Dark Web Informer :verified_paw:

I am currently only posting on X and Telegram as of 2026/02/13. Visit my socials below!

Website: https://darkwebinformer.com/

Website Pricing (Includes Crypto): https://darkwebinformer.com/pricing

Socials: https://darkwebinformer.com/socials

API Access: https://darkwebinformer.com/api-details

Donations: https://darkwebinformer.com/donations

Advertise (Only Legitimate Companies): https://darkwebinformer.com/advertising

About Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer

Updated: 2026-02-13

Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrvqhr5sdnf9rds8qq0l844cx64cjej76wqjcs06pw26sfpsxehqgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsvsvq4c

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

Show more details

Published at

2026-04-28T22:06:15+02:00

Kind type

0 Metadata

Event JSON

{ "id": "87b21421ea4c820c5ca7ee3d3043c671279397b2faf06bc7cc0dadd4b29c598e", "pubkey": "3602e3a41b34946d81c007fcf5ae0daae25997b4e04b107e82e56a090c0d9b81", "created_at": 1777406775, "kind": 0, "tags": [ [ "emoji", "verified_paw", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/162/404/original/e464c64f5a98dc53.png" ], [ "proxy", "https://infosec.exchange/users/DarkWebInformer", "activitypub" ], [ "client", "Mostr", "31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr", "wss://relay.ditto.pub" ] ], "content": "{\"name\":\"Dark Web Informer :verified_paw:\",\"about\":\"I am currently only posting on X and Telegram as of 2026/02/13. Visit my socials below!\\n\\nWebsite: https://darkwebinformer.com/\\n\\nWebsite Pricing (Includes Crypto): https://darkwebinformer.com/pricing\\n\\nSocials: https://darkwebinformer.com/socials\\n\\nAPI Access: https://darkwebinformer.com/api-details\\n\\nDonations: https://darkwebinformer.com/donations\\n\\nAdvertise (Only Legitimate Companies): https://darkwebinformer.com/advertising\\n\\nAbout Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer\\n\\nUpdated: 2026-02-13\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/112/253/795/748/183/030/original/8806fc8e13350e19.png\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/112/253/795/748/183/030/original/3b116fd806f5e6d6.png\",\"nip05\":\"[email protected]\",\"fields\":[[\"Dark Web Informer\",\"https://darkwebinformer.com\"],[\"X/Twitter\",\"https://www.x.com/DarkWebInformer\"],[\"Medium\",\"https://medium.com/@DarkWebInformer\"],[\"GitHub\",\"https://github.com/DarkWebInformer\"]]}", "sig": "e79cdeb4fc49d3edd6df6781bac10022589b36a88ab073022952774724f2c3e5b6842c5b1829c867eb06ff3c77ed2c8cc7c55e588608f788cb3a01cfb4a521e8" }

Last Notes

2026-02-11 17:41:24 CET

‼️🇰🇼 A data set allegedly from Zain Kuwait, a major telecommunications provider, has been posted for sale containing 3,849,601 subscriber records totaling 11.3GB in JSON format.
The breach is dated 2026 and includes subscriber numbers, owner names, and associate names. Sample data shows Arabic-language subscriber records with phone numbers, verification status, and spam flags.
The seller offers tiered pricing in Monero: 15 XMR for takedown, 10 XMR for exclusive purchase with deletion, 5 XMR for non-exclusive access, or 2 XMR for the scraping exploit itself.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/989/216/160/172/original/3af896c0c9ba0626.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/989/203/693/696/original/a9e25b850d4224c8.png

2026-02-10 21:02:46 CET

Story of my life. 😭
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/118/743/353/697/original/d5ccf5d851ceac23.webp

2026-02-10 00:51:28 CET

‼️🇬🇧 A data set allegedly from alphacapitalgroup.uk, a UK-based forex trading platform, has been posted for download.
The dump dates from May 2024 and contains 240,647 lines including payment IDs, transaction IDs, user IDs, emails, payment types, amounts in dollars, user profiles, countries, promo/coupon names, account login IDs, challenge names, and timestamps.
Sample data shows transactions from users across the UK, Australia, India, South Africa, Nigeria, Kuwait, and other countries with various "Alpha Pro" account tiers.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/043/353/464/905/227/original/600cfdd75fbf067c.png

2026-02-10 00:21:41 CET

Daily Dose of Dark Web Informer - February 9th, 2026
https://darkwebinformer.com/daily-dose-of-dark-web-informer-february-9th-2026/

2026-02-09 22:08:07 CET

❗️🇦🇷 WordPress admin access to an Argentinian e-commerce store is being auctioned by a threat actor.
The listing claims a payment card redirect via MercadoPago is in place, with 100 orders in January and 26 in February, and 90% unique orders.
The auction starts at $300 with a blitz price of $600.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/710/248/660/346/original/b022ae5f8e636eb6.png

2026-02-09 20:23:37 CET

❗️ The threat actor advertises custom malware development and related technical services, including bots, parsers, automation tools, reverse engineering, native executable crypters (excluding .NET), traffic-flooding capabilities, and credential stealers.
They explicitly state they are not interested in cryptocurrency-related projects, brute-force tooling, web development, or C2 infrastructure, and emphasize a preference for native, lightweight malware, including shellcode-based implementations.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/301/568/506/585/original/e308209fde2f75aa.png

2026-02-09 20:14:39 CET

❗️🇮🇱 Cyber Islamic resistance-Axis targeted the website of Maayan
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/266/277/886/011/original/5812d8e7964dc2a3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/266/280/483/537/original/e05e410688dd1de2.png

2026-02-09 20:03:13 CET

‼️ An Android antidetect and device-changing tool called "DeviceChanger/Antidetect+" is being advertised.
The software offers device model and parameter spoofing, hardware/software ID changes, Wi-Fi network blocking and creation, GPS spoofing, app ID changing, remote device management, OVPN/SOCKS clients, Play Integrity bypass, and video/photo stream substitution.
The tool is priced at $100/month.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/220/936/542/858/original/a3a1c1e5f786bd0c.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/220/950/054/843/original/f49975c866bcc77e.png

2026-02-09 18:40:50 CET

‼️🇪🇬 A threat actor is selling an alleged full database of EgyptAir containing 104,000+ records and sensitive documents.
The dump includes multiple CSV tables: 21 admin-included user records, 88,653 user accounts with emails, passwords, and national IDs, HR application records, 1,114 HR final results, and 9,607 personal data records from 2020 containing national IDs, birth dates, addresses, phone numbers, military status, marital status, and education details.
The leak also includes 42 PDF files, 3 images, and 1 video from staff emails.
Pricing starts at $300 in Monero.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/897/097/963/940/original/d4abb94aeda476e6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/897/099/844/155/original/ea2be45db5483f04.png

2026-02-09 18:32:35 CET

nmapUnleashed: A modern CLI wrapper for Nmap, designed to make network scanning more comfortable and effective.
GitHub: https://github.com/Sharkeonix/nmap-unleashed
Released: Jan 31, 2026
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/865/149/123/316/original/57a47d6930e62794.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/865/149/818/515/original/af4e3f6ddee4cd45.png

2026-02-09 18:07:30 CET

⚠️ The Weekly Whiskey - Valentine's Edition 02/09/2026
This is a 1:1 copy from Dread user /u/samwhiskey
https://darkwebinformer.com/the-weekly-whiskey-valentines-edition-02-09-2026/

2026-02-09 17:50:41 CET

‼️🇬🇧 UK Fast Food Chain Pepe's Piri Piri Allegedly Breached After Refusing Ransom, 2.1 Million Customer Records Leaked
https://darkwebinformer.com/uk-fast-food-chain-pepes-piri-piri-allegedly-breached-after-refusing-ransom-2-1-million-customer-records-leaked/

2026-02-09 17:34:59 CET

‼️🇫🇷 French Insurance Company Maxance Allegedly Breached, 348K Customer Records Leaked
https://darkwebinformer.com/french-insurance-company-maxance-allegedly-breached-348k-customer-records-leaked/

2026-02-09 17:18:33 CET

❗️🇺🇸 A threat actor is auctioning domain admin access to a U.S. construction management company with an estimated revenue of ~$20 million.
The listing specifies Fortinet VPN access with SentinelOne antivirus in place. The auction starts at $2,000 with a $500 step and a blitz price of $4,000.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/573/835/702/072/original/effd21b4aced28b5.png

2026-02-09 17:08:44 CET

❗️🇱🇺 A threat actor has posted a scrape of 6,555,206 Jamendo.com user records dated February 8, 2026.
Jamendo is a music sharing platform. The dataset is 366MB uncompressed CSV (88MB compressed) and contains user IDs, display names, emails, gender, biography, managed artist IDs, and admin status.
The actor notes that only around a couple million of the 6.5M records have emails set, and that display names are often autofilled from email addresses during registration.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/534/667/315/871/original/a83c62823da6a009.png

2026-02-09 16:19:35 CET

❗️🇨🇦 Access to a Canadian PrestaShop e-commerce store with native payment forms is being auctioned. The site has processed 51,339 total orders, with 3,737 credit card orders between June 2025 and January 2026.
The listing includes access to admin panels, webshell, and Adminer. The seller notes the store has high customer retention, with only 1 in 4.5 customers being new.
The auction starts at $600 with a blitz price of $2,500.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/341/890/996/715/original/93bcd937f5b213f9.png

2026-02-08 22:33:05 CET

- reply

On next update I will put an active/not active next to each channel that way you can see the historical review behind it and likely a filter to make it easier to see either/or.

2026-02-06 23:57:02 CET

‼️🇺🇸 Atlas Air has been claimed a victim to Everest Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/153/064/135/768/original/620e9fa122eebbf7.png

2026-02-06 23:50:29 CET

❗️Alleged leak of Jeffrey Epstein client password list
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/128/041/976/053/original/daaa1074c6455ae5.png

2026-02-06 01:20:50 CET

‼️ Dutch authorities just seized one Windscribe VPN server without a warrant, claiming they'll return it after they "fully analyze it."
They say their real concern "is the unredacted Epstein files we had on there..."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/020/821/121/627/915/original/08308233d455cf6d.png

2026-01-31 00:41:55 CET

The new Pro/Elite threat feed (Plus feed was fine) was showing unstyled CSS and wasn't loading data properly on mobile. It's fixed. The CSS was not made for mobile though, so when using the mobile version switch your browser to desktop site and everything will work fine.

2026-01-30 17:48:13 CET

‼️ An international law enforcement operation called "Operation Switch off" has concluded, targeting what authorities describe as a large-scale illegal IPTV streaming network.
Led by Italy's Catania Public Prosecutor's Office and coordinated through Eurojust, Europol, and Interpol, the investigation identified 31 individuals allegedly connected to a transnational criminal organization. The suspects face accusations including unauthorized broadcasting of access-controlled content, computer fraud, and money laundering.
According to investigators, the network captured and redistributed live broadcasts and on-demand content from major platforms including Sky, DAZN, Amazon Prime, Netflix, Paramount, and Disney+, allegedly serving millions of users worldwide.
More than 100 Italian Postal Police officers executed searches across 11 Italian cities and 14 international locations, with cooperation from authorities in the United Kingdom, Spain, Romania, Kosovo, Canada, India, South Korea, and the United Arab Emirates.
The year-long investigation built on intelligence from a previous operation called "Taken Down." Authorities allege the suspects used cryptocurrency investments, shell companies, and fictitious asset registrations to obscure proceeds that reportedly generated millions of euros monthly.
The operation disrupted approximately 1,000 Italian resellers and cut service to over 100,000 end users in Italy, with millions more affected globally. Three illegal IPTV platforms were seized in Italy, while investigators in Romania identified a significant distribution operation running six servers.
The original video is in 360p. Source: https://www.poliziadistato.it/articolo/166979f86bd0846335000880
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/985/068/226/878/280/original/aeee38b875f0d78a.mp4

2026-01-25 02:58:07 CET

Clawdbot: A personal AI assistant you run on your own devices.
GitHub: https://github.com/clawdbot/clawdbot
Clawdbot answers you on the channels you already use (WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage, Microsoft Teams, WebChat), plus extension channels like BlueBubbles, Matrix, Zalo, and Zalo Personal. It can speak and listen on macOS/iOS/Android, and can render a live Canvas you control.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/953/253/246/849/388/original/ae07fbb027b6c046.jpg

2026-01-23 22:20:57 CET

‼️Microsoft reportedly provided the FBI with a set of BitLocker encryption keys that allowed investigators to unlock laptops belonging to criminal suspects, according to reports.
https://techcrunch.com/2026/01/23/microsoft-gave-fbi-a-set-of-bitlocker-encryption-keys-to-unlock-suspects-laptops-reports
The case centered on multiple individuals suspected of committing fraud tied to the Pandemic Unemployment Assistance program in Guam, a U.S. territory in the Pacific.

2026-01-22 01:20:54 CET

- reply

Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/de15ce7b85f87e80375f

2026-01-22 01:19:32 CET

⚠️A vendor using the alias speedypharma (link) was arrested by law enforcement. Following the arrest, authorities likely accessed his Dark Matter Market account using his credentials.
There was discussion around how the “last login” timestamp works. In Dark Matter Market’s codebase, this timestamp reflects a fully successful login, which strongly suggests law enforcement access rather than routine activity. Dark Matter requires a PGP to be used to login to the account. So LE likely also has access to the vendor's PGP key. Something similar occurred with LEA using the Archetyp admin's PGP to sign messages on Dread.
Markets typically ban vendors quickly after a bust to reduce the window in which law enforcement can access accounts and collect additional data.
https://darkwebinformer.com/man-arrested-in-south-bakersfield-on-federal-drug-charges/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/935/875/795/316/531/original/910655b7c1619193.png

2026-01-21 20:07:10 CET

NMAP Commands
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/934/653/914/854/911/original/45418b77ac6c8998.jpg

2026-01-19 21:32:49 CET

Every cable has a purpose… except no one knows what it is.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/923/666/121/764/228/original/d3aa9e81df76b444.jpg

2026-01-16 00:32:44 CET

A Hacker Shares His Biggest Fears
A white hat hacker, a cybersecurity analyst with more than 30 years of experience at a major Silicon Valley firm, reflects on why he walked away from black hat hacking to use his skills for the greater good.
He explains the unsettling truth about how vulnerable modern systems really are, from the possibility of attackers crippling the American power grid or shutting down critical medical facilities to how effortlessly someone with nothing more than WiFi and spare time can access private information most people assume is secure.
Video Credit: youtube.com/@VICE
Video Date: August 11th, 2021
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/901/723/916/286/946/original/ec8943640825feb0.mp4

2026-01-13 17:54:07 CET

- reply

Orion Ransomware has been added to the Threat-Surface GitHub repo: https://github.com/DarkWebInformer/Threat-Surface

2026-01-13 17:52:48 CET

‼️Affiliate Access login, Client Portal login, and Server Status from the Orion Ransomware DLS:
http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion/access/partner-access
http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion/user/access
http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion/server-status
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/888/821/098/587/313/original/b2896ffab59c821e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/888/821/107/926/352/original/7100828da8f8ef13.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/888/821/122/901/173/original/250afd563b8880aa.png

2026-01-10 16:50:29 CET

‼️17.5 Million Instagram Accounts Exposed in Major API Data Leak
Meta is facing a significant security incident after cybersecurity firm Malwarebytes confirmed a breach impacting 17.5 million Instagram users.
The leaked dataset, which includes usernames, email addresses, phone numbers, and partial physical addresses, is now being actively circulated on dark web forums.
In the aftermath, millions of Instagram users have reported receiving unexpected password reset emails from the platform’s legitimate domain: security@mail[.]instagram[.]com.
Although the emails are authentic, they were not requested by recipients, fueling widespread confusion over whether Instagram is experiencing a glitch or if users are being targeted in phishing attempts.
Security researchers now believe these unsolicited reset emails are directly linked to the breach, suggesting threat actors may be using the exposed data to initiate account recovery flows or to obscure targeted phishing activity.
The dataset is believed to have been obtained by a hacker known as “Solonik”, with the underlying issue reportedly tied to an API-related exposure dating back to 2024 (see screenshot 2).
As of now, Meta has not issued an official statement regarding the incident.
Sources: https://cybersecuritynews.com/instagram-data-leak-exposes-sensitive-info-of-17-5m-accounts/
https://cyberinsider.com/malwarebytes-warns-of-instagram-data-breach-impacting-17-5-million-users/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/871/593/655/931/961/original/1b91be7c78d052e2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/871/593/663/194/671/original/42462a623c6c05d5.png

2026-01-10 00:16:10 CET

Why Oversharing is the Real OPSEC Failure - OPSEC for High Threat Models
https://darkwebinformer.com/why-oversharing-is-the-real-opsec-failure-opsec-for-high-threat-models/
This is a 1:1 copy from Dread user /u/jake0126. The original post can be found on Dread at: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/a9dd03e88e92dfc0715c. The screenshots from the post are at the bottom of this page.

2026-01-05 19:03:27 CET

Microsoft Office is no more... it is now called "Microsoft 365 Copilot app" 🤣
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/843/806/300/520/461/original/a3c7f463e390c424.png

2026-01-04 21:00:33 CET

🚨 L4663R666H05T & Simsimi defaced the website of Faith Victory Association
Umbra Forums: https://x.com/DarkWebInformer/status/2007495858997399775
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/838/603/203/084/936/original/1666f5c3b934c4e1.png

2026-01-03 01:05:42 CET

A hacker going by the name Martha Root... takes down a white supremacist dating website and leaks all of the data. Good f*cking shit @BackTwoTheRoot!
okstupid[.]lol
https://x.com/DarkWebInformer/status/2007241716831793170

2025-12-31 20:46:42 CET

- reply

ENSAI was also claimed on 9/15/2025 (TA: ghidra) and 12/23/2024 (TA: st0jke)

2025-12-31 20:40:28 CET

🚨🇫🇷 French engineering school ENSAI (École nationale de la statistique et de l'analyse de l'information) allegedly fully compromised. Complete source code and extensive student databases breached including 3,900 student records.
▪️ All student information (3,900 students)
▪️ All student photos with names
▪️ Personal and professional email addresses
▪️ Personal mobile phone numbers
▪️ First and last names of ENSAI professors
▪️ Payment receipts (partial credit card numbers, CVV, expiration dates)
▪️ Applications (DUSTID, LMJET, LMJR, MDATACU, SDDP, SMARTDATA)
▪️ Evaluation forms
▪️ SQL files
▪️ Students' residential addresses
▪️ All ENSAI student accounts
▪️ Complete ENSAI source code (60,000 files + 21GB)
This is a comprehensive institutional breach affecting thousands of students and faculty members.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/815/874/069/291/463/original/1c5b8bb3f55862e4.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/815/874/074/684/016/original/7367b8e6d7e0bb60.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/815/874/132/417/473/original/13b47c375884f589.png

2025-12-30 02:35:26 CET

- reply

Yes, you can find it in the response header, but you will find something else on this site. 😉

2025-12-30 02:30:29 CET

- reply

🚨 The site is running on Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad[.]onion/cgi-bin/printenv
http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad[.]onion/cgi-bin/test-cgi
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/928/034/220/292/original/89fd4bde8de94d53.png

2025-12-30 00:20:11 CET

🚨 New Ransomware Group Identified: The Sicari Knife
Dark Web 1: http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad[.]onion
Dark Web 2: http://sicariktdbhjtrk6f2pwdh6wlequw7pcjva25skkzz4m3zz3opyox3qd[.]onion
Dark Web 3: http://sicari7zpu3mtxqggde7mu3ywppntdqg22arcukvlaihjbfcb2rnktid[.]onion
Dark Web 4: http://sicarilxx2br6esqnhad4w26bcgb5j2snbbnhyo4b6t7kby2oy4x3jad[.]onion
Dark Web 5: http://sicari7m63wlggfxajiuonfsk72fgencne5ztzakyuhfxzq5rnbkjead[.]onion
Dark Web 6: http://sicariifoucvhyqg54smi3esg5sfcyw5z65t6yigqu4loyuoz62bb2id[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/664/257/506/original/b8903c3fc176c2cc.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/694/678/860/original/559369fb3b8d764f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/699/714/092/original/c9e74199fe704588.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/699/645/909/original/d05e06f719a01687.png

2025-12-29 20:53:58 CET

💡Darknet Markets Timeline is now available for everyone. https://darkwebinformer.com/darknet-markets-timeline/. There is some inconsistencies & bugs! Some details/sources are still missing, but will be gradually added when I have time. It can also be found on the Resources menu at the header of the website.

2025-12-29 18:49:59 CET

🚨 Unauthorized backdoor access to Intelligence X threat intelligence platform listed for sale
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/804/116/216/218/036/original/875f55bfdc3d9dcb.png

2025-12-27 00:35:00 CET

⚠️pgpfreak's is an OpenPGP key server (HKP) focused on privacy. It's a free service that you can use to share PGP keys and certificates with other anonymous users
Onion: http://pgpfreake3valkfdt2id4x6smq6uial4xa4wy2woyzuvf35n4f2eruid[.]onion
Dread Announcement: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/6c0bd1a0362750dd1808
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/788/484/898/048/000/original/73af821a343930ad.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/788/484/919/490/399/original/7c49c6926c8e8427.png

2025-12-26 20:12:21 CET

KeePassXC: A modern, secure, and open-source password manager that stores and manages your most sensitive information.
GitHub: https://github.com/keepassxreboot/keepassxc
Highly recommended!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/787/453/270/887/269/original/b6939621fbfe7a67.png

2025-12-25 03:44:29 CET

🚨 AWS is currently having an outage. Many services are being affected by it; Arc Raiders, Fortnite, Steam, Rocket League, Epic Games, Embark Studios, PlayStation Network, etc.
Happy Holidays!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/777/907/467/223/379/original/af36162f3365bd14.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/777/907/467/868/773/original/ea9f9552b5c83313.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/777/907/469/535/648/original/ea6dc8e1e77e6832.png

2025-12-23 23:57:35 CET

- reply

Thread (Pitch): https://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd[.]onion/p/59be59fa

2025-12-23 23:46:10 CET

Paris provided the following update on Pitch in regards to the Dread outage
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/771/306/787/569/707/original/9d29fde8cfa16adc.png

2025-12-22 22:51:35 CET

- reply

Added to Threat-Surface: https://github.com/DarkWebInformer/Threat-Surface

2025-12-22 22:49:05 CET

🚨 Fraud Shop: RONDA
Clearnet: rondastore[.]org
Dark Web: r4hyxmieadsyhnqzccmib45qtwa3x74gpnp24ovicuiuc5jzj3jxj2ad[.]onion
IP: 5[.]188[.]86[.]67
ASN: 49453
Org: Global Layer B.V.
Ports: 80, 443, 2947
Server: nginx/1.18.0 (Ubuntu)
Port 2947: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
Invalid SSH identification string.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/765/420/553/962/794/original/6efbe447ca7ff129.png

2025-12-21 18:26:03 CET

🚨 Shinyhunte[.]rs domain is now up for sale for 20 XMR or $9,392.14 at time of this post
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/758/723/513/927/720/original/d87309a0439e83eb.png

2025-12-20 23:34:24 CET

- reply

Or here: https://shinyhunte[.]rs

2025-12-20 23:00:24 CET

"THE TRUTH ABOUT Scattered LAPSUS$ Hunters"
If you are interested, you can see more, including the images, here: https://t.me/BreachForumsNews/83
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/754/138/769/362/354/original/4d197e7595589e44.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/754/138/772/646/983/original/1f89b05875708fbd.png

2025-12-18 20:29:55 CET

- reply

Added to Threat-Surface repo: https://github.com/DarkWebInformer/Threat-Surface

2025-12-18 20:13:17 CET

Forum: rootsploit[.]org
IP: 89.35.130.51
ASN: 214309
Server: nginx
Ports: 21, 22, 80, 110, 143, 443, 993, 995, 1500, 1501, 5414, 27356
IMAP/POP3 SSL Cert: rootsploitpshack.aurorix.net
ispmanager: https://89.35.130.51:1500/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/742/142/476/589/321/original/4b6488497bba54c6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/742/156/841/369/045/original/97c1e51a444a57e9.png

2025-12-18 18:13:43 CET

Apologies for the inconvenience... the issue is resolved. If you are sitting on one of the threat feed pages do a refresh and alerts should start again. 🙃

2025-12-18 17:18:42 CET

There is an issue with the threat feed updating, I'm looking into it. This doesn't affect any of the other feeds.

2025-12-13 21:12:45 CET

🚨 Ledger, Binance, Coinbase, Gemini, and Kraken User Leads For Sale on a Hacker Forum
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/714/080/561/114/404/original/c437af0b39931b76.png

2025-12-08 20:48:47 CET

Silent.Link: Buy global mobile 4G/5G Internet access and burner phone numbers instantly and privately on any modern eSIM-compatible smartphone.
KYC: Terms explicitly state KYC will never be requested.
X: @silentlink1
Payment: Monero (XMR), Bitcoin (BTC), Lightning
Clearnet: https://silent.link
Dark Web: http://silentlnit5ryavvfz5vw7s4qg62jujd666lnc4tg2chj64zuwuqtvqd[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/685/675/019/159/095/original/c7fa78f70605971f.png

2025-12-07 23:39:20 CET

- reply

If you only have a plus subscription, you will still see Ransomware stats and recent events from Ransomware groups.

2025-12-07 23:27:06 CET

I have moved the Threat Intelligence Analytics to the subscribers area for all paid subscribers.
https://darkwebinformer.com/threat-intelligence-analytics/
Some of the charts are interactive by clicking on the bars. All of them allow you to hover over the different parts of the charts to see the numbers. More charts and features will be added after the new year.

2025-12-03 23:19:50 CET

🚨🇬🇧 NCFE is investigating a cybersecurity incident after detecting suspicious activity on its systems late last week. The company says it wants customers and stakeholders to be informed as early as possible.
Source: https://www.ncfe.org.uk/servicecontinuity/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/957/246/426/936/original/f73163aa659e800c.png

2025-12-03 17:35:19 CET

https://x.com/DarkWebInformer/status/1996256681630547976

2025-12-01 19:13:53 CET

🚨🇺🇸 A threat actor is allegedly selling CABoom Leads
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/645/665/073/530/483/original/531590d8d75f7f2f.png

2025-11-27 17:51:05 CET

🦃 Stay informed. Holidays don’t stop threat actors.

2025-11-27 17:26:44 CET

🚨🇰🇷 A threat actor claims to have leaked source code to Intellivix
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/622/595/171/277/628/original/060c0a6f6b604206.png

2025-11-26 18:27:37 CET

Another update... if you are an API subscriber you now have access to an endpoint that provides the news feed in real time. The update can be found at the top of the docs page. The full IOC history is being worked on & may come out in the first week of December rather than Nov.

2025-11-25 02:12:51 CET

🚨🇺🇸 Infrastructure Destruction Squad claims to be targeting the US
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/607/674/771/910/138/original/78fcd6e8e294347a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/607/674/775/692/624/original/15f158ed5e943396.png

2025-11-25 00:09:16 CET

Ransomware Attack Update for the 24th of November 2025
https://darkwebinformer.com/ransomware-attack-update-for-the-24th-of-november-2025/

2025-11-24 20:59:48 CET

Never seems to get old.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/606/446/913/788/003/original/d4718e41d84e176e.jpeg

2025-11-24 20:36:16 CET

I had a couple people ask me privately if I would be doing any holiday sales, and the answer is no. Also have been asked if there are watermarks or blurred images on any of the feeds, no to that as well. All images on feeds and within the paywall blog posts contain no watermarks or blurred images (all unredacted).

2025-11-24 00:49:11 CET

I pushed some updates to the Whiteintel Corp Alerts feed for those with access to the early access program. Search, sorting, some stats at the top, and some loading behavior. Should be available to all paid subscribers by no later than Wednesday.

2025-11-23 19:04:47 CET

My @nprofile…znqz was suspended and I can't even login to appeal. No email either. GGs. All of my code/repos is locally backed up.
https://github.com/darkwebInformer/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/600/330/705/373/646/original/c8f53c9f17665874.png

2025-11-22 22:38:26 CET

CISA Kev Catalog Feed and News Feed were updated with some mobile fixes so you can view them on your phone now. Whiteintel Corporate alerts/feed (early access) now shows every page and not just the first 3 pages. It also has a search bar now.

2025-11-19 21:38:54 CET

- reply

This timeline will be available to everyone once it is ready.

2025-11-19 21:37:19 CET

The Darknet Markets Timeline that is currently in early access has been updated. 2010-2023 are about 90% accurate now, the only thing missing is source articles which will take time because no one really covers Darknet Markets. 2024-2025 are still to be added. https://darkwebinformer.com/darknet-markets-timeline/

2025-11-18 16:58:26 CET

🚨🇺🇸 Alleged Spirit Halloween Data Leak with 3,600 Employees Exposed
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/571/523/072/322/920/original/1b6d6a16f254d6b4.png

2025-11-16 21:33:01 CET

🚨Claimed Bulk Auction of 800 Fullz With 70% Validity Rate
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/561/277/344/575/101/original/bdfb22d80effbf3a.png

2025-11-16 18:25:53 CET

🚨CrazyRDP raid footage has been released showing law enforcement loading many servers into different trucks
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/560/542/586/258/583/original/dd41e7aed530defb.mp4

2025-11-13 00:16:03 CET

Ransomware Attack Update for the 12th of November 2025
https://darkwebinformer.com/ransomware-attack-update-for-the-12th-of-november-2025/

2025-11-12 18:35:25 CET

It's 1995 & you startup a 486DX
Video Credit: youtube.com/@PCUSER486
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/537/931/167/438/750/original/7705ac80814922d1.mp4

2025-11-11 18:32:04 CET

🚨RansomHouse Ransomware claims 3 victims
🇫🇮 Octomeca Oy
🇵🇭 Public Safety Mutual Benefit Fund
🇲🇹 Polidano Group
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/532/254/974/395/434/original/7c4b78adde7ed68c.png

2025-11-01 22:57:44 CET

- reply

These will be added under Resources -> Services on the navigation bar.

2025-11-01 22:35:48 CET

eigenwallet aka UnstoppableSwap Service: Bitcoin → Monero atomic swaps, securely and in a decentralized manner using a state-of-the-art cryptographic protocol and open-source desktop software. Formerly UnstoppableSwap.
https://darkwebinformer.com/eigenwallet-aka-unstoppableswap-service/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/476/589/110/770/915/original/8029d515bdea9d20.png

2025-11-01 01:04:18 CET

Check Point has a Halloween inspired Threat Map going on. Pretty neat.
https://darkwebinformer.com/check-point-live-cyber-threat-map/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/471/512/831/652/529/original/e922a842fceda39b.png

2025-10-30 18:16:20 CET

- reply

First seen is showing by newest instead of latest. Refresh.

2025-10-30 17:55:59 CET

The IOC Feed is now available for Elite Subscribers of the Early Access Program. The feed will be available to everyone next week.
https://darkwebinformer.com/ioc-alerts-feed/

2025-10-30 00:38:40 CET

Lol, wtf... currently the Aisuru botnet C2 domain is ranked #1 in the world of top domains.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/460/086/112/991/287/original/1665c488c611de54.png

2025-10-29 22:41:08 CET

- reply

Also will eventually add some things like Domain info, shortcut links to check on sites like http://crt.sh/, fofa, virustotal, urlscan, etc.

2025-10-29 22:27:01 CET

Worked on the IOC Feed a little more today. Still on track to be available next week. Likely available to Elite subscribers tomorrow or Friday. Will be available to everyone when released. Mostly ui issues remain.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/459/568/882/721/399/original/f3d32ff23c229ca3.png

2025-10-29 18:01:06 CET

🚨 Microsoft is currently investigating a world wide outage related to DNS.
https://x.com/MSFT365Status/status/1983571232122671591
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/458/524/079/108/032/original/adb64ebfc128c166.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/458/524/084/228/558/original/9068f70580e3498c.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/458/524/086/569/217/original/f166992551f12859.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/458/524/092/309/839/original/3f0fe682720feab6.png

2025-10-21 22:08:55 CEST

⚠️Chat, the feds don't tell anyone when someone gets arrested until you see the press release or documents. You could say someone could be arrested if they go silent for a while, but even then you really don't know. 🥷

2025-10-21 01:05:18 CEST

- reply

“Sic transit gloria mundi” is Latin for “Thus passes the glory of the world” meaning fame, status, or influence fades.

2025-10-21 00:55:44 CEST

What is going on 🤣 shinyhunte[.]rs
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/408/957/800/090/323/original/83b7469d3dd2ce7a.png

2025-10-19 20:33:18 CEST

🚨🇺🇸 Alleged sale of 1,700,000,000 Facebook scrapped data including ID, gender, DOB, place, relationship, and friends count
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/402/262/327/858/155/original/92773f35a2a90cca.png

2025-10-19 05:12:36 CEST

Hackers are exploiting a 0-day vulnerability in Windows Remote Access Connection Manager in ongoing attacks.
CVE: CVE-2025-59230
https://gbhackers.com/hackers-exploit-windows-remote-access-connection-manager-0-day/

2025-10-19 01:22:13 CEST

It’s more peaceful when everything is private. #privacy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/397/736/178/164/756/original/792696d1930072c1.jpg

2025-10-18 23:26:34 CEST

- reply

Stay Connected with Dark Web Informer
Get full access to exclusive intelligence, unredacted screenshots, claim URLs, early alerts and more at darkwebinformer.com
Join Telegram: t.me/SliceForLife🔪
Follow the X Bot for More Intel: x.com/DarkWebIntelBot

2025-10-18 23:26:25 CEST

🚨🇵🇪 MC INVERSIONES INMOBILIARIAS Construction Company has Fallen Victim to RADAR Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/397/280/363/831/013/original/37e171a70a909457.png

2025-10-18 22:36:23 CEST

🚨TK HOLDINGS GROUP has been Claimed a Victim to RADAR Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/397/084/915/536/103/original/b444a75f4840b0eb.png