βΌοΈπ¦πͺ A threat actor is offering admin-level Fortinet SSL-VPN access into an undisclosed UAE-based hotel reservations company with reported revenue of $17 million and 1,450 network hosts, priced at $700.
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈ CVE-2026-39113: Heap Buffer Overflow in SQLite's Optional SQLAR Extension
GitHub: https://github.com/20000419/CVE-2026-39113
GitHub: https://github.com/20000419/CVE-2026-39113
β€4
Media is too big
VIEW IN TELEGRAM
The Informant's Gambit - A Darknet Mystery
The year 2013 marked a turning point in the evolution of cybercrime. The growing adoption of Bitcoin and Tor helped usher in a new era of online anonymity, underground commerce, and digital crime, culminating in one of the most widely publicized federal cases of the modern internet era.
The Silk Road case is one that many people have heard of, but far fewer understand in its entirety. Beyond the headlines, the arrest of Ross Ulbricht, and the eventual collapse of the marketplace lies a far more complicated story involving informants, undercover operations, corrupt federal agents, and figures whose roles remain largely overlooked.
This video examines the largely forgotten relationship between Ross Ulbricht and a mysterious figure known as "NotWonderful," also known as "Alpacino." The individual appeared to operate as an informant from within the darknet marketplace, yet references to the figure seemingly vanished from the government's official record as the Silk Road investigation progressed.
Who was NotWonderful, what role did they actually play in the investigation, and why did their presence seemingly disappear from the record?
Video Credit: youtube.com/@BarelySociable
The year 2013 marked a turning point in the evolution of cybercrime. The growing adoption of Bitcoin and Tor helped usher in a new era of online anonymity, underground commerce, and digital crime, culminating in one of the most widely publicized federal cases of the modern internet era.
The Silk Road case is one that many people have heard of, but far fewer understand in its entirety. Beyond the headlines, the arrest of Ross Ulbricht, and the eventual collapse of the marketplace lies a far more complicated story involving informants, undercover operations, corrupt federal agents, and figures whose roles remain largely overlooked.
This video examines the largely forgotten relationship between Ross Ulbricht and a mysterious figure known as "NotWonderful," also known as "Alpacino." The individual appeared to operate as an informant from within the darknet marketplace, yet references to the figure seemingly vanished from the government's official record as the Silk Road investigation progressed.
Who was NotWonderful, what role did they actually play in the investigation, and why did their presence seemingly disappear from the record?
Video Credit: youtube.com/@BarelySociable
How come TAs don't buy like 120 inch tvs that are $125000 and flex it? Like, I get it, you like watches but come on.
π1
π¨π―π΅ Nintendo targets more than 400 Switch emulator repositories in massive GitHub sweep
Nintendo filed seven DMCA anti-circumvention notices in a single day targeting Switch emulator projects and their forks.
The largest action hit Suyu, a Yuzu successor, with GitHub processing the notice against an entire network of 311 repositories.
Other targets included:
β’ 29 Skyline repositories
β’ Multiple Yuzu forks and Android ports
β’ 17 MonoNX forks
β’ Yuzu Early Access mirrors
Nintendo argues the emulators circumvent its technological protection measures by using unauthorized cryptographic keys to decrypt Switch games.
Most of the targeted repositories are now offline. Some of the code had already survived previous shutdowns through forks, mirrors, and revived projects, meaning keeping it offline may prove harder than removing it.
Source: https://torrentfreak.com/nintendo-wipes-out-400-switch-emulator-repos-in-single-day-github-sweep/
Nintendo filed seven DMCA anti-circumvention notices in a single day targeting Switch emulator projects and their forks.
The largest action hit Suyu, a Yuzu successor, with GitHub processing the notice against an entire network of 311 repositories.
Other targets included:
β’ 29 Skyline repositories
β’ Multiple Yuzu forks and Android ports
β’ 17 MonoNX forks
β’ Yuzu Early Access mirrors
Nintendo argues the emulators circumvent its technological protection measures by using unauthorized cryptographic keys to decrypt Switch games.
Most of the targeted repositories are now offline. Some of the code had already survived previous shutdowns through forks, mirrors, and revived projects, meaning keeping it offline may prove harder than removing it.
Source: https://torrentfreak.com/nintendo-wipes-out-400-switch-emulator-repos-in-single-day-github-sweep/
π4β€1
πͺ That Dark Web Guy - Part 3 πͺ pinned Β«βοΈ I will randomly purge this channel. Over 27 forums monitored on the platform and still growing. X/Twitter: https://x.com/DarkWebInformer Main Channel: https://t.me/SliceForLifeee Backup Channel: https://t.me/SliceForLifeeee Telegram CVE Feed: https://β¦Β»
π¨πͺπΈ UGT FeSMC FGV Alicante allegedly breached, employee database and internal application data leaked on a cybercrime forum
β
A forum user claims to have compromised UGT FeSMC FGV Alicante, releasing an expanded employee database alongside what is described as a private APK used by internal personnel and an employee pass-generation application. The listing says this is a second release following an earlier leak.
β
The advertised data includes:
β
β’ 338 employee and agent records
β’ Employee IDs, numbers and names
β’ Employee categories and residence information
β’ Seniority dates and personnel records
β’ 2,756 work-shift records
β’ 792 shift-type records
β’ 16,407 detailed shift schedules and working hours
β’ Work and historical calendars
β’ 118,404 annual calendar records
β’ 3,002 vacation-period records
β’ Rest-period information
β’ Train numbers, routes, origins and destinations
β’ Railway stops and geographic coordinates
β’ Material-cycle information
β’ Publications and internal circulars
β’ Documents and document relationships
β’ Internal notifications and audio messages
β’ Application and database configuration data
β’ Internal application menus and resources
β’ Operational variables and parameters
β’ Historical work-time and scheduling information
β’ Android application and SQLite metadata
β
The thread also claims access to an internal employee application and pass generator, with screenshots published as proof of access.
β
The claims and the authenticity, source and scope of the allegedly exposed data and internal application access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum user claims to have compromised UGT FeSMC FGV Alicante, releasing an expanded employee database alongside what is described as a private APK used by internal personnel and an employee pass-generation application. The listing says this is a second release following an earlier leak.
β
The advertised data includes:
β
β’ 338 employee and agent records
β’ Employee IDs, numbers and names
β’ Employee categories and residence information
β’ Seniority dates and personnel records
β’ 2,756 work-shift records
β’ 792 shift-type records
β’ 16,407 detailed shift schedules and working hours
β’ Work and historical calendars
β’ 118,404 annual calendar records
β’ 3,002 vacation-period records
β’ Rest-period information
β’ Train numbers, routes, origins and destinations
β’ Railway stops and geographic coordinates
β’ Material-cycle information
β’ Publications and internal circulars
β’ Documents and document relationships
β’ Internal notifications and audio messages
β’ Application and database configuration data
β’ Internal application menus and resources
β’ Operational variables and parameters
β’ Historical work-time and scheduling information
β’ Android application and SQLite metadata
β
The thread also claims access to an internal employee application and pass generator, with screenshots published as proof of access.
β
The claims and the authenticity, source and scope of the allegedly exposed data and internal application access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· DΓ©clic Services allegedly breached, 6.27M raw database records advertised for sale on a cybercrime forum
β
A forum actor claims to have breached DΓ©clic Services and extracted its production database after gaining access through the company's web environment and an internet-exposed ERP system. The alleged breach is dated August 20, 2026.
β
The listing claims the SQL database contains 6,271,531 raw, non-deduplicated records, including:
β
β’ Approximately 13,000 user records
β’ 14,947 unique email addresses
β’ 6,451 unique IBANs
β’ Approximately 6,300 IBAN/RIB records
β’ 561 unique password entries
β’ Names and user identities
β’ Contact information and postal addresses
β’ Password hashes
β’ Billing and financial information
β’ Payment and billing history
β’ Subcontractor-related records
β’ Internal hostnames and service endpoints
β’ Application configuration data
β’ Infrastructure references
β’ Access and credential-related information
β
The listing also claims credentials, access keys and configuration information associated with cloud infrastructure were present in the compromised environment. A sample containing approximately 300 SQL rows across seven tables was published, while invoices, contracts, accounting data, API keys, configuration files, documents and hundreds of additional tables are claimed to exist in the full dataset.
β
The claims and the authenticity, source and scope of the allegedly exposed data and access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have breached DΓ©clic Services and extracted its production database after gaining access through the company's web environment and an internet-exposed ERP system. The alleged breach is dated August 20, 2026.
β
The listing claims the SQL database contains 6,271,531 raw, non-deduplicated records, including:
β
β’ Approximately 13,000 user records
β’ 14,947 unique email addresses
β’ 6,451 unique IBANs
β’ Approximately 6,300 IBAN/RIB records
β’ 561 unique password entries
β’ Names and user identities
β’ Contact information and postal addresses
β’ Password hashes
β’ Billing and financial information
β’ Payment and billing history
β’ Subcontractor-related records
β’ Internal hostnames and service endpoints
β’ Application configuration data
β’ Infrastructure references
β’ Access and credential-related information
β
The listing also claims credentials, access keys and configuration information associated with cloud infrastructure were present in the compromised environment. A sample containing approximately 300 SQL rows across seven tables was published, while invoices, contracts, accounting data, API keys, configuration files, documents and hundreds of additional tables are claimed to exist in the full dataset.
β
The claims and the authenticity, source and scope of the allegedly exposed data and access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΊπΈ Dataset containing 5.3M allegedly used or inactive payment card records advertised on a cybercrime forum
β
A forum seller is advertising a private dataset containing approximately 5.3 million records, claiming roughly 99% of the data is associated with the United States. The listing describes the payment card information as previously used or no longer active.
β
The advertised data includes:
β
β’ Payment card numbers
β’ Expiration dates
β’ Cardholder names
β’ Billing addresses
β’ Cities, states and ZIP codes
β’ Countries
β’ Phone numbers
β’ Email addresses
β’ IP addresses
β’ User-agent information
β
The seller states that every record contains either a phone number or email address and says escrow is accepted.
β
Bidding starts at $8,000, with $500 minimum bid increments and a $10,000 buyout price. The auction is scheduled to end on September 21, 2026.
β
The seller's claims and the authenticity, source and validity of the advertised data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller is advertising a private dataset containing approximately 5.3 million records, claiming roughly 99% of the data is associated with the United States. The listing describes the payment card information as previously used or no longer active.
β
The advertised data includes:
β
β’ Payment card numbers
β’ Expiration dates
β’ Cardholder names
β’ Billing addresses
β’ Cities, states and ZIP codes
β’ Countries
β’ Phone numbers
β’ Email addresses
β’ IP addresses
β’ User-agent information
β
The seller states that every record contains either a phone number or email address and says escrow is accepted.
β
Bidding starts at $8,000, with $500 minimum bid increments and a $10,000 buyout price. The auction is scheduled to end on September 21, 2026.
β
The seller's claims and the authenticity, source and validity of the advertised data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· French Tennis Federation database allegedly breached, 200K+ users claimed
β
A cybercrime forum user claims to have breached the French Tennis Federation (FFT) and exfiltrated information belonging to more than 200,000 users. The post lists a total user count of 210,540 and claims the data was extracted during a recent scraping operation.
β
The advertised data includes:
β
β’ User and account IDs
β’ Names
β’ Email and contact-related information
β’ Phone numbers
β’ Billing addresses
β’ Shipping addresses
β’ Postal codes, cities and countries
β’ Payment method information
β’ Customer and seller information
β’ Order and product information
β’ Prices, quantities and tax amounts
β’ Account balances and fees
β’ Refund information
β’ Status and account activity fields
β’ Date and timestamp information
β
The forum post includes what the user describes as a sample of the allegedly compromised data and lists dozens of database fields claimed to have been extracted.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A cybercrime forum user claims to have breached the French Tennis Federation (FFT) and exfiltrated information belonging to more than 200,000 users. The post lists a total user count of 210,540 and claims the data was extracted during a recent scraping operation.
β
The advertised data includes:
β
β’ User and account IDs
β’ Names
β’ Email and contact-related information
β’ Phone numbers
β’ Billing addresses
β’ Shipping addresses
β’ Postal codes, cities and countries
β’ Payment method information
β’ Customer and seller information
β’ Order and product information
β’ Prices, quantities and tax amounts
β’ Account balances and fees
β’ Refund information
β’ Status and account activity fields
β’ Date and timestamp information
β
The forum post includes what the user describes as a sample of the allegedly compromised data and lists dozens of database fields claimed to have been extracted.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΉπ· Access to Turkish telecommunications company allegedly listed for sale on a cybercrime forum
β
A cybercrime forum user is advertising what they claim is privileged access to the Azure Active Directory environment of a telecommunications company in Turkey. The seller claims the access provides Database Administrator (SA) privileges.
β
The advertised access includes:
β
β’ Azure AD environment
β’ Database Administrator (SA) privileges
β’ Approximately 100 hosts
β’ No detected AV/EDR
β’ Telecommunications industry
β’ Turkey-based organization
β’ Claimed company revenue of $25M to $50M
β
The seller is asking 2,487,240 sats, approximately 0.02487240 BTC, for the access and states that it is also available through an underground access marketplace.
β
The seller's claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A cybercrime forum user is advertising what they claim is privileged access to the Azure Active Directory environment of a telecommunications company in Turkey. The seller claims the access provides Database Administrator (SA) privileges.
β
The advertised access includes:
β
β’ Azure AD environment
β’ Database Administrator (SA) privileges
β’ Approximately 100 hosts
β’ No detected AV/EDR
β’ Telecommunications industry
β’ Turkey-based organization
β’ Claimed company revenue of $25M to $50M
β
The seller is asking 2,487,240 sats, approximately 0.02487240 BTC, for the access and states that it is also available through an underground access marketplace.
β
The seller's claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πͺπΈ Cistec database allegedly leaked on a cybercrime forum, millions of records claimed
β
A cybercrime forum user claims to have obtained data from Cistec, a Spain-based digital marketing and technology company. The post claims access to a 1.4 GB database environment containing 31 databases and 1,214 tables, including CRM, ERP, HR, invoicing, logistics and communications-related systems.
β
The advertised data includes:
β
β’ First and last names
β’ Email addresses
β’ Phone and mobile numbers
β’ DNI and identification numbers
β’ Dates of birth
β’ Physical addresses
β’ Cities, locations and postal codes
β’ Gender information
β’ IP addresses
β’ Internal identifiers
β’ CRM and customer-related records
β’ ERP and invoicing-related data
β
The user claims approximately 1.1 million personal records from 2022 through 2025, approximately 65,000 additional records associated with business partner Impacting Digital, and approximately 5.4 million phone-number records, of which around 4.2 million are claimed to be unique.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A cybercrime forum user claims to have obtained data from Cistec, a Spain-based digital marketing and technology company. The post claims access to a 1.4 GB database environment containing 31 databases and 1,214 tables, including CRM, ERP, HR, invoicing, logistics and communications-related systems.
β
The advertised data includes:
β
β’ First and last names
β’ Email addresses
β’ Phone and mobile numbers
β’ DNI and identification numbers
β’ Dates of birth
β’ Physical addresses
β’ Cities, locations and postal codes
β’ Gender information
β’ IP addresses
β’ Internal identifiers
β’ CRM and customer-related records
β’ ERP and invoicing-related data
β
The user claims approximately 1.1 million personal records from 2022 through 2025, approximately 65,000 additional records associated with business partner Impacting Digital, and approximately 5.4 million phone-number records, of which around 4.2 million are claimed to be unique.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈ New Darknet Market: UnderWeb Market
You don't need to register. Get to the registration screen and remove everything after .onion/ and reload. π€·ββοΈ
Market: https://73y3tbxyjqvakzv5se2iqpf2it67qalnz4jbkqs7s524mfrpvrsfv6id[.]onion
Dread Announcement: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/38c334902cf34331d788
You don't need to register. Get to the registration screen and remove everything after .onion/ and reload. π€·ββοΈ
Market: https://73y3tbxyjqvakzv5se2iqpf2it67qalnz4jbkqs7s524mfrpvrsfv6id[.]onion
Dread Announcement: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/38c334902cf34331d788
π₯1π1
βΌοΈ New Dark Web Informer Blog Post!
Title: bitbybit Studio Customer Records and AI Chat Logs Offered for Sale
Link: https://darkwebinformer.com/bitbybit-studio-customer-records-and-ai-chat-logs-offered-for-sale/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: bitbybit Studio Customer Records and AI Chat Logs Offered for Sale
Link: https://darkwebinformer.com/bitbybit-studio-customer-records-and-ai-chat-logs-offered-for-sale/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
bitbybit Studio Customer Records and AI Chat Logs Offered for Sale
A forum user posting as seraphims is selling what they describe as the database of bitbybit.studio, an AI commerce platform that turns customer conversations on WhatsApp and Instagram into orders, support, and checkouts.
βΌοΈ New Dark Web Informer Blog Post!
Title: French Police File Queries Allegedly Taken Through the Calypsso Portal
Link: https://darkwebinformer.com/french-police-file-queries-allegedly-taken-through-the-calypsso-portal/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: French Police File Queries Allegedly Taken Through the Calypsso Portal
Link: https://darkwebinformer.com/french-police-file-queries-allegedly-taken-through-the-calypsso-portal/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
French Police File Queries Allegedly Taken Through the Calypsso Portal
A forum user posting as DumpSecNew is selling what they describe as data drawn from Portail Calypsso, an access portal used to query French national police systems.