you may have heard that the hacker known
as pom pom purin who was the founder and
head admin of breach forums was arrested
by the FBI in New York last week on one
count of conspiracy to solicit
individuals with the purpose of selling
unauthorized device access which is
basically fed speak for saying that this
guy was running a forum where people
could sell hacked databases and palm
himself even acted as a middleman for a
lot of those transactions since I guess
it's kind of difficult to sell
information to people directly but now
we have copies of court papers
pertaining to pom pom's charges that
tell us exactly how he got caught and
we're going to take a look at what he
could have done better to not be an FBI
custody right now now for a little bit
of background Palm created breach forums
shortly after raid forums another place
where hackers could have have gone and
sold their databases was seized by the
FBI the feds managed to get full access
to the database of this forum after they
compromised it so at that point they
were able to see all of the information
that members of this forum used when
they signed up their names their email
addresses every post that they made on
the Forum as well as all of their DMS on
the Forum now pom pom purrin was a
member of raid forums for some time and
he had some notoriety here he even had
Direct conversations with omnipotent the
founder and owner of raid forums which
is where we're going to see the first
opsec mistakes that Palm made so this is
a copy of the conversation that Palm had
with omnipotent back on November the
28th of 2020 about a recent data breach
of the popular Android keyboard app AI
DOT type and that particular data breach
had resulted in the names phone numbers
and email addresses of the app's 31
million users getting leaked to the
public because of a mistake that the
developer made so the conversation goes
like this hello I'm sorry to bother you
with this but I noticed recently that
the AI DOT type data breach post doesn't
seem to include every user at least to
my understanding looking up one of my
old emails on have I been pwned I come
up as in it but I cannot locate myself
in the file provided at and this is the
file containing everyone's info it seems
that maybe it is only a partial amount
of data from it I was under the
impression that it was the full amount
of data from looking at the thread as I
didn't see any mention of it only being
some of the data from the breach
not messaging to ask for credits back or
anything and credits are what they use
in the Forum in order to purchase these
data breaches because I wanted it
anyways I just wanted to let you know
that it doesn't seem to be the full
amount of data and that the thread
doesn't seem to communicate that it
isn't the full one thanks winky face and
then this is a response from omnipotent
what email did you look up and how
pom pom responded apologies for late
reply here is another email that I found
to be present on have it been pwned but
not inside of the file provided on the
thread I don't want to share my actual
email for obvious reasons but this email
seems to have the same case as mine
Connor Fitzpatrick 02
gmail.com and then here we have a link
to where he's um
basically showing us
the screenshot of Connor Fitzpatrick O2
in gmail.com showing that it does show
up in a couple of different data
breaches and then he explains how he's
searching the file locally on his
computer using the grep command and he's
saying that to make sure the command is
working correctly I made a test.txt file
including the email address I'm trying
to search in the same format as the data
in the breach and then he runs the same
command and it works on his test.txt but
not the original one and then I think
this is a screenshot of him yeah so this
is a screenshot of him trying to do
those grep commands to find the data on
his local computer now you probably
guessed correctly that Connor
Fitzpatrick O2 gmail.com is pom pom's
real email address but you didn't even
have to guess because at the top of the
affidavit we've got his name right here
United States of America versus Conor
Brian Fitzpatrick AKA Pom-Pom purin the
defendant so obviously the email address
first name last name and year of his
birth at gmail.com is going to be his
personal email and this was also connect
to his personal Google pay account which
also had his personal Visa card listed
on there now of course Conor didn't want
omnipotent to think that this was his
real email and omnipotent probably
didn't think it was at the time but of
course later on the FBI agents reading
this would figure out the truth now it's
not an uncommon thing for hackers or
really anyone that has a little bit of
cyber security knowledge to try and find
themselves in a leaked database or on
have I been pwned.com in fact that's the
whole reason that that service was
created it can easily let you search
through 12 billion email and phone
records from hundreds of different
database leaks that have happened over
the years so that you can very quickly
see if your information shows up in any
of them and we see that this is the
correlation Palm was making to say that
the database leak was incomplete but if
you think about this for a moment
the ability to come up with a random
email address that you have no
connection to that's part of the whole
database leak but not part of this
partial database leak that would be like
finding a needle in Haystack it's very
very unlikely that any email you're
going to be able to pull out is not one
that you have some association with now
a couple of months prior to this
conversation that pom pom had with
omnipotent he had created the email
address Connor
fitzpatrick2002 gmail.com in order to
replace that older email address that
had been pwned in some databases and
again this new personal email address
was linked to his Google pay account
which has his full name and home address
on it and that Google pay account was
tied to his Visa card ending in 3068
Again full name and home address is
associated with that and the account was
tied to two of his personal cell phones
and iPhone 11 Pro Max IMEI ending in
5342 and an iPhone 7 plus IMEI ending in
93.71 both of these phones had been tied
to Conor's personal Verizon phone number
ending in 3144 and it even looks like
both of these phones at one point in
time had used the same sim card with the
imsi ending in
6028 now the reason that I'm talking so
much about his phones is according to IP
records Connor had apparently used these
phones at least nine times to access his
pom pom purrin account on raid forums in
2021 so that right there is an
unbreakable chain linking Conor's
personal life to his hacker man life but
it doesn't stop there you guys the
recovery email for Connor
fitzpatrick2002 gmail.com was
funmc59tm at gmail.com which was used to
register another account on raid forums
with the name a a and when the feds
trace the registration of this AAA
account back to the IP address they
found that they were using the
74.101.151.4ip then when they go and
pull the records from Verizon they see
that it was registered to a customer
with the last name Fitzpatrick at the
union premises with a telephone number
ending in 2956 and the email address
associated with the same person's public
employment but this wasn't actually uh
Connor Fitzpatrick the sun this was
Connor Fitzpatrick the father so this is
when he was using his dad's internet
connection uh where he was probably just
living with his dad because again this
kid was like 20 when he got arrested so
he's living with his dad creating
hackerman accounts on his dad's bare IP
address not covering him with a VPN or
tour or anything like that but wait
there's even more links right records
received from Google concerning Connor
fitzpatrick2002 gmail.com also showed
logins from numerous virtual private
network provider companies from at least
on or about September 20th 2021 through
on or about May 12 2022 and then we get
a long list of all these different vpns
that he was using so it looks like
around 2021 towards the end of 2021
Connor finally figured out what a VPN
was and I have a feeling that he might
have learned how vpns work from one of
the many influencers that show them on
YouTube saying that oh they're gonna
make you so heck insecure and anonymous
because they don't keep locks
but you know
the feds really don't even have to
subpoena the VPN company they don't have
to hack them or capture traffic go and
plug in some black boxes into a closet
somewhere to find you
when you use
the same [ __ ] IP address
for the VPN server to log into your
personal Gmail and then the next day you
go and log into your hackerman account
for instance on or about March 7 2022
records received from Google show that
the Connor fitzpatrick2002 gmail.com
Google account was accessed from IP
address
89.187.181.117 on or about March 7th
2022 this was owned by datacamp limited
however a query of this IP address on
spur.us in turn revealed that this IP
address was actually used by the VPN
provider ivpn at the time then according
to records from Zoom that same IP
address was used the following day on or
about March 8th 2022 to log into a zoom
account under the name of pom pom purrin
which was an email address of or with an
email address of pompompurin at rise up
Dot dot net the Pom-Pom pernet rise
up.net email address is notable because
at the time of zoom's accounts Creations
it also served as Pom-Pom pern's
registration email on raid forums per
records obtained by the FBI in that
investigation I mean come on dude don't
you think even the dumbest FBI agent on
the planet can figure out that two
different accounts being accessed less
than a day apart from the same VPN
server belongs to the same person
you see this is how people get caught
the feds rarely end up using these
Advanced Techniques like backdoored
applications or backdoored CPUs or any
of that crazy stuff that you hear people
talking about the three-letter agencies
being able to do it's always the low
hanging fruit
that seems to get these guys caught up
and I find it really funny
how hackers you know people that you
would think know more about opsec than
any other criminal Under the Sun are
making the same kind of dumb mistakes
that these gangsters in the Bronx that
got ricoed were making basically these
guys that I was just watching this trap
geek video about were killing their Ops
getting seen on camera because there's
more cameras in New York than there are
street lights and then they would brag
about the murders on Instagram live and
that same person would later on be
featured in a music video that millions
of people watch talking about killing
their Ops and I think in one of the
cases this dude was wearing a pair of
unreleased Jordans
he killed a dude and then later on he's
in an Instagram live wearing that same
pair of unreleased Jordans
and of course they're gonna see on
camera there's there's more cameras in
New York than there are street lights I
mean there's comedy bits about how dumb
these Street kids are when it comes to
their opsec and you know they're both
from New York Pom-Pom burns from like
pesakill New York or something like that
and obviously these kids are from the
Bronx and despite being from New York it
seems like neither one of them have
heard of Biggie's 10 Crack Commandments
basically an offset guide for selling
rocks but the way I see it if Palm had
followed rule seven and kept his real
life in business completely separated
maybe get a different phone for all of
his hacker man activities and if he
wouldn't have pulled this dumb stunt in
his DMS where he's like oh yeah Connor
fits Patrick O2 is totally not my real
email if he hadn't done that then Palm
probably would not be sitting with the
feds right now so since we know that
Pom-Pom pern's personal opsec was
garbage it's got a lot of people asking
how good was his opsec when he was
running breach forums well we've been
getting updates from Baphomet who has
taken over breached after Palms arrest
and on March the 24th bath met posted a
message stating that the FBI did indeed
have access to breach forums SQL
database and this is further confirmed
from part 69 of the affidavit which
mentions the feds using IP information
obtained from breach forms SQL database
to confirm yet another link between
Connor's real identity and his hacker
man Persona since he used the same IP to
log in as pom pom purrin that he did to
backup stuff to his personal iCloud so
we're probably going to start seeing a
cascading effect in the coming months
and years of other hackers who had opsec
similarly as bad as Pom-Pom purins
getting arrested in the exact same way
because breach forums was pretty much
just a clone of raid forums in terms of
its look and feel at least so I really
wouldn't be surprised if these databases
containing DMS and all kinds of other
Crumbs are going to lead the feds right
to these hackers Apartments now Baphomet
is continuing to take his time with
redeploying the community or something
similar
and I'd have to imagine that he's
[ __ ] bricks but we'll just have to
see in the coming months and years if
his opsec is really as solid as he says
it is