part of the chain. The listings show that work, the services on offer, and the ranges attached to both.
Tooling sits at the start. Coders and cryptors build the malware, control panels, and crypting later roles use, while sellers, info brokers, and COM insiders supply logs, accounts, and records. Cash-out operators sit at the end. They move funds through drop accounts, crypto swaps, or merchant shells and return clean money or crypto.
The highest claimed earnings attach to owners of top stealers and drainers, at $30,000 to $100,000 or more per month, and to cash-out infrastructure owners, at $30,000 or more per month. Large traffic teams are claimed at $15,000 to $50,000 or more per month. The listings also show high claimed income for direct insider access and for people who own infrastructure.
## How the Chain Fits Together
```text
Tooling -> Infrastructure/Data -> Traffic -> Victim Interaction -> Monetization -> Cash-out
```
Coders and cryptors sit in tooling, and I observed that later roles depend on stealers, drainers, loaders, botnets, control panels, and related infrastructure. Sellers, info brokers, and COM insiders supply logs, card data, accounts, servers, proxies, and records on people or accounts. Traffickers send targets to phishing sites, stealers, or drainers once those tools are ready. Callers then apply live pressure, take one-time codes, or push stuck payments. Renderers cover KYC or payment proof, and carders, stuffers, droppers, and cash-out operators turn the result into goods and clean funds.
## Role Overview
Figures in the pay-model column and the monthly column are claimed earnings. They are not verified income. COM has unit prices and a claimed upper range in the notes below.
| Role | Function | Main activities | Pay model | Claimed monthly range |
| ------------------------------------ | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Coders and Cryptors** | Build tools and keep malware undetectable | Stealers for cookies and passwords, RATs, crypto address clippers, loaders, botnets C, C++, Rust, and Go Phishing pages, smart contracts for crypto drainers, admin panels for log management Static and dynamic masking, code encryption, and EDR behavioral analysis bypass, to reach FUD | SaaS or one-time source sales Up to 20 to 30 percent of team profits One-off file encryption $10 to $150 | Freelance commission: $2,000 to $5,000 per month Experienced, private tools: $8,000 to $20,000 per month Top stealers and drainers: $30,000 to $100,000 or more per month |
| **Sellers** | Supply consumables, tools, and data | Logs sorted by GEO and keywords Card number, CVV, expiry, and magnetic stripe dumps for writing to plastic Warmed crypto exchange accounts, self-registered payment systems, RDP or DS, private mobile proxies | Margin on resale or direct extraction, with minimal cost | Small auto shops and intermediaries: $1,000 to $3,000 per month Large sellers with auto sales: $5,000 to $15,000 per month Big shops with their own sources: $20,000 or more per month |
| **Call Processors and Info Brokers** | Use closed databases or insiders | Call detail records, base-station geolocation, SIM swaps Statements, balances, passcodes, and passport scans from bank systems Interior, traffic, tax, customs, and border data | From $15 for simple checks to $500 to $2,000 for SIM swaps or bank statements | Intermediaries and resellers: $1,500 to $3,500 per month Direct insiders and large services: $5,000 to $20,000 or more per month |
| **Traffickers** | Send targets to phishing, stealers, or drainers | Shorts, Reels, and TikToks for downloads or Telegram bots SEO or Google and Bing Ads for fake wallet and software pages Spam on Telegram, Discord, social networks, and email, via auto registration and parsers Web3 and NFT lures: fake airdrops, mints, private clubs | 40 to 70 percent of logs or drains $1 to $15 per valid log, by country | New UBT: $500 to $2,000 per month Experienced solo operators: $3,000 to $10,000 per month Large teams: $15,000 to $50,000 or more per month |
| **Callers** | Pressure victims by voice or text | Pose as bank, law enforcement, or government staff on targeted lists Anti-fraud calls to foreign merchant or bank support to push stuck transactions, in English or other languages Voice calls to capture one-time SMS codes | 10 to 30 percent of the stolen amount $30 to $150 per successful call or unblock | Regular callers: $1,000 to $3,000 per month Experienced callers with languages: $4,000 to $9,000 per month Underground call center organizers: $20,000 or more per month |
| **Renderers and Graphers** | Forge graphics for KYC or payment proof | Passport, ID, SSN, and utility bill source files 3D face models or selfies with a document, for liveness checks Transfer screenshots, ATM receipts, order proofs Physical card, ID, and license duplicates with lamination and holograms | $5 to $150 per document, by complexity A percentage of unlocked funds, percent not stated | Beginners and freelancers: $800 to $2,000 per month Experienced renderers: $3,000 to $7,000 per month Studios: $10,000 or more per month |
| **Carders** | Spend or transfer with card data and logs. Also called Vbyvala | Electronics, clothing, and jewelry ordered to a receiver address Digital gift cards, subscriptions, and codes resold immediately Airlines, hotels, rentals, and transfers sold at a discount Bank, ACH, PayPal, Stripe, P2P, and drop cards | Digital gifts at 40 to 60 percent of face value Physical goods at 30 to 50 percent of in-store price | Beginners: $1,000 to $2,500 per month Experienced gift carders: $4,000 to $8,000 per month Pros with private self registrations and merchants: $10,000 to $25,000 or more per month |
| **Stuffers** | Turn goods into cash by buying and reselling | Electronics, branded goods, and gift cards, in legal or illegal stores In-person shoppers, called realtors, using another person's card, Apple Pay, or Google Pay, up to single transaction limits Buyers take parcels, with acceptance and storage risk Resale on Avito, eBay, or Telegram at 10 to 20 percent below retail | Buyback at 30 to 50 percent of store price Final clean market sale at 70 to 90 percent | New or solo operators: $1,500 to $3,000 per month Experienced operators: $5,000 to $12,000 per month Large buyback services and drophouse owners: $15,000 to $30,000 or more per month |
| **Droppers** | Receive parcels or transfers for cash-out | Networks that open cards or accounts on real or fake IDs US or EU parcel drops, also called drop houses, then repackage and forward Coach fronts through video or photo KYC on Binance, Bybit, Wise, Revolut, and other services | 15 to 30 percent per payment or product | Beginners: $1,000 to $2,500 per month Experienced droppers: $4,000 to $10,000 per month Large services with multi country agents: $15,000 to $40,000 or more per month |
| **Cash Out Operators** | Launder funds, break blockchain or banking trails, and return clean money or crypto | Non-cash transfers to drop cards, then ATM or cash register withdrawals Mixers, stablecoins, and Monero Shell companies and merchant acquiring, as payment for services | 10 to 40 percent, depending on source taint | Regular performers: $2,000 to $5,000 per month Experienced teams: $8,000 to $20,000 per month Infrastructure owners: $30,000 or more per month |
| **COM Insiders** | Insider requests on people or accounts. Overlaps info broker work | SIM swaps EDR-related access, price not stated Calls to high-balance crypto targets, called whales | $1,000 to $1,400 per SIM swap $100 to $1,000 per call, by target size 2 to 6 percent of the target balance that gets cashed out | Listings in this role claim earnings that can reach six or seven figures. This is a claimed figure and is not verified (claimed earnings). |
## Advertised Prices
### Tooling, crypting, signing, and evasion
The reduced EDR listing, current as of 04.08 [date format unconfirmed], claims full visibility of attacks in real time, guaranteed license keys, and assistance installing agents. A separate listing offers one license with an original CS 4.13 hash, available until February [date format unconfirmed]. The EV crypt listing says large volume or regular customers can get more favorable conditions, with no figure, and it states a warranty, full delivery, and on-time delivery. The crypt partner's name is redacted in the source.
The premium crypt listing claims a zero leak policy: encryption runs on the buyer's server and the payload is never shared. It says the stub is cleaned and that a guide is provided for automation on the buyer's infrastructure. The Killer AV listing, updated 19.06 [date format unconfirmed], describes a freeze or suspend approach it calls invisible sleep. It says classic killers terminate processes and trigger alerts in the admin panel.
Cobalt Strike listings name CrowdStrike Falcon, Sophos, Microsoft Defender, Kaspersky, and ClamAV. One 4.12 offer includes Shellter 11.1. A related listing describes a bonus video on Shellter setup, AV and EDR bypass with Shellter, and adding a certificate with Shellter. Detection ratios in this section are listing claims.
These rows are advertised prices from tooling, crypting, signing, and evasion listings.
| Listing | What the listing offers | Price tiers | Notes | Provenance |
| ------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------- | ---------------- |
| **Reduced EDR licenses** | Reduced prices for named EDR products | CrowdStrike $200 SentinelOne $200 Kaspersky EDR $220 Trend Micro $200 Cortex XDR $220 Bitdefender $200 ESET Inspect $200 | Current as of 04.08 [date format unconfirmed] | Advertised price |
| **CS 4.13 license** | One license with an original CS 4.13 hash | $2,500 | Available until February [date format unconfirmed] | Advertised price |
| **EV code signing and crypt** | Bypass of AV, EDR, SmartScreen, and Chrome | $250 for the first file $400 for two files $500 for three files $750 weekly, unlimited $3,000 monthly, unlimited | Better volume terms claimed, no figure | Advertised price |
| **Premium crypt** | FUD and AV or EDR bypass | $100 for 4 unique copies $750 for 7 days $2,500 for 30 days | Monthly tier includes full support and custom stubs | Advertised price |
| **EV code signing certificate** | SSL.com EV as .pfx plus cloud | $1,600 for one year | Term is one year | Advertised price |
| **OV code signing certificate** | DigiCert OV or GlobalSign OV, in the cloud | $350 | Term not stated | Advertised price |
| **Killer AV** | Targeted destruction, disabling, and bypass | $350 single build $2,500 monthly access | Updated 19.06 [date format unconfirmed] | Advertised price |
| **Cobalt Strike 4.12** | Cobalt Strike 4.12 build | $6,000 | Shellter 11.1 included | Advertised price |
| **Cobalt Strike 4.12** | Cobalt Strike 4.12 build | $3,000 | Second listed price | Advertised price |
| **Cobalt Strike PS1 template** | Latest PS1 template | Not stated | Claims 3 out of 36 detections | Not stated |
| **Signed Cobalt Strike binary** | Binary signed with Microsoft, under 1MB | Not stated | Claims 0 out of 36 detections | Not stated |
Full list: EDR license vendors (7 items)
- CrowdStrike at $200
- SentinelOne at $200
- Kaspersky EDR at $220
- Trend Micro at $200
- Cortex XDR at $220
- Bitdefender at $200
- ESET Inspect at $200
Full list: premium crypt named products (7 items)
- CrowdStrike
- SentinelOne
- Kaspersky
- Defender
- XDR
- EDR
- AV
Full list: premium crypt payload categories (7 items)
- Red team payloads
- RATs
- Stealers
- Clippers
- Loaders
- Botnets
- Keyloggers
Full list: premium crypt supported formats (5 items)
- x64 and x86 native
- C, C++, Go, Rust, and Nim
- .NET Framework and .NET Core
- exe, dll, and bin conversion
- ps1 wrapping for fileless memory execution
Full list: premium crypt listed results (4 items)
- Static detection at 0 out of 26 on avcheck.net
- 24 hour monitoring
- 7 day monitoring
- Stub updates
Full list: Killer AV named products (19 items)
- Avast
- Norton
- TotalAV
- Bitdefender
- ESET
- McAfee
- Kaspersky
- Quick Heal
- Sophos
- Windows Defender
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- SentinelOne Singularity
- Kaspersky EDR
- Cortex XDR
- Bitdefender GravityZone Ultra
- Trend Micro Apex One
- VMware Carbon Black Cloud
- Cisco Secure Endpoint
Full list: Cobalt Strike named products (5 items)
- CrowdStrike Falcon
- Sophos
- Microsoft Defender
- Kaspersky
- ClamAV
### Phishing and AitM infrastructure
The EH listing calls the product a PaaS platform for AitM attacks. It says the system replaces manual configuration editing, Nginx restarts, individual phishlet builds, and instant detections from security systems. The closed-club listing describes limited private node seats and a community covering Evilginx modifications, SMTP mailers with DKIM spoofing, and spam system techniques. Premium rows are from the Evilginx2 v3.3.Pro 4 Modify listing.
These rows are advertised prices for phishlets, EH platform tiers, and related install listings.
| Listing | What the listing offers | Price tiers | Notes | Provenance |
| --- | --- | --- | --- | --- |
| **Tonkeeper phishlet** | Individual phishlet | $300 | Wallet, import wallet, recovery phrase, cookies, 2FA, session tokens, update | Advertised price |
| **Telegram phishlet** | Individual phishlet | $250 | Number, password, cookies, 2FA, session tokens, AutoLogin, update | Advertised price |
| **Amazon phishlet** | Individual phishlet | $250 | Email, password, cookies, 2FA, session tokens, AutoLogin, update | Advertised price |
| **New bank phishlets** | One price for each named bank | $1,000 each | Named banks listed below | Advertised price |
| **EH START Operator** | PaaS tier for AitM attacks | $500 per month | Inclusions listed below | Advertised price |
| **EH PRO Red Team** | PaaS tier for AitM attacks | $750 per month | Inclusions listed below | Advertised price |
| **EH closed club** | Limited private node seats | Not stated | Community topics stated above | Not stated |
| **Google Gmail and Services** | Premium phishlet | $2,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Binance.com** | Premium phishlet | $2,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Blockchain.com** | Premium phishlet with a JS inject module | $2,000 | Automatic 12 word seed collection | Advertised price |
| **Office 365** | Premium phishlet | $1,500 | Includes Okta and GoDaddy | Advertised price |
| **Azure.com** | Premium phishlet | $3,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **AWS** | Premium phishlet | $1,000 | Listed through amazon.com | Advertised price |
| **Salesforce** | Premium phishlet | $1,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Microsoft Ads** | Premium phishlet | $1,500 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Wells Fargo** | Banking phishlet | $2,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Citi** | Banking phishlet | $2,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Bank of America** | Banking phishlet | $2,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Chase** | Banking phishlet | $2,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Scotiabank Canada** | Banking phishlet | $1,500 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Amazon.com** | E-commerce phishlet | $1,000 | Separate from the $250 Amazon phishlet | Advertised price |
| **Facebook** | Social phishlet | $1,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Instagram** | Social phishlet | $1,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **GitHub** | Social phishlet | $1,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **Airbnb** | E-commerce and social phishlet | $1,000 | Evilginx2 v3.3.Pro 4 Modify | Advertised price |
| **EH plus EvilGinx Pro Modify 4.3.0** | Update for existing clients | $500 | Inclusions listed below | Advertised price |
| **EH plus EvilGinx Modify 4.3.0 Full Pack** | Full pack plus phishlets for new clients | $3,500 | Inclusions listed below | Advertised price |
Full list: bank phishlets at $1,000 each (21 items)
- KeyBank
- Regions Bank
- Fifth Third Bank
- Huntington Bank
- BBVA USA
- Citizens Bank
- M&T Bank
- BMO Harris Bank
- First Republic Bank
- Zions Bank
- Webster Bank
- Simmons Bank
- Old National Bank
- Comerica Bank
- First Horizon Bank
- Valley National Bank
- Bank of the West
- First Citizens Bank
- Cadence Bank
- Pinnacle Financial Partners
- Ameris Bank
Full list: additional Evilginx targets with no price in that listing (22 items)
- AOL
- Yahoo
- OKX
- Telegram
- Bybit
- iCloud
- OpenAI
- X.com
- PayPal
- LinkedIn
- Adobe
- Bitget
- Capital One
- La Poste
- Ibank
- Privacy
- Tonkeeper
- Volksbank
- Capitalist
- Discord
- Iamconnected.com
- PortBase
Full list: phishlet categories (83 items)
**Bank**
- Wells Fargo
- Citi
- BOA
- Chase
- Scotiabank
- Capital One
- Ibank
- Volksbank
- KeyBank
- Regions
- Fifth Third
- Huntington
- BBVA USA
- Citizens
- M&T
- BMO Harris
- First Republic
- Zions
- Webster
- Simmons
- Old National
- Comerica
- First Horizon
- Valley National
- Bank of the West
- First Citizens
- Cadence
- Pinnacle
- Ameris
- Banrisul
- Banco Mercantil
- Banco Original
- BTG Pactual
- Banco Inter
- Chime
- BREX
- PayPal
**Crypto and payment**
- Binance
- Blockchain
- OKX
- Bybit
- Bitget
- Tonkeeper
- Bitcoinira
- PayPal
- Capitalist
- Polymarket
- Privacy
- Kraken
- Raydium
**Mail**
- Google
- Office 365
- AOL
- Yahoo
- iCloud
- La Poste
- Mailo
- Migadu
- Kolab Now
- Mailfence
- GMX
- Tutanota
- Runbox
- WEB.DE
- Mail.com
- SendGrid
- Nubo
**Social**
- Facebook
- Instagram
- Telegram
- X
- LinkedIn
- Discord
- GitHub
**Other**
- Azure
- Salesforce
- Airbnb
- OpenAI
- Adobe
- PortBase
- Siquando Forum
- Seeweb
- Amazon
Full list: EH platform tier inclusions (10 items)
**START Operator**
- One active server
- Web panel
- Basic phishlets
- No provided domain or certificate
**PRO Red Team**
- Unlimited nodes
- Dedicated isolated server profile
- Customizable phishlets
- Role-based access for Admin, Operator, and Analyst
- Corporate SIEM integration
- Personal 24 hour and 7 day support
Full list: EH plus EvilGinx install inclusions (8 items)
- Live installation and setup
- Custom configuration
- Chat support in the EH panel and Telegram
- AnyDesk configuration
- Mandatory screen recording
- Expert guidance
- Comprehensive support
- Personalized approach
PayPal is listed under both Bank and Crypto and payment. I kept that repeat. The category list is an inventory of names. A price above applies only where that same listing states it.
### Insider lookup and account services
Rows say Not stated where a listing gives no figure. Two prices are printed as x,xxx and xxxx, and those strings are copied. DoorDash says a bulk discount is available. The Namecheap and GoDaddy listing says the $1,000 base can vary with domain traffic, and it claims domain takedown.
The Verizon lookup listing says buyers can cross-check the data and that tests are accepted. That listing shows no price. The bundle listing claims Verizon services since 2025. It says a test can be done on an alt account the buyer owns, that an escrow middleman is accepted, and that proof of processing will be provided.
Telecom lookups list T-Mobile, Three UK, Vodafone, Lycamobile, Rogers, and Xfinity at $1,000 per lookup, plus a T-Mobile swap at $10,000 and an Xfinity swap at $5,000. A separate Xfinity ISP and mobile listing prices a lookup at $500 and a reset at $800, with a turnaround of 20 to 40 minutes. That listing also names CSA, CPNI, landlines, and locked accounts.
The Roblox terms listing gives a turnaround of 0 to 3 days, usually one day, and says the fee is refunded if the work is not done in 3 days. It claims to be the cheapest available. Checkmark and shielding prices are not stated, and those listings say to ask. The Airbnb listing says buyers and sellers can be searched.
Every figure in this table is an advertised price, except the SIM-swap row, which I recorded under COM as a claimed unit price.
| Service | Input stated | Data returned (as stated) | Price | Turnaround (if stated) |
| --- | --- | --- | --- | --- |
| **SIM swap** | Not stated | Not stated | $1,000 to $1,400 each (claimed earnings) | Not stated |
| **Verizon lookup and swap** | Not stated | Listed below | Not stated | Not stated |
| **Coinbase** | Not stated | Not stated | Not stated | Not stated |
| **Discord** | Not stated | Listed below | Not stated | Not stated |
| **Gmail, contact listing** | Not stated | Listed below | Not stated | Not stated |
| **Namecheap and GoDaddy** | Not stated | Listed below | $1,000 base | Not stated |
| **Lookup and EDR bundle** | Not stated | Not stated | Not stated | 1 to 3 days |
| **Xfinity ISP and mobile lookup** | Email and number | Everything on the account | $500 | 20 to 40 minutes |
| **Xfinity ISP and mobile reset** | Email and number | Recovery password, password change, and 2FA method change | $800 | 20 to 40 minutes |
| **AT&T swaps** | Email or number | Not stated | Not stated | Not stated |
| **UK domain reset** | Not stated | Not stated | $800 each | Not stated |
| **eBay and PayPal lookup** | Email, phone, address, name, order number, or IP | Listed below | $400 | Not stated |
| **Telecom lookup** | Number, email, or name | Everything on the entire account | $1,000 per lookup | Not stated |
| **T-Mobile swap** | Not stated | Not stated | $10,000 | Not stated |
| **Xfinity swap** | Not stated | Not stated | $5,000 | Not stated |
| **Outlook lookup** | Not stated | Everything, including phone, email, backup email, backup phone | Not stated | Not stated |
| **DoorDash lookup** | Email, phone number, or order number | Listed below | $350 per lookup | Not stated |
| **LinkedIn profile lookup** | Profile link | Listed below | $600 each | Not stated |
| **Uber and Uber Eats** | Not stated | Most recent 3 trips and everything linked | x,xxx per | Not stated |
| **Cox Mobile and ISP lookup** | Phone or email | Listed below | $1,000 | Not stated |
| **Gmail lookup** | Not stated | Listed below | $3,500 | Not stated |
| **Meta lookup (IG, FB, WP)** | Username, IGID, or number | Listed below | $600 each | Not stated |
| **Instagram unban** | IG username, follower count, and ban note screenshot | Any ban reason. Also bans, post removals, and userclaims | $1,000 to $3,000 | Not stated |
| **Epic Games lookup** | Username or email | Listed below | $1,400 per lookup | Not stated |
| **Email reset** | Email | Recovery password, password change, and 2FA change to yours | $300 each | Not stated |
| **Meta Business Manager lookup** | Profile link | Listed below | $850 | 30 minutes |
| **Roblox lookup and shielding** | Profile link | Listed below | $850 | 0–3 hour |
| **X and Twitter unban** | Not stated | Not stated | xxxx per request | 24 hour |
| **Apple lookup** | Phone number or email | Listed below | $400 | Not stated |
| **Airbnb lookup** | Number, email, or user | Everything on the account | $800 per request | Not stated |
| **Google Ads lookup** | Mail or ad URL | Listed below | $700 per request | Not stated |
| **Roblox terms, OGU** | Not stated | Not stated | $1,000 | 0 to 3 days |
| **Roblox terms, limiteds** | Not stated | Not stated | $1,500+ | 0 to 3 days |
| **Roblox terms, checkmarks** | Not stated | Not stated | Not stated | 0 to 3 days |
Full list: returned fields by service
**Verizon lookup and swap**
- Name
- Business names
- Date of birth
- Address on file
- Email
- Phone plan
- Device description
- Rate
- Phone model or IMEI
- SIM or ICCID
- Account number
- Latest bill amount
- Latest bill date
**Discord**
- Email
- Number if any
- IP login history
- Device IDs if any
- Billing information
- Transaction logs
**Gmail, contact listing**
- Email
- Number if any
- IP login history
- Device IDs if any
- Billing information
- Transaction logs, including other Google services such as YouTube
**Namecheap and GoDaddy**
- Email
- Number
- Billing information
- Domain owner first and last name
- Address if found
- IP login history
- Transaction logs
**eBay and PayPal**
- Full name
- Home address and date of birth
- All linked information
- Payment method
- Recent orders
- IP address
**Meta lookup (IG, FB, WP)**
- Email
- Phone number
- 2FA status
- Registration date
- Country
- Predicted home location
- Date of birth
- Active status (180 days)
- IPs
- Device and machine list
- Linked accounts
- Private IG stories and posts
- Last active time
- Ad accounts
**Roblox lookup and shielding**
- Email
- Phone
- Creation date
- Premium expiration dates
- User ID
- More
**LinkedIn profile**
- Full name
- Email and phone number
- Account notes or violations
- Latest IP, sign up IP, and last activity IP
- Date of last activity
**DoorDash**
- Full name
- Linked phone number and email
- Orders and total spent
- Last 3 recent orders
- Home address
**Epic Games**
- Email
- Phone number
- First name and last name
- User ID
- Console currently connected and dates
- Previous link
- Invoices
- Payment method
**Gmail lookup**
- Phone
- Email
- Backup email
- Backup phone
- Creation date
- Last attempt IP
- Creation IP
- Geolocation
**Meta Business Manager**
- Business ID
- Owner or managed partner
- User access and roles
- Account team
- Credit line if available
- Billing status
- Risk profile
- Review status
- Linked assets
- IDD diagnostics
- Policy and setup
- More
**Google Ads**
- Name
- All data
- Campaign ROAS
- CPC
- Campaign structure
- Assets
- Keywords
- Address
- Billing information
- More
**Apple**
- Email
- Number
- Name
- Address
- Recent orders and order number
- Physical item orders
**Cox Mobile and ISP**
- Everything on the account
- For mobile: ICCID, IMEI, and everything on the account
- From an email search: everything on the entire account
Full list: lookup and EDR bundle services (15 items)
- Microsoft
- Minecraft
- Instagram
- Facebook
- Discord
- Namecheap
- GoDaddy
- Domain suspensions
- TikTok
- Xbox
- DoorDash
- Uber
- Uber Eats
- Verizon
- More
Full list: UK domain resets at $800 each (13 items)
- worldonline.co.uk
- Tinyworld.co.uk
- Talktalk.net
- Homecall.co.uk
- Tiscali.co.uk
- ukgateway.net
- screaming.net
- homechoice.co.uk
- lineone.net
- toucansurf.com
- Dsl.pipex.com
- pipex.com
- tinyonline.co.uk
Full list: always active services (23 items)
- Meta (IG, FB, WP) lookups
- CenturyLink resets
- LinkedIn lookups
- eBay lookups
- PayPal lookups
- DoorDash lookups
- IG bans, unbans, and shadowban removal
- Cox Mobile and ISP lookups
- Epic Games lookups
- Gmail lookups
- Three UK lookups
- Vodafone lookups
- Virginmedia and O2 lookups and resets
- Earthlink resets
- Apple lookups
- Google Ads lookups
- Airbnb lookups
- Three UK email changes
- Lycamobile lookups
- Roblox terms
- Xfinity lookups and resets
- TikTok lookups
- Venmo lookups
Email resets at $300 each cover Virginmedia, Centurylink, and Earthlink. The X and Twitter listing says the printed price depends on user value and followers.
## Listing Examples
The blocks below are reconstructed from listings I observed. Seller names, handles, and contact details are omitted.
```text
Premium crypt listing
Provenance: Advertised price
Claim: FUD and AV or EDR bypass
Named: CrowdStrike, SentinelOne, Kaspersky, Defender, XDR, EDR, AV
Single: $100 for 4 unique copies
Weekly: $750 for 7 days
Monthly: $2,500 for 30 days, with full support and custom stubs
Listed result: static detection 0 out of 26 on avcheck.net
```
```text
EH platform listing
Provenance: Advertised price
Described as: PaaS for AitM attacks
START Operator: $500 per month
One active server
Web panel
Basic phishlets
No provided domain or certificate
PRO Red Team: $750 per month
Unlimited nodes
Dedicated isolated server profile
Customizable phishlets
Roles: Admin, Operator, Analyst
Corporate SIEM integration
Personal 24 hour and 7 day support
```
```json
{
"service": "DoorDash lookup",
"input": ["email", "phone number", "order number"],
"data_returned": [
"full name",
"linked phone number and email",
"orders and total spent",
"last 3 recent orders",
"home address"
],
"price": "$350 per lookup",
"bulk_discount": "Bulk discount is available",
"provenance": "Advertised price"
}
```
## Analyst observations
The highest printed monthly figures are claimed earnings, not verified income. Owners of top stealers and drainers are listed at $30,000 to $100,000 or more per month. Cash-out infrastructure owners are listed at $30,000 or more per month. Large traffic teams are listed at $15,000 to $50,000 or more per month.
Large dropper services with multi country agents are listed at $15,000 to $40,000 or more per month. Big sellers with their own sources, and underground call center organizers, are listed at $20,000 or more per month. Direct insiders and large lookup services are listed at $5,000 to $20,000 or more per month.
The stealer and drainer line is the only monthly range that prints $100,000. Other high ranges end at "or more" and give no ceiling. The listings also show two upper tiers outside that highest-range group: large stuffer buyback services at $15,000 to $30,000 or more per month, and pros with private self registrations and merchants at $10,000 to $25,000 or more per month.
I group the lower claimed earnings with individual rendering, basic calling, beginner carding, small selling, and early traffic. I group the middle with experienced callers, experienced sellers, gift carding, renderers, droppers, and stuffers. I group the higher claimed earnings with private tooling, top stealers and drainers, large traffic teams, direct insider services, multi country dropper services, and cash-out infrastructure.
I observed prices tracking access, trust, scale, and operational difficulty. The high ranges sit with roles that control scarce access, private tooling, high value traffic, insider requests, or final cash-out infrastructure. This suggests those ranges attach to roles that hold an input other roles buy: a private tool, a direct insider, a traffic team, or the path that returns clean funds. That reading is not a measured profit.
I observed the roles as a chain of inputs. Traffickers start once tools are ready. Carders spend data and logs that sellers supply. Stuffers resell goods already obtained, and droppers receive parcels or transfers, while cash-out operators are the final link.
This suggests roles past tooling, traffic, or cash-out depend on an input the listings do not give them directly. The listings show those handoffs. I did not measure what happens if one role stops.
## Defensive Implications
- Crypting, code signing, and Killer AV are sold as services against named endpoint products. A file that carries a signature, or a host where protection was disabled, still needs a behavioral check.
- Traffic is its own role. The listings show Shorts, Reels, TikToks, SEO, Google and Bing Ads, spam, and drainer lures as the way targets reach phishing pages, stealers, and drainers.
- Carrier and mailbox changes are priced work. Listings advertise SIM swaps, mail resets, and lookups, including an Xfinity turnaround of 20 to 40 minutes and a bundle turnaround of 1 to 3 days.
- Cash-out is a dependency. The listings show drop accounts, parcel drops, KYC fronts, mixers, stablecoins, Monero, and merchant shells, and high claimed earnings for people who own that layer.
- The work is priced as separate roles. Detection is more useful at the handoffs between tooling, data, traffic, pressure, and cash-out than at any single role.
## Limitations
- Advertised prices and claimed earnings are not verified sales or income.
- These listings are what I see day to day. They are not a full census of the market.
- The dates 04.08, 19.06, and "until February" do not fix a year or a date format.
- Seller reliability is unknown. Warranties, detection counts, and offers of a test are seller statements.
- The same target appears in more than one listing. I kept the Uber, Gmail, Amazon phishlet, and telecom rows separate. The listings do not say they are one offer.
- Some prices are missing, or printed as x,xxx or xxxx. Ranges that end in "or more" have no ceiling.
- COM overlaps info broker work. I kept it as its own area.
## Sources and Note
There is a lot here, and this is just from what I see every day. If I missed something, please feel free to correct me by DMing me on X at [@_SW64](https://x.com/_SW64_)_.
### Credits
- [https://onion.as/823](https://onion.as/823)
- Telegram Groups/Channels