TEAM ICE & THE ELUSIVE XBOX 360 MOD CHIP

PUBLIC ADVISORY
BY USTLER OF BLACKLISTED 411 MAGAZINE

What started as an innocent curiosity into the Xbox 360 modchip revealed a lot of
information that the public was not aware of. My original intention was to do an
interview with Team ICE, who we honestly believed to have had a legitimate product.
Through our communications, we soon became aware of information which that gave us
serious doubts into their claims. Not wanting to publish false information, we made an
effort to investigate every aspect of Team ICE and their past. The following information
is provided in order to help you make your OWN decision on the matter. We hope that
through verifiable information (some more than others), you will be able to draw a
reasonable conclusion into the validity of their claims.

Note to Team ICE: Our original intentions were not tainted, but through our
communication and investigation, Blacklisted411 cannot endorse the product without
verifiable proof. If you do have a legitimate product, we do apologize (although my
personal conclusion does not agree). Your lack of co-operation into providing detail, and
the blatantly wrong information you provided us has brought this upon you.

Rarecodes.com ­ icemodchip.com ­ infinitymods.com

Deception or mistake?
First, I would like to point out that infitymods.com have no apparent relation to
infinitymod.com (the makers of the Matrix Infinity modchip for PS2). Furthermore, the
name icemodchip also has no relation to the "Xenium Ice" modchip produced by Team
Xodus. Many people have concluded that the project was lead by Team Xodus, even
though this is not the case.

Is there a relationship between the sites?
The next claim started circulating not long after my initial contact with Team ICE had
started. Upon further investigation, I found that rarecodes.com, icemodchip.com and
infinitymods.com had the same IP address (odd yet interesting). A simple ping gave us
the IP address of 64.21.181.130 on all three URLs. Directly accessing the IP address
gives us a Cpanel message informing us that the IP address has no default host (meaning
that the websites are all virtually hosted). One could easily claim that the web host,
rarecodes.com, was simply virtually hosting their customers on a single IP address. The
next piece of information retrieved from the header of an email sent by Team ICE shows
the danger in not configuring your SMTP server properly.

This leak of information provides us with a complete list of email addresses being used
on the server. Notice that only icemodchip.com, infinitymods.com and rarecodes.com
appear. It's rather odd that a hosting company such as rarecodes.com would allow such a
leak of information. Simply by using nslookup we were able to do a Reverse IP address
lookup (meaning that instead of resolving a domain to an IP address, we resolve an IP
address to a domain). Using this, we got the hostname gold.whbdns.com. Next, we
wanted to validate the claim that rarecodes.com makes on their website.


"RareCodes Inc. is located in NL, Canada. We currently maintain 10 main
servers locally, and 32 mirror servers located in various U.S. States. All 42 of our servers
are running into a direct GiGaBiT Pipeline, which guarantees you the customer fast
speeds, at all times"

42 servers and ten of them are in Canada? Well, using Neotrace (Similar to VisualRoute)
we were able to create a quick map showing where the server is located. For obvious
reasons, the trace route was routed through a proxy and the portion containing the
origination of the trace was omitted.



Furthermore, we determined that the IP address is assigned to Net Access Corporation
(Although we are pretty certain they are only the host and have no involvement in
icemodchips.com or any of the other websites in question.)

In order to verify that rarecodes.com had no involvement, we attempted to contact them
by phone. Much to our disappointment, the phone number listed on their website "709-
749-0373" was not working. Instead of being greeted by Rarecodes, we got this strange
message:

Roger's Wireless: The cellular number you have called is not assigned, please check the
number and try the call again. (Then repeated in French)

What happened to the 24 hour tech support? Why would a company like rarecodes.com
with their 48 servers and 10 local servers choose to associate themselves with a modchip
website??

Of course, we were not done yet. A few pieces of additional information prove to be
somewhat incriminating. First off, rarecodes.com uses paypal. The email address used
for the paypal account is support@rarecodes.com, but using this link to pay him gives us
this (Note the link is below but in small font. Feel free to copy and paste it to duplicate
the error):

https://www.paypal.com/cgi-bin/webscr?cmd=_xclick-subscriptions&business=support@rarecodes.com
&item_name=Basic%20Plan%20-%201%20Month&item_number=RC- 0049-BAC1MT&no_shipping=1&no_note=1&currency_code=USD&bn=PP-SubscriptionsBF&charset=
UTF-8&a1=0.00&p1=3&t1=D&a3=9.25&p3=1&t3=M&src=1&sra=1

This obviously raises the question on how rarecodes.com receives payment?
(icemodchip.com must have some way of paying them? Why haven't they fixed this?
With so many customers (25,000) this would seem an important issue to fix, and quickly.

Now, I told you guys to remember his name. One important piece of information was
released before which allowed us to make a connection between the two people. If you
remember, the X-PopBeforeSMTPSenders statement that we obtained from an email sent
had the name Evan@infinitymods.com. What a coincidence.

Ebay Fraud?
Another thing we noticed in the X-PopBeforeSMTPSenders that was in the header of the
email address was Ebay@infinitymods.com. This brought us to the conclusion that
infinitymods.com may be selling on eBay. A quick look at infinitymods.com gave us
some rather useful information. Since we are unable to lookup a UserID on Ebay using an
email address, we must use other useful information to match a description. In this case,
all we needed was the phone number (1-866-930-mods). Using this, we got this auction:


Need For Speed Most Wanted *Christmas Special PS2*
http://64.233.187.104/search?q=cache:PzfIqyV_WmQJ:cgi.ebay.com/Need-For-Speed-Most-Wanted-
Christmas-Special-PS2_W0QQitemZ8246000967QQcategoryZ62053QQcmdZViewItem+1-866-930-mods
&hl=en
(Text is made small to save space. Its still a working link but we were required to use
Google cache to obtain the original auction since eBay removed it.)



This auction started on the 12-24-05 and ended on 12-27-05. The good part about it was
that we were able to pick up his userID: infinitymods2k5 (Registered on December 19th
2005). A quick look at his feedback gave us this information:


http://feedback.ebay.com/ws/eBayISAPI.dll?ViewFeedback&userid=infinitymods2k5

Three negative feedback in less than 20 days. Also, one might question the integrity of
the buyer in this case (since some buyers often never pay for an item.) If you notice the
ending times for europazagreb (one of the ebay buyers) are about the same, so we doubt
that he was attempting to defraud infinitymods2k5.

We also found another eBay account under the name "backupscene" by using the email
from rarecodes.com. Although there are a few are some positive feedback left for him,
we would like to point out this high price item

http://cgi.ebay.ca/XBOX-360-ULTIMATE-PACKAGE_W0QQitemZ8238449950QQcategoryZ62054QQtcZ
photoQQrdZ1QQcmdZViewItem

This feedback was left on Dec 14th.



Most notably, this is a high priced item (942$ USD Aprox). In a previous .NET edition, I
talked about how eBay fraud is committed. Starting with small items being bought and
sold, the fraudulent eBay seller will eventually attempt to sell a big ticket item.
Defrauding people of 20 USD is not worth it, but 900+ USD may be worth the 2 months
of selling profitless items. Please note, backupscene is no longer a registered eBay
member. The registration date was Nov 24, 2005 and the last sale was around the 19th of
December.


The past of rarecodes.com
I want to point out some interesting facts about rarecodes.com past. Using one of my
favorite websites (archive.org) we are able to reconstruct every change made over the
past 3 years.

The original rarecodes.com site was simply a redirect to a hyperboards site and was used
for cheat codes (More like bugs) in Socom for PS2. This page appears on Oct 17, 2003
(Preview created with archive.org)


http://web.archive.org/web/20031017083434/http://www.rarecodes.com/

On Dec 27, 2003, the site made a drastic change to this (Preview not included).

http://web.archive.org/web/20031227022030/http://www.rarecodes.com/

In 2004, it changed to what appears to be a PHP based auction site, but to my knowledge,
this auction site was never fully functional. The original programming claims to be SkyD,
but I have been unable to confirm this (although I remember seeing a PHP classifieds
script that look very similar about 2 years ago).

http://web.archive.org/web/20040203201458/http://www.rarecodes.com/

Not long after the classified script disappeared, this popped up.

http://web.archive.org/web/20040609015146/http://www.rarecodes.net/

After this was posted for some time, he appeared to have changed webhosts to mixcat.net
and created a "modchip" website. Here he took "Pre-orders" but information leading to
customers is very vague.

http://web.archive.org/web/20040624063118/http://www.rarecodes.com/

We did however find this

"This guy is a scammer, he owes me $50 for modding someone's PS2, he screwed me out
of money and I demand it, I have waited over 2 months and the time has come to put a
stop to the scams. SkyD if you..."

http://64.233.187.104/search?q=cache:4zUBgs54JkIJ:www.backup-source.com/forums/
search.php%3Fdo%3Dfinduser%26u%3D2925+rarecodes.com+skyd&hl=en

A lot more information is out there on his previous history. Try looking for SkyD and
rarecodes.com in google (Combined). Remember this was in 2004, so use google cache if
it's old and outdated. What you will find is that SkyD got himself banned from a myriad
of forums. Most of the people I could find had posted something similar to the above
quote. Contacting these people became extremely challenging. Those who did return our
emails expressed the same views but did not want to be mentioned in this release due to
the fact they no longer cared about the situation. That pretty much covers the history of
rarecodes.com. I do wonder where rarecodes.com 48 servers and 4 years of service are?

Good templates don't make a website!!!
Next topic we cover is the use of templates. This section will be rather short. Both
rarecodes.com and icemodchip.com use templates that can easily be found on P2P. The
templates originate from boxedart.com and a simple membership allows you to download
both of them for a low price.

Icemodchip.com = http://www.boxedart.com/phpshop/info.php/mp_/16964
Rarecodes.com = http://www.boxedart.com/phpshop/info.php/mp_/16145

It is a strange coincidence that both templates come from the same site, but this isn't
enough evidence in itself. Everything is pretty much the same, even down to the
annoying techno music. I've seen a few claims from rarecodes.com on various message
boards (Under the name SkyD) telling people they have a team of people designing stuff,
but this doesn't plausible.

SkyD and icemodchip.com
Some of you may be doubt that SkyD has any involvement in icemodchip.com. I would
like to direct you back a few years. A project called "Project Lithium 2" (I want to know
where Project Lithium 1 went) was in "Development" by a person named SkyD.
According to sources (please remember this is 2004, so Google cache becomes your best
friend again. Also a few websites still have the info.)

"We received a brief status update on Project Lithium 2 from the coder SkyD over the
weekend listing June 15th, 2004 as the official BETA test date. It's important to NOTE
that the final (public) version of Project Lithium 2 (tentatively scheduled for a July 15th
release) will include a pressed factory-produced PS2 disc expected to cost $19.95 each."

http://64.233.187.104/search?q=cache:ij5tCbGQU4MJ:www.ps2ownz.com/modules.php%3Fname%
3DNews%26file%3Dshowarticle%26threadid%3D20428+%22Project+Lithium+2%22+cost&hl=en

The problem was that I was unable to find ANY information about it ever being released.
I did, however, find this on the same site as the above quote (This was released before the
19.95 price quote).

"Based off of NoID's original work and the past NIP files, Project Lithium 2 is currently
in the final development/packaging process and is coded by SkyD."

http://64.233.187.104/search?q=cache:VF_0dl46_0QJ:www.ps2ownz.com/modules.php%3Fname%
3DNews%26file%3Dshowarticle%26t%3D20026%26op%3Dnextnewest+%22Project+Lithium+2%22+
&hl=en
Notice it says "Based off NoID's original work." This makes us wonder if the project
was simply NoID's work on a CD with newer NIP files. No apparent production was ever
made and the project seemed to disappear after awhile.

Problems in Menu
Another thing we noted while doing research was the recently released Menu items are
completely wrong. The Xbox 360 does not have an internal hard drive, but rather a
removable SATA drive. Sources inside Xbox-Scene tell us that the Xbox 360 hard drive
does not employ locking techniques found in the original Xbox. Furthermore some
simple research on Google shows us multiple sources confirming that the Xbox 360 hard
drive is indeed NOT locked. So this brings up the question, why is this option in the
menu?



As we can see, the "Lock/Unlock Hard Drive" is fake since the hard drive is not locked
by the Xbox 360 console. Also notice the "Save Game" and "Load Game" menu items.
Someone please explain to me why these are in a bios menu??? Isn't the game
responsible for saving and loading game progress??

Furthermore, a quick look at the detail shows us this.



Look right above the B button. Notice the background around it. This is an obvious
Photoshop copy and paste. While the menu does look semi-authentic, it is entirely
possible that it may be a modified version of a previous dashboard skin or bios skin from
the original Xbox. We didn't want to spend time looking for the skin. When we contacted
icemodchip.com about these inaccuracies, they responded by removing the images from
their site and telling us that they were ONLY concept images and that the menu in the
modchip was different.

Inaccuracies in email claims
The following is email correspondence between me and Team I.C.E.

In response to a question asked about who had mod chips for testing, we got this reply.

Xbox-scene has one, foundmy.com has 1, and hack360.com has one. More samples to be sent
shortly.

We attempted to contact Xbox-Scene and Hack360. Xbox-Scene replied and confirmed
our suspicions that they had indeed not received a single thing. Currently, we have still
not heard back from Hack360 (But I personally believe this is true of all three of the
mentioned sites). After contacting him back asking why they denied having received the
modchip from him, he told us this:

People with samples have a close lid on this matter as there is a security issue at hand

I would like to note that there is no security matter. All I asked was whether this claim
was true. The response, Absolutely NOT. In fact, when posting the question on the
forum, I was greeted with a rude reply and the topic was locked and deleted (Supposedly
someone was creating multiple names and posting links to icemodchip.com along with
"false" information [Or that's at least what I'm told]). But not to worry, we sorted that all
out after I contacted them.

Also, threatening a journalist is probably not the best thing to do. This is probably one of
the major reasons I decided to follow up and spend four days worth of research into this
matter (Would have only been two, but an unfortunate power surge lost some research.)

In response to me telling him that I was unable to publish the info, he sent me this:

Verify as you wish, but we expect something produced now for the information provided and our
time spent.

I just want to note, just because you answered my emails doesn't mean I'm obligated to
publish something. However, since you expect something to be published, this is what
you're going to get.

Do the Math
In one correspondence, I requested wholesale prices. And here they are

70.00 per unit
100 pcs $5,500.00
250 pcs $13,700.00
500 pcs $25,000.00
1000 pcs $46,000.00
5000 pcs $245,000.00
10000 pcs $500,000.00

At first glance, everything looks normal, but let's do the math anyways.

5,500.00/100 = 55 USD per piece
13,700.00/250 = 54.8 USD per piece
25,000.00/500 = 50 USD per piece
46,000.00/1,000 = 46 USD per piece
245,000.00/5,000 = 49 USD per piece
500,000.00/10,000 = 50 USD per piece

I know it's hedging on nit picking, but this helps demonstrate the quality of this outfit.
Someone really needs to brush up on their math skills. By far, if I order 1,000 pieces I
save 3 dollars from ordering 5,000 pieces. Normally, in business, a straight percentage is
applied and often increases at a set interval. For example, 10% discount at 1,000 but 15%
discount at 10,000.

Problems with the hostname
The next problem deals with the fact that even though the companies claim to be
separate, an apparent link between them can be determined using the IP address
contained in email correspondence. For obvious reasons, we will not disclose the IP
address or hostname. We would simply like to point out that all emails coming from the
multiple domains, originate from the same hostname. This hostname contains
roadrunner.nf.net. Furthermore, an unnamed source from xbox-scene confirms that the
hostname is the same as SkyD, who apparently uses IRC a lot.

"Usually any of the console channels on EfNet...he goes by the nick
"Backups""

"I'm pretty sure he's in that area when I've seen him on IRC it's always
the same hostname"