Executive Summary
ThreatWatch360 identified and analyzed Pepe Club, a marketplace focused on the sale of stolen payment card data and Fullz records.
The marketplace provides buyers with access to records containing payment card information alongside personally identifiable information (PII), including names, addresses, phone numbers, email addresses, and ZIP codes. Analysis also revealed a seller reputation system, cryptocurrency-based payments, automated delivery, and a dedicated Telegram presence used for announcements and vendor recruitment.
The platform appears designed to streamline the buying and selling of compromised financial data through a structured marketplace environment.
Marketplace Overview
Pepe Club operates through both dark web and publicly accessible web infrastructure, allowing users to access marketplace services through multiple channels.
The platform offers a traditional marketplace experience with user registration, account management, inventory browsing, shopping cart functionality, and automated purchasing workflows.
Marketplace announcements indicate that operators regularly update inventory and actively engage with both buyers and sellers through associated communication channels.
Figure 01: Pepe Club login portal.
Access and Registration
Registration appears to be open and does not require an invitation, reducing barriers for new users.
Once registered, users can access marketplace inventory, manage account balances, review orders, and purchase available records. The platform supports cryptocurrency-based funding, including Bitcoin (BTC) and Monero (XMR).
The marketplace also publishes operational announcements and warnings regarding phishing or impersonation attempts, suggesting operators actively manage their infrastructure and user communications.
Figure 02: Marketplace announcement and security notice.
Marketplace Features
Pepe Club provides several features commonly observed within underground marketplaces.
Users can search and filter inventory based on country, issuing bank, card type, and available data fields. Product listings display seller information, pricing, ratings, refund indicators, and claimed validity metrics.
The marketplace also includes a dedicated checkout process where users can review selected records before completing a purchase. Available evidence suggests purchased records are delivered automatically after payment rather than through an escrow model.
Seller ratings and customer feedback are prominently displayed throughout the platform, allowing buyers to assess inventory quality before making purchases.
Figure 03: Product listing interface.
Figure 04: Checkout workflow.
Product Offerings
Analysis indicates that Pepe Club primarily operates as a Fullz marketplace.
Observed listings included payment card data combined with personal information such as cardholder names, addresses, ZIP codes, phone numbers, and email addresses. This combination increases the value of the records by providing buyers with both financial and identity-related information.
Inventory is organized into datasets referred to as "Bases." These datasets appear to be grouped by geographic coverage and seller attribution. Observed inventory included records associated with multiple countries, including the United States, Canada, France, Germany, Ireland, and the United Kingdom.
Listings also indicate whether records are refundable and display seller-provided validity rates, allowing buyers to compare available inventory before purchasing.
Figure 05: Example Fullz dataset listing.
Seller Ecosystem
The marketplace maintains a seller-driven inventory model supported by public ratings and reputation indicators.
Observed listings displayed seller aliases, customer ratings, and claimed validity rates. While these metrics could not be independently verified, they appear to play an important role in helping buyers evaluate sellers and inventory quality.
Analysis also identified active recruitment efforts targeting large-volume sellers. Recruitment messages encourage experienced vendors to contact marketplace operators through Telegram, suggesting an ongoing effort to expand inventory and attract additional suppliers.
This vendor-focused approach indicates that marketplace growth is closely tied to maintaining a steady supply of newly acquired data.
Figure 06: Vendor recruitment advertisement.
Telegram Infrastructure
Telegram serves as a key communication and marketing channel for the marketplace.
The platform maintains a public channel used to announce new inventory, promote recently added datasets, publish marketplace updates, and communicate with the broader user community.
Observed posts frequently advertised newly available "Bases" and highlighted inventory associated with specific countries and sellers. The marketplace also uses Telegram to recruit vendors and direct prospective sellers to dedicated contact accounts.
The integration of Telegram provides operators with a communication channel outside of the marketplace itself while simultaneously promoting new inventory releases.
Figure 07: Marketplace Telegram channel.
Figure 08: Inventory announcement published through Telegram.
Assessment
Pepe Club exhibits characteristics commonly associated with organized carding and Fullz marketplaces.
The platform combines cryptocurrency payments, automated delivery, seller reputation systems, inventory filtering, and external communication channels into a single ecosystem designed to facilitate the exchange of compromised financial data.
Particularly notable is the marketplace's emphasis on seller reputation, refund indicators, and inventory validation claims. These features appear intended to increase buyer confidence and encourage repeat transactions.
The marketplace's active recruitment of large-scale sellers, combined with frequent inventory announcements, suggests an effort to continuously expand available datasets and maintain marketplace activity.
Operational Infrastructure
Pepe Club maintains infrastructure across both dark web and publicly accessible web services. The marketplace also operates Telegram channels used for inventory announcements, vendor recruitment, and operational communications.
To prevent misuse, direct access details and marketplace URLs have been intentionally omitted from this report.
Conclusion
Pepe Club is a Fullz marketplace focused on the distribution of compromised payment card data and associated personal information.
Analysis identified a structured marketplace environment featuring cryptocurrency payments, automated record delivery, seller reputation systems, inventory validation indicators, and Telegram-based communications. The platform's recruitment of large-volume sellers and regular inventory updates suggest an active effort to expand available datasets and sustain marketplace operations.
Continued monitoring of marketplace activity, seller recruitment efforts, and newly advertised datasets may provide valuable insight into evolving trends within the payment card fraud ecosystem.
