In addition, law enforcement in the U.S. also seized four domains used by the website: “wt1shop.net,” “wt1store.cc,” “wt1store.com,” and “wt1store.net.”
Nicolai Colesnicov, 36, of the Republic of Moldova, operated WT1SHOP, is facing charges of operating an online market that allowed vendors to sell stolen login credentials and other PII, including 25,000 scanned driver’s licenses/passports, 1.7 million login credentials for various online shops, 108,000 bank accounts, 21,800 credit cards, federal officials said.
WT1SHOP provided a forum and payment mechanism for the sale and purchase of stolen PII, using Bitcoin, according to the complaint.
in June 2020 Dutch law enforcement officials obtained an image of the WT1SHOP database that showed there were 60,823 registered users on the site, including 91 sellers and two administrators. As of June 2020, sellers on WT1SHOP had engaged in sales of 2.4 million credentials for $4 million, according to the complaint.
The credentials consisted of login credentials for retailers and financial institutions, email accounts, PayPal accounts, and identification cards, as well as credentials to remotely access and operate computers, servers, and network devices without authorization, according to the complaint.
Law enforcement’s review of WT1SHOP in December 2021 showed the number of users and sellers on the website had increased to 106,273 users and 94 sellers with 5.85 million credentials available for sale.
Law enforcement traced Bitcoin sales made on WT1SHOP, payments made to the webhost of WT1SHOP, email addresses related to WT1SHOP, and associated login information from these accounts to Colesnicov, including determining Colesnicov was the operator of WT1SHOP based on his logins as the administrator on the WT1SHOP website, according to the affidavit.
If convicted, Colesnicov faces a maximum sentence of 10 years in federal prison for conspiracy and trafficking in unauthorized access devices.