#INSTORE CARDING FORUMS ARCHIVE#
#INSTORE CARDING FORUMS PROFESSIONAL#

In order to accomplish the latter goal, Andrew jokes that he “will probably have to rob all the banks in the world.”Īfter searching my huge personal archive of hacked cybercrime forums for Andrew’s various email and Jabber addresses, I found several private messages sent by different users on the Spamdotbiz forum who recommended to other members the Jabber address as someone to contact in order to hire a service that could be used to flood someone’s Gmail inbox with tens or hundreds of thousands of junk messages. Here we learned that Andrew’s current goals (as of 2010) were to get married to his girlfriend, buy the $20,000 Toyota Solara pictured below, move to Helsinki, and to achieve world domination. This Google groups discussion about CakePHP includes a message from an Andrey Hodirevski who uses the email address is no longer online, but a cached copy of it from shows it was once Andrew’s personal site.

#INSTORE CARDING FORUMS PROFESSIONAL#

It says his professional skills include programming in Java, CakePHP and MySQL, among others. This page at lists an Andrey Hodirevski from Odessa with the same anime profile image, the “purplexcite” Twitter profile, and a Skype address by the same name.

Recall as I mentioned at the top of this post that one of the clones of the card shop at Rescatorla is kaddafihk.

Ghost.ua lists several pricing plans for its servers, naming them after different despotic leaders, including Fidel Castro and Muammar Gaddafi (it is spelled “Kaddafi” on Ghost.ua). That site is no longer online, but a cached copy of it at shows that the business is located in Odessa at this address, and the phone number +38 (048) 799-53-13. Andrew’s LinkedIn page also says he is the administrator and Web developer at a hosting company in Ukraine called ghost.ua. The same anime profile image for Andrew’s LiveJournal page is also on the LinkedIn profile for an Andrew Hodirevski from Ukraine, and the two pages share the aforementioned Twitter profile (purplexcite).

In almost a dozen posts on LiveJournal, Hodirevski talks about his interest in Java programming, and even includes a few pictures of himself attending an instructional class on Java. That profile (“ ikaikki“) says Hodirevski’s email address is that his Jabber instant message address is and that his Twitter account is “ purplexcite” (that Twitter has since been deleted). I located a relatively recent Livejournal profile ( /profile) for an Andrew Hodirevski from Odessa, Ukraine that includes several profile pictures which are remarkably similar to the photos of Helkern leaked by the cihms guys. In this cached post we can see him again claiming the 261333 ICQ address, and pointing out to other members that his real nickname is Helkern.Īndrew from Odessa’s LiveJournal profile pic from the account ikaikki”Ī historic WHOIS lookup ordered from shows that was first registered in 2008 to an Andrey Hodirevski from Illichivsk, a city in the Odessa province of southwestern Ukraine. Helkern - going by his shortened username “Hel,” also was a VIP member of xakername. Helkern said his email address was his Skype address was helkern_skype, and that he lived in Odessa, the third-largest city in Ukraine. In this introductions page from a Russian language gaming forum, a user named Helkern also was active in 2008 and claimed that same ICQ address. In it, he claims ownership of the ICQ instant messenger address 261333. So if Helkern is Rescator, who is Helkern? If we check at some of the other Russian forums that Helkern was active in at the time that Darklife was online in 2008, we can see he was a fairly frequent contributor to the now-defunct Grabberzcom in this cached post, Helkern can be seen pasting an exploit he developed for a remote SQL injection vulnerability. Darklife admin “Helkern” brags to other members about hacking into cihms, a more elite Russian hacking forum.In a counterattack documented in the entertaining thread that is still posted as a trophy of sorts at cihms/old/epicfail, hackers from cihms hacked into the Darklife forum, and posted personal photos of Helkern and fellow Darklife leaders, including these two of Helkern:

Instore carding forums