The German Underground: Buying and Selling Goods via Droppers

The recent Paris attacks were carried out with both guns and explosives. While the perpetrators probably made the latter themselves, they could not do the same for their guns. So where did they turn to? One option may have been: the Deep Web.

On November 27, a German arms dealer was arrested on suspicion of illegal arms trading. While prosecutors refused to definitively confirm or deny them, leaks to the German press indicated that the suspect sold four AK-type assault rifles to the attackers. It is believed that he sold guns over the Deep Web to anyone who could pay up the cash.

This connection between acts of terrorism and the Deep Web isn’t surprising. We have frequently talked about how the Deep Web is used as a venue for the illegal trade in weapons and drugs. Our research on the German-speaking underground community has given us a lot of insight on the transactions that occur and the individuals behind them.

Figure 1. MacBook for sale via the German underground

For example, let’s take a person named Klaus. He wants to buy an expensive MacBook Pro but he does not want to pay a lot of money for it. He acquires a nickname – “Pink Panther” – and visits the well-known German underground forums likebus1nezz.biz and crimenetwork.biz. There he finds another user named “El Ano”, who runs an eponymous dropping service.

El Ano is one of many droppers that offer their services to would-be buyers like Pink Panther. Simply put, El Ano “buys” items for his customers and pays for them with stolen funds (for example, from compromised PayPal accounts). All he charges his customers is a minimal fee of what he has to “pay” for.

In this case, Pink Panther selects a MacBook on eBay which he will “buy” for 1000 euros. He makes contact with the seller who is convinced to accept PayPal instead of credit cards. The information of the seller is sent to El Ano, who makes the payment. Pink Panther will then pays El Ano for his service, with an amount that is far less than the asking price on eBay, and agrees to pick up the laptop in person.

Pink Panther now has a laptop for far less than he would normally have paid for. El Ano has his “fee”. Of course, once the fraud was discovered either PayPal or the seller would be in trouble. By that time, however, multiple transactions could have been carried out by the fraudsters. As a result, PayPal dropping appears to be a thriving modus operandi in the German underground.

Figure 2. Advertisement for El Ano’s dropping service

The above text is an advertisement by El Ano on a German underground forum. Translated into English, it reads:

“$$$ Paypal – Pick Up – Payments $$$

Paypal, Payments, Carding, Drops, Money, Bitcoin, Cash

Dear Fraud community, As I had to decline several customers last week, I have decided to offer you a “happy hour” for Monday, November 30 from 10am to 10 pm. Every payment up to 1.4k is 99 EUR. Anyone who gives me feedback with a pic and username gets the offer for 80.

Hello CNW (crimenetwork),

I’m offering PayPal payments and also the PayPal pick-up service (Just in Time Dropping). As my former thread was deleted, you can find all information in this new thread.

The post below describes how to pick up any goods “bought” via dropping. PackStation is a service in Germany that allows customers to send and receive parcels via automated booths located across the country. The English translation follows the post itself:

Figure 3. Ad describing the dropping process

Pick up your goods today itself!

You don’t have time to wait for your package? Or it’s too much risk to wait near the PS (PackStation)? Then this is the exact right place for you! I pay for your articles of choice and you can come pick it up right after!

Procedure for pick up:

You chose your articles from Ebay classified ads and ask the person if a payment via paypal and pickup is possible. I can give you a few pointers as to what stories make it seem more credible and more often than not vics (victims) buy into them.

You sent me the seller’s Paypal Address, I send the payment and let you know.

We stay in contact until the drop is completed. Before you knock at person’s door, ask if everything is fine and to be 100% sure it’s fine.

Payments to shops, private mails etc… all possible

Price for a normal PayPal payment is 20% of the payment value (up to EUR 2000)

Price F&F PayPal payment: 35% of payment value (right now only up to EUR 750)

Carding a PS or HD (new)

You tell me your article of choice. EUR 500

I will tell you my price for the article

You pay

a suitable vic (victim) will be selected who sends to PS (PackStation) or HS

We facilitate the entire contact + payment and you get a tracking ID from me

Should we not be able to find a suitable vic for items such as gold or jewelry (which can happen), then you receive your money back

Using stolen accounts to buy goods is just one facet of the German underground economy. Our recently published research paper titled U-Markt: Peering into the German Cybercriminal Underground takes a closer look at the German underground, describing the products and services available for sale as well as the way users operate to conceal their movements. We also compare the German underground community to better-known communities such as the Russian underground and provide a list of users who seem to frequent both platforms.