π¨π¨πΎ File upload vulnerability affecting a Cyprus government website allegedly offered for sale
β
A forum actor claims to be selling a file upload vulnerability affecting an unidentified gov[.]cy website in Cyprus. The seller says they also possess credentials to a test account on the affected site.
β
The advertised access allegedly allows:
β
β’ Uploading multiple file types to the government-hosted environment
β’ Creating downloadable links hosted on the government website
β’ Uploading executable, document and archive formats
β’ Using the trusted government domain to distribute uploaded files
β’ Access through an existing test account
β
The seller claims additional proof, including Burp Suite screenshots, will be provided privately to interested buyers.
β
The vulnerability is being offered for between $300 and $750, with the price described as negotiable. The seller says ETH and XMR are accepted.
β
The affected government service was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling a file upload vulnerability affecting an unidentified gov[.]cy website in Cyprus. The seller says they also possess credentials to a test account on the affected site.
β
The advertised access allegedly allows:
β
β’ Uploading multiple file types to the government-hosted environment
β’ Creating downloadable links hosted on the government website
β’ Uploading executable, document and archive formats
β’ Using the trusted government domain to distribute uploaded files
β’ Access through an existing test account
β
The seller claims additional proof, including Burp Suite screenshots, will be provided privately to interested buyers.
β
The vulnerability is being offered for between $300 and $750, with the price described as negotiable. The seller says ETH and XMR are accepted.
β
The affected government service was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
πͺ Slice For Life - Part 2 πͺ
π¨ ShinyHunters claims an unnamed company as a victim. The listing claims over 11.5 million records across Salesforce, ServiceNow, and Entra containing some customer and employee PII, along with 3.1 TB+ of internal corporate data.
βΌοΈ ShinyHunters has removed this unnamed company from their pay or leak portal. Looks like negotiations are ongoing.
Small update, since I haven't given one in a while. A couple of large legal entities have requested the following, but I haven't committed to them yet.
- Do**ing resources/alert feed (I have always said no in the past to this, but this industry is always changing and I have to keep an open mind while also staying legal)
- A feed that provides updates on shops... if the shop updates, scrape it for an alert.
- More c*rding forums to be tracked
I am also still working on the following:
- 8 forums being added to the threat feed
- Threat Surface Resources list is being completely updated
- Historical threat feed is ongoing
- PoC Explorer is ongoing
- OpSec Failures page is soon
- CVE Trend explorer is ongoing
- Do**ing resources/alert feed (I have always said no in the past to this, but this industry is always changing and I have to keep an open mind while also staying legal)
- A feed that provides updates on shops... if the shop updates, scrape it for an alert.
- More c*rding forums to be tracked
I am also still working on the following:
- 8 forums being added to the threat feed
- Threat Surface Resources list is being completely updated
- Historical threat feed is ongoing
- PoC Explorer is ongoing
- OpSec Failures page is soon
- CVE Trend explorer is ongoing
β€7
π¨ Unidentified PC builder and parts comparison platform with 1.4M users allegedly breached
A forum actor claims to have compromised an unnamed PC building and component comparison service that remains online and active, obtaining extensive access across its production infrastructure, databases, APIs and cloud environments.
The advertised access allegedly includes:
β’ Production MongoDB containing approximately 1.4 million user accounts
β’ Roughly 3 million saved PC builds and 1.3 million render jobs
β’ 148 MongoDB collections with millions of records
β’ Redis access containing approximately 1.6 million keys
β’ Google BigQuery analytics and administrative activity data
β’ A Firebase dataset reportedly containing around 9 million event records
β’ Google Cloud Storage backups, including MongoDB dumps
β’ Approximately 700GB across DigitalOcean Spaces with around 650,000 files
β’ User photos, component images, 3D models and other stored assets
β’ Production REST and tRPC API access
β’ Multiple GCP service accounts and administrative JWT capabilities
β’ DigitalOcean infrastructure and container registry access
β’ SSH access to three MacStadium Mac minis used for rendering
β’ Source code repositories and internal documentation
β’ GitHub organization write access
β’ Discord bot access to a server with roughly 11,000 members
β’ Apple signing and APNs credentials
β’ SendGrid, Gemini, Hugging Face and other third-party API credentials
β’ Affiliate and advertising network credentials
β’ Grafana, Loki and SSH credentials
β’ Related Firebase applications and additional cloud environments
The actor also claims to have already extracted:
β’ 631 completed PC builds
β’ 592 complete user profiles
β’ 6,399 legacy bcrypt password hashes
β’ Approximately 10 staff accounts
The seller states that the compromised infrastructure and copied data are already backed up externally and claims the service remains operational.
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to have compromised an unnamed PC building and component comparison service that remains online and active, obtaining extensive access across its production infrastructure, databases, APIs and cloud environments.
The advertised access allegedly includes:
β’ Production MongoDB containing approximately 1.4 million user accounts
β’ Roughly 3 million saved PC builds and 1.3 million render jobs
β’ 148 MongoDB collections with millions of records
β’ Redis access containing approximately 1.6 million keys
β’ Google BigQuery analytics and administrative activity data
β’ A Firebase dataset reportedly containing around 9 million event records
β’ Google Cloud Storage backups, including MongoDB dumps
β’ Approximately 700GB across DigitalOcean Spaces with around 650,000 files
β’ User photos, component images, 3D models and other stored assets
β’ Production REST and tRPC API access
β’ Multiple GCP service accounts and administrative JWT capabilities
β’ DigitalOcean infrastructure and container registry access
β’ SSH access to three MacStadium Mac minis used for rendering
β’ Source code repositories and internal documentation
β’ GitHub organization write access
β’ Discord bot access to a server with roughly 11,000 members
β’ Apple signing and APNs credentials
β’ SendGrid, Gemini, Hugging Face and other third-party API credentials
β’ Affiliate and advertising network credentials
β’ Grafana, Loki and SSH credentials
β’ Related Firebase applications and additional cloud environments
The actor also claims to have already extracted:
β’ 631 completed PC builds
β’ 592 complete user profiles
β’ 6,399 legacy bcrypt password hashes
β’ Approximately 10 staff accounts
The seller states that the compromised infrastructure and copied data are already backed up externally and claims the service remains operational.
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€3
π¨π§πͺ SQL injection vulnerability affecting Wallonie-Bruxelles Enseignement allegedly offered for sale
β
A forum actor claims to be selling an SQL injection vulnerability affecting Wallonie-Bruxelles Enseignement (WBE), the public education authority serving French-speaking Belgium.
β
The seller claims the vulnerable system supports several SQL injection techniques, including:
β
β’ Boolean-based blind SQL injection
β’ Error-based SQL injection
β’ Inline query injection
β’ Time-based blind SQL injection
β
The actor describes WBE as managing more than 500 schools and approximately 210,000 students.
β
The vulnerability is being offered for $150.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling an SQL injection vulnerability affecting Wallonie-Bruxelles Enseignement (WBE), the public education authority serving French-speaking Belgium.
β
The seller claims the vulnerable system supports several SQL injection techniques, including:
β
β’ Boolean-based blind SQL injection
β’ Error-based SQL injection
β’ Inline query injection
β’ Time-based blind SQL injection
β
The actor describes WBE as managing more than 500 schools and approximately 210,000 students.
β
The vulnerability is being offered for $150.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€1
π¨ FPFX Tech breach allegedly exposes trader data from 130 proprietary trading firms
β
A forum actor claims to be selling data obtained from FPFX Tech, a software provider that supplies infrastructure and technology to online proprietary trading firms.
β
The actor claims the breach affects approximately 130 prop firms using FPFX Tech and contains 392,000 unique trader records.
β
The exposed data allegedly includes:
β
β’ Full names
β’ Email addresses
β’ Trader account information
β’ Account creation dates
β’ Other personally identifiable information
β’ Records linked to approximately 130 proprietary trading firms
β
The seller published a list of allegedly affected firms along with a 1,000-record sample and is accepting offers for the full dataset.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling data obtained from FPFX Tech, a software provider that supplies infrastructure and technology to online proprietary trading firms.
β
The actor claims the breach affects approximately 130 prop firms using FPFX Tech and contains 392,000 unique trader records.
β
The exposed data allegedly includes:
β
β’ Full names
β’ Email addresses
β’ Trader account information
β’ Account creation dates
β’ Other personally identifiable information
β’ Records linked to approximately 130 proprietary trading firms
β
The seller published a list of allegedly affected firms along with a 1,000-record sample and is accepting offers for the full dataset.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π³π¬ Database containing 200,000 Nigerian user records allegedly offered for sale
β
A forum actor claims to be selling a dataset containing approximately 200,000 unique Nigerian user records, which the seller associates with crp.com. A sample spreadsheet was published alongside the listing.
β
The exposed data allegedly includes:
β
β’ Full names
β’ Phone numbers
β’ Dates of birth and ages
β’ Bank Verification Numbers (BVNs)
β’ Bank account numbers and account types
β’ Bank and branch information
β’ Employee and payroll identifiers
β’ Employment status and department information
β’ Job titles, grades and employment dates
β’ Salary structures and basic salaries
β’ Monthly allowances and deductions
β’ Pension and retirement information
β’ Payment status and payroll records
β’ Employee photographs and biometric-related fields
β’ Government ministry and establishment information
β
The sample appears to contain detailed employee and payroll records, including banking, salary and employment information.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling a dataset containing approximately 200,000 unique Nigerian user records, which the seller associates with crp.com. A sample spreadsheet was published alongside the listing.
β
The exposed data allegedly includes:
β
β’ Full names
β’ Phone numbers
β’ Dates of birth and ages
β’ Bank Verification Numbers (BVNs)
β’ Bank account numbers and account types
β’ Bank and branch information
β’ Employee and payroll identifiers
β’ Employment status and department information
β’ Job titles, grades and employment dates
β’ Salary structures and basic salaries
β’ Monthly allowances and deductions
β’ Pension and retirement information
β’ Payment status and payroll records
β’ Employee photographs and biometric-related fields
β’ Government ministry and establishment information
β
The sample appears to contain detailed employee and payroll records, including banking, salary and employment information.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈ New Dark Web Informer Blog Post!
Title: ArtNexus Database Allegedly Left Public, Exposing 3,314 Collectors and Galleries With Addresses and Payment Tokens
Link: https://darkwebinformer.com/artnexus-database-allegedly-left-public-exposing-3-314-collectors-and-galleries-with-addresses-and-payment-tokens/?v=2
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: ArtNexus Database Allegedly Left Public, Exposing 3,314 Collectors and Galleries With Addresses and Payment Tokens
Link: https://darkwebinformer.com/artnexus-database-allegedly-left-public-exposing-3-314-collectors-and-galleries-with-addresses-and-payment-tokens/?v=2
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
ArtNexus Database Allegedly Left Public, Exposing 3,314 Collectors and Galleries With Addresses and Payment Tokens
An actor posting as exfilar claims that ArtNexus, a Colombian fine art magazine and marketplace connecting galleries, collectors, and curators across 37 countries, left its backend database publicly readable with no authentication.
π¨π«π· Bemeye user database containing 728,000 records allegedly leaked
β
A forum actor claims to have leaked a database belonging to Bemeye, described in the listing as a rewards application. The dataset is advertised as containing approximately 728,000 records.
β
The exposed data allegedly includes:
β
β’ Email addresses
β’ First and last names
β’ Countries and currencies
β’ Dates of birth and gender
β’ Residential addresses, cities and postal codes
β’ Education and occupation information
β’ Account status and registration information
β’ IBAN-related banking information
β’ Device models and operating system details
β’ Application versions and locale information
β’ User activity, task and mission statistics
β’ Earnings and account-related metadata
β
A sample containing detailed user profiles was published alongside the post.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have leaked a database belonging to Bemeye, described in the listing as a rewards application. The dataset is advertised as containing approximately 728,000 records.
β
The exposed data allegedly includes:
β
β’ Email addresses
β’ First and last names
β’ Countries and currencies
β’ Dates of birth and gender
β’ Residential addresses, cities and postal codes
β’ Education and occupation information
β’ Account status and registration information
β’ IBAN-related banking information
β’ Device models and operating system details
β’ Application versions and locale information
β’ User activity, task and mission statistics
β’ Earnings and account-related metadata
β
A sample containing detailed user profiles was published alongside the post.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Media is too big
VIEW IN TELEGRAM
Elliot Hacks A Pedophile | Mr. Robot
From Mr Robot Season 1 Episode 1 "eps1.0_hellofriend.mov"
Video Credit: youtube.com/@MrRobot
From Mr Robot Season 1 Episode 1 "eps1.0_hellofriend.mov"
Video Credit: youtube.com/@MrRobot
β€3π₯2
βΌοΈ New Dark Web Informer Blog Post!
Title: Argentina's National Identity Registry Allegedly Leaked, 48 Million Citizen Records With Home Addresses Offered
Link: https://darkwebinformer.com/argentinas-national-identity-registry-allegedly-leaked-48-million-citizen-records-with-home-addresses-offered/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Argentina's National Identity Registry Allegedly Leaked, 48 Million Citizen Records With Home Addresses Offered
Link: https://darkwebinformer.com/argentinas-national-identity-registry-allegedly-leaked-48-million-citizen-records-with-home-addresses-offered/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Argentina's National Identity Registry Allegedly Leaked, 48 Million Citizen Records With Home Addresses Offered
An actor posting as GordonFreeman claims to hold the complete database of RENAPER, Argentina's Registro Nacional de las Personas, the national authority responsible for citizen identity and the issuance of the DNI.
IP Information for 5.206.227.203
ASN: 47674
ISP / Org: NETSOLUTIONS - Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA, MO
Country: NL
Network Range: 5.206.224.0/22
ASN: 47674
ISP / Org: NETSOLUTIONS - Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA, MO
Country: NL
Network Range: 5.206.224.0/22
WHOIS for carders.biz
Domain: carders.biz
Registered On: 2021-05-02 00:30:02 UTC
Expires On: 2027-05-02 00:30:02 UTC
Updated On: 2026-02-06 14:21:18 UTC
Status:
clientTransferProhibited
Name Servers:
karina.ns.cloudflare.com
clyde.ns.cloudflare.com
Registrar: Eranet International Limited
IANA ID: 1868
URL: Not Available
Abuse Email: Not Available
Abuse Phone: Not Available
Domain: carders.biz
Registered On: 2021-05-02 00:30:02 UTC
Expires On: 2027-05-02 00:30:02 UTC
Updated On: 2026-02-06 14:21:18 UTC
Status:
clientTransferProhibited
Name Servers:
karina.ns.cloudflare.com
clyde.ns.cloudflare.com
Registrar: Eranet International Limited
IANA ID: 1868
URL: Not Available
Abuse Email: Not Available
Abuse Phone: Not Available