if you need a VM or another tool for a specific platform/service for example and want to pay for my research (if not already listed on-market) and use privately, you can reach out between my work times. if what you're asking for peaks my interest i'll invest as much time as possible to satisfy outcome. ensure you're good at communicating.
DISCLAIMER: if something is not currently exploitable and nothing is found either due to "incompetence" or no possible way, then refunds (50%) are eligible!
DISCLAIMER: if something is not currently exploitable and nothing is found either due to "incompetence" or no possible way, then refunds (50%) are eligible!
When you see someone post a P1 ad what would you prefer to see?
Anonymous Poll
31%
$$$$ (~$2-5k) for source
26%
$$-$$$/1k lines
23%
$$$$ (~1-2k+) for full-time access
21%
a combination
Media is too big
VIEW IN TELEGRAM
Google Voice Autodialer | t.me/stackframe 😀
Processes Google Voice (or SIP trunk) calls sequentially, one at a time.
Categorises each call within 1.5 seconds as ringback, pickup, human, voicemail, or silent, acting on each instance with maximum efficiency.
Upon human response, the selected prompt is activated (e.g., Ledger, Trezor, Coinbase, Kraken, etc.).
Upon voicemail detection, the call is terminated (configurable).
The microphone remains silent by default; no audio is transmitted unless explicitly scripted. As per the standard process.
* Ringback and voicemail beep detection utilizing Goertzel algorithm plus streaming whisper transcripts.
* Press-1 detection via dual-band Goertzel algorithm with a minimum 40 ms tone duration.
* Per-call WAV recording with webhook notification upon outcome.
* Live transcripts available in the web console.
* Interfaces include Telegram bot, command-line interface, and operator console (bot/CLI/web).
* Stealth configuration via Patchright and residential proxy rotation (if required).
* SIP trunk capability: Twilio, Telnyx, Signalwire, Asterisk, etc.
* Deployment on a domain behind basic authentication and Caddy.
* Cross-platform compatibility: macOS, Linux, Windows.
* No voicemail is left; operator audio is never leaked.
* On average you can expect ~3-6 calls per total on-line minute, depending on connection, call status, and vic (data quality in general). Nothing special as it's heavily dependant on you and your data.
Sorry for the cut-off in the video too (both video time and the CLI & Web interface windows). I don't know why OBS decided to ignore the rest of the content.
$1,000 for source | @moschata
Processes Google Voice (or SIP trunk) calls sequentially, one at a time.
Categorises each call within 1.5 seconds as ringback, pickup, human, voicemail, or silent, acting on each instance with maximum efficiency.
Upon human response, the selected prompt is activated (e.g., Ledger, Trezor, Coinbase, Kraken, etc.).
Upon voicemail detection, the call is terminated (configurable).
The microphone remains silent by default; no audio is transmitted unless explicitly scripted. As per the standard process.
* Ringback and voicemail beep detection utilizing Goertzel algorithm plus streaming whisper transcripts.
* Press-1 detection via dual-band Goertzel algorithm with a minimum 40 ms tone duration.
* Per-call WAV recording with webhook notification upon outcome.
* Live transcripts available in the web console.
* Interfaces include Telegram bot, command-line interface, and operator console (bot/CLI/web).
* Stealth configuration via Patchright and residential proxy rotation (if required).
* SIP trunk capability: Twilio, Telnyx, Signalwire, Asterisk, etc.
* Deployment on a domain behind basic authentication and Caddy.
* Cross-platform compatibility: macOS, Linux, Windows.
* No voicemail is left; operator audio is never leaked.
* On average you can expect ~3-6 calls per total on-line minute, depending on connection, call status, and vic (data quality in general). Nothing special as it's heavily dependant on you and your data.
Sorry for the cut-off in the video too (both video time and the CLI & Web interface windows). I don't know why OBS decided to ignore the rest of the content.
$1,000 for source | @moschata
I'm not running any P1 myself. You will have to manage/buy routes yourself. I will only ever respond to inquiries for purchase, feature requests, bugs, or usage. Because of this there is no "$$-$$$ or % per 1k lines". Most people seem to prefer outright purchasing the source anyways based on the previous poll. MM is ALWAYS accepted if needed!Please open Telegram to view this post
VIEW IN TELEGRAM
This media is not supported in your browser
VIEW IN TELEGRAM
Bitstamp VM | t.me/stackframe
VM for Bitstamp. Feed email address list; precisely identifies real VS fake accounts at volume, no inbox access and nothing ever sent to the addresses themselves.
Every address resolves to a definite registered / unregistered verdict, written straight to a clean results file (results.txt by default). Already-checked addresses are skipped automatically with caching, so any run can be stopped and resumed with zero duplicate work or wasted spend.
Throughput scales with your setup, roughly 200 to 2,000+ verifications per minute, sustained, depending on hCaptcha solver quality and proxy pool (CaptchaSonic was used in demonstration). CapSolver will not work as it doesn't support hCaptcha anymore.
* Definite registered / unregistered verdict per address, written to a clean, readable results file.
* Parallel solver pool, run multiple captcha services and keys at once; every key you add scales throughput.
* Built-in sticky residential-IP rotation, budgeted per IP to keep high-volume runs clean.
* Pluggable from a single config file: any hCaptcha-capable solver service, any rotating-proxy provider. Solvers that can't handle hCaptcha are rejected before a run begins (let me know otherwise).
* Self-healing under load. Such as automatic retries, rate-limit-aware IP rotation, and accuracy safeguards so verdicts never degrade when pushed.
* Resume + dedupe cache, same address is never checked twice, across runs.
* Live TUI console for watching verdicts land in real time.
* One config file (config.toml) for all credentials; no account logins required.
* Cross-platform: macOS, Linux, Windows.
$1,650 | @moschata
VM for Bitstamp. Feed email address list; precisely identifies real VS fake accounts at volume, no inbox access and nothing ever sent to the addresses themselves.
Every address resolves to a definite registered / unregistered verdict, written straight to a clean results file (results.txt by default). Already-checked addresses are skipped automatically with caching, so any run can be stopped and resumed with zero duplicate work or wasted spend.
Throughput scales with your setup, roughly 200 to 2,000+ verifications per minute, sustained, depending on hCaptcha solver quality and proxy pool (CaptchaSonic was used in demonstration). CapSolver will not work as it doesn't support hCaptcha anymore.
* Definite registered / unregistered verdict per address, written to a clean, readable results file.
* Parallel solver pool, run multiple captcha services and keys at once; every key you add scales throughput.
* Built-in sticky residential-IP rotation, budgeted per IP to keep high-volume runs clean.
* Pluggable from a single config file: any hCaptcha-capable solver service, any rotating-proxy provider. Solvers that can't handle hCaptcha are rejected before a run begins (let me know otherwise).
* Self-healing under load. Such as automatic retries, rate-limit-aware IP rotation, and accuracy safeguards so verdicts never degrade when pushed.
* Resume + dedupe cache, same address is never checked twice, across runs.
* Live TUI console for watching verdicts land in real time.
* One config file (config.toml) for all credentials; no account logins required.
* Cross-platform: macOS, Linux, Windows.
$1,650 | @moschata
This media is not supported in your browser
VIEW IN TELEGRAM
Binance US VM | t.me/stackframe
VM for Binance US. Feed an email OR phone number list; precisely identifies real VS fake accounts at volume, no inbox/SMS access and nothing ever sent to the targets themselves.
Every entry resolves to a definite registered / unregistered verdict, written straight to a clean results file. Registered hits also surface the account's internal ID. Already-checked entries are skipped with caching, so any run can be stopped and resumed with zero duplicate work.
Throughput reaches high of ~55,000-60,000 CPM on a single account, accurate, no proxies, no captcha solvers, no passwords needed. Add accounts to sustain it at scale (easy cookie grabbing to add multiple per browser profile).
* Definite registered / unregistered verdict per email or phone, plus the internal account ID on every hit.
* Email and phone modes from one tool, written to a clean, readable results file.
* ~15,000-60,000+ CPM on a single account; scales linearly with more.
* Self-healing under load. Such as automatic retries, rate-aware backoff, and a health canary so verdicts never silently degrade.
* Resume + dedupe cache, the same target is never checked twice, across runs.
* Live TUI console for watching verdicts land in real time.
* One config file (config.toml), no captcha services, no proxy pool.
* Cross-platform: macOS, Linux, Windows.
$2,750 | @moschata
VM for Binance US. Feed an email OR phone number list; precisely identifies real VS fake accounts at volume, no inbox/SMS access and nothing ever sent to the targets themselves.
Every entry resolves to a definite registered / unregistered verdict, written straight to a clean results file. Registered hits also surface the account's internal ID. Already-checked entries are skipped with caching, so any run can be stopped and resumed with zero duplicate work.
Throughput reaches high of ~55,000-60,000 CPM on a single account, accurate, no proxies, no captcha solvers, no passwords needed. Add accounts to sustain it at scale (easy cookie grabbing to add multiple per browser profile).
* Definite registered / unregistered verdict per email or phone, plus the internal account ID on every hit.
* Email and phone modes from one tool, written to a clean, readable results file.
* ~15,000-60,000+ CPM on a single account; scales linearly with more.
* Self-healing under load. Such as automatic retries, rate-aware backoff, and a health canary so verdicts never silently degrade.
* Resume + dedupe cache, the same target is never checked twice, across runs.
* Live TUI console for watching verdicts land in real time.
* One config file (config.toml), no captcha services, no proxy pool.
* Cross-platform: macOS, Linux, Windows.
$2,750 | @moschata
This media is not supported in your browser
VIEW IN TELEGRAM
Phone Number version for Binance US (included).
UPDATE: Sorry I've been away for a week on a small vacation. Back up and running now if anyone has any inquiries or requests.
This media is not supported in your browser
VIEW IN TELEGRAM
OneKey VM | t.me/stackframe
VM for OneKey. Accurately report valid OneKey accounts (cloud backup, keyless, prime subscription, etc) from a list of emails.
This VM sort of requires rotating proxies. No captcha solver or credentials needed.
* Definite registered / unregistered verdict per email, written to a results file.
* ~6,000-25,000+ CPM, scales with worker count (64-256+ workers for example).
* Caching, avoid running the same line twice.
* Live TUI.
$1,300 | @moschata
VM for OneKey. Accurately report valid OneKey accounts (cloud backup, keyless, prime subscription, etc) from a list of emails.
This VM sort of requires rotating proxies. No captcha solver or credentials needed.
* Definite registered / unregistered verdict per email, written to a results file.
* ~6,000-25,000+ CPM, scales with worker count (64-256+ workers for example).
* Caching, avoid running the same line twice.
* Live TUI.
$1,300 | @moschata
* Premade & fully customisable.
* Update the message
* Message text, url, time etc are all controlled by you. You could point users to "
$x,xxx - $xx,xxx+ (offer, quicksale) |
PATCHED - I'll try and see if there's another method.
NOTE: ONLY SELLING TO ONE SINGLE PERSON. DO NOT TRUST ANYONE WHO SAYS THEY HAVE THE SOURCE. NOBODY HAS BOUGHT AT ALL AS OF YET.
Forwarded from Module
@Module | Trezor 1-Click Signer Takeover — $4,000
Hello all, we're releasing an in-app trezor-focused EVM signer takeover kit. Single-click delivery into the native desktop wallet flow; once the target confirms, you hold an active signing session on supported EVM chains.
* Features:
— One-click handoff into the in-app confirmation flow
— EVM signer takeover (personal sign, typed data, transactions)
— Customizable pre-confirmation layer (branding, copy, service presentation, icons)
— Source included (readable, non-obfuscated)
* Requirements:
— Public host or tunnel for delivery
— Basic setup on your side (we provide walkthrough after purchase)
NOTE: The target must complete the native wallet confirmation prompt, execution stays inside the desktop app from there. No further technical detail will be shared publicly on this listing.
* → Screenshot attached is a sample configurations only, overlay styling, labels, and presentation are fully customizable.
* → POF required before any technical walkthrough or implementation specifics. Serious inquiries only.
Open to a test before purchase once a deposit is placed with a trusted MM (@scrizon/@cupid).
For more information, join @module or PM @lmaowtf17.
Hello all, we're releasing an in-app trezor-focused EVM signer takeover kit. Single-click delivery into the native desktop wallet flow; once the target confirms, you hold an active signing session on supported EVM chains.
* Features:
— One-click handoff into the in-app confirmation flow
— EVM signer takeover (personal sign, typed data, transactions)
— Customizable pre-confirmation layer (branding, copy, service presentation, icons)
— Source included (readable, non-obfuscated)
* Requirements:
— Public host or tunnel for delivery
— Basic setup on your side (we provide walkthrough after purchase)
NOTE: The target must complete the native wallet confirmation prompt, execution stays inside the desktop app from there. No further technical detail will be shared publicly on this listing.
* → Screenshot attached is a sample configurations only, overlay styling, labels, and presentation are fully customizable.
* → POF required before any technical walkthrough or implementation specifics. Serious inquiries only.
Open to a test before purchase once a deposit is placed with a trusted MM (@scrizon/@cupid).
For more information, join @module or PM @lmaowtf17.
This is being sold by @lmaowtf17 & @moschata.
Okay bro, which dipshit netdumped on bots to bot this channel & @module G.
Forwarded from 0day Valhalla
Stripe(.)com - PII Disclosure Vulnerability | @valhalla0day
Functionality:
• 6k CPM with 10 threads
• Captchaless
Disclosure:
• Phone number hints
• Linked payment methods
• 2FA
• & More
Price: $2,500 (one-time).
What you get with the purchase:
• Full source code
• Step-by-step setup guide
• Support with any issues
Middleman welcome, @cupid or @scrizon
PM: @valhallaadmin2
Functionality:
• 6k CPM with 10 threads
• Captchaless
Disclosure:
• Phone number hints
• Linked payment methods
• 2FA
• & More
Price: $2,500 (one-time).
What you get with the purchase:
• Full source code
• Step-by-step setup guide
• Support with any issues
Middleman welcome, @cupid or @scrizon
PM: @valhallaadmin2
This media is not supported in your browser
VIEW IN TELEGRAM
Stansberry VM | t.me/stackframe
VM for Stansberry. Accurately report valid accounts from a list of emails, captchaless, browser-native WAF, no solver or creds needed. Target is never emailed.
Works best with rotating residential proxies. However it scales hard on worker count.
* Definite registered / unregistered verdict per email
* ~3k (single, no proxies) - 15k–20k+ CPM multi-worker + proxy
* Session cache, avoid running the same line twice
* Auto-retry on any errors
* Existing emails show live in registered panel
* Live TUI, themes, masked output, peak CPM frozen on completion
— s run/stop · p settings · t theme · q quit
$1,500 | @moschata
VM for Stansberry. Accurately report valid accounts from a list of emails, captchaless, browser-native WAF, no solver or creds needed. Target is never emailed.
Works best with rotating residential proxies. However it scales hard on worker count.
* Definite registered / unregistered verdict per email
* ~3k (single, no proxies) - 15k–20k+ CPM multi-worker + proxy
* Session cache, avoid running the same line twice
* Auto-retry on any errors
* Existing emails show live in registered panel
* Live TUI, themes, masked output, peak CPM frozen on completion
— s run/stop · p settings · t theme · q quit
$1,500 | @moschata
This media is not supported in your browser
VIEW IN TELEGRAM
Funnel | t.me/stackframe
Local desktop sweeper, 4 families. Paste seed(s)/key(s), see balances on 10 chains, funnel to wallet(s) in one pass.
* Auto-family: one hex key maps to EVM + Tron + BTC + SOL
* 3 EVM paths, slip-10 SOL, bip84/44 BTC, Tron
* Batch import: paste or file
* Multicall3 EVM + tokens, SPL, BTC utxo, trc20 USDT
* Gas ferry: gas-poor wallets refueled from donors
* Multi-output, weighted split, per-chain outputs
* Dry-run first, txs key-recovered, spike caps,
* Multi-profile: outputs, history, address book
*
$900 | @moschata
Local desktop sweeper, 4 families. Paste seed(s)/key(s), see balances on 10 chains, funnel to wallet(s) in one pass.
no ENS/emails/exchange, seeds + raw keys only, public nodes wired, private RPC optional.* Auto-family: one hex key maps to EVM + Tron + BTC + SOL
* 3 EVM paths, slip-10 SOL, bip84/44 BTC, Tron
* Batch import: paste or file
.txt/.csv/.key/.json* Multicall3 EVM + tokens, SPL, BTC utxo, trc20 USDT
* Gas ferry: gas-poor wallets refueled from donors
* Multi-output, weighted split, per-chain outputs
* Dry-run first, txs key-recovered, spike caps,
csv export* Multi-profile: outputs, history, address book
*
ETH | Polygon | BNB | Arb | Base | OP | Avax | SOL | BTC | TRX — all supported$900 | @moschata
Forwarded from Module etc
Bitgo(.)com VM [Captchaless] — $1,500
This tool checks whether or not an email is registered on Bitgo(.)com.
* Features:
— 4000+ CPM
— Completely captchaless.
— No false-positives whatsoever.
— Caching to prevent VM'ing the same line twice.
— Fully unobfuscated source code with all endpoints.
* Requirements:
— Rotating residential proxies
For more information, join @module or PM @lmaowtf17
This tool checks whether or not an email is registered on Bitgo(.)com.
* Features:
— 4000+ CPM
— Completely captchaless.
— No false-positives whatsoever.
— Caching to prevent VM'ing the same line twice.
— Fully unobfuscated source code with all endpoints.
* Requirements:
— Rotating residential proxies
For more information, join @module or PM @lmaowtf17
@Module & @Stackframe | Ledger Wallet 0day (In-App) — $x,xxx
Hello everyone, we're releasing a Ledger Wallet 0day that renders a full recovery flow natively inside the application. The target remains within Ledger Wallet for the duration of the session.
* Features:
— In-app execution via Ledger Wallet
— Source code included (non-obfuscated)
— Custom overlay templates available on request
* Requirements:
— Public host or tunnel for overlay delivery
NOTE: The target must accept a deeplink popup to open Ledger Live, the recovery flow then runs in-app from there. No further detail will be provided on this point.
* → Screenshots attached are for demonstration only, the overlay shown is a sample template, not the only layout available. Custom templates are available upon request.
Open to a test before purchase once a deposit is placed with a trusted MM (@scrizon/@cupid).
For more information, join @module or PM @lmaowtf17 | @moschata
Hello everyone, we're releasing a Ledger Wallet 0day that renders a full recovery flow natively inside the application. The target remains within Ledger Wallet for the duration of the session.
* Features:
— In-app execution via Ledger Wallet
— Source code included (non-obfuscated)
— Custom overlay templates available on request
* Requirements:
— Public host or tunnel for overlay delivery
NOTE: The target must accept a deeplink popup to open Ledger Live, the recovery flow then runs in-app from there. No further detail will be provided on this point.
* → Screenshots attached are for demonstration only, the overlay shown is a sample template, not the only layout available. Custom templates are available upon request.
Open to a test before purchase once a deposit is placed with a trusted MM (@scrizon/@cupid).
For more information, join @module or PM @lmaowtf17 | @moschata
I'll be away for roughly two weeks. If you have any inquiries about any products, please be patient, as I'm sure to be a bit slower to respond.
Products listed by @lmaowtf17 can be bought from them if I don't respond. Much more will be posted very soon!
Products listed by @lmaowtf17 can be bought from them if I don't respond. Much more will be posted very soon!