Hacker/Cybercrime Community / Script Kiddies / Skids / Skid Hunters / Hacker Forums / Darknet Marketplaces - Skids and manchildren that hunt them

[Avenue]

In what seems to be a weekly occurrence doxbin is in trouble again, this time all three domains appear to be suspended, again, possibly due to a seizure by known German domain stealing registrar Key-Systems, again.

Spoiler: whois

doxbin.com

doxbin.net

doxbin.org

Last time this happened in late-ish 2024 they managed to get their domains back, will they succeed again? Who knows. I sometimes wonder how much longer the site can survive in its current form. With the recent databreach, a seemly constant revolving door of staff changes and a business model that relies on people essentially bribing staff to remove doxes or the willingness of users splurging on novelty ranks, the site seems to be in a bad place now. If the site does come to an end I at least hope it will go down with a bang and not whither away as some place of former infamy. (staged kidnapping 2.0 maybe?)
doublepost? never heard of her

 

[dumbledore]

In what seems to be a weekly occurrence doxbin is in trouble again, this time all three domains appear to be suspended, again, possibly due to a seizure by known German domain stealing registrar Key-Systems, again.

They have been unsuspended and now redirect to their new Telegram channel (A). From what I know, they are required to move to another registar.

Spoiler

 

[Vordhusbn]

Hey, it's been a bit since this thread was active.

I don't wish to say who I am as there has been a lot of bad press surrounding my name but I have made DB com my home back in late 2022 when I was a confused, bored and friendless teenager. Needless to say that it has fucking ruined every single inch of my brain but I have (sadly) gained overwhelming knowledge as to all of the inner workings and controversy of every single shitty lil skid drama that has occurred. I was here when Eom ruled the scene, I was here when Helladrol/Argosity took over. I was there when Lillie was hanging around with Hypnotist Sappho and I was there when they larped being having an Interpol Red Notice and illegally immigrated to the US from France so they could start a failing company and larp being rich on X. I was there when Wiz started ThreatSec and then got doxxed and left. I was there when Hana/Kmeta was a big nigga and I was there when Astounding made BlackForums, passed the responsibility onto 20 other people then exit scammed his way out of the scene. I was there when Emo was bragging about 20k CB hits in his channel that had 13 subscribers at the time and I was there when he started grooming minors over Minecraft. I was there when Phin made a name for himself here and the recent shit where he started making enemies with everyone.

I've seen it all. I didn't have anywhere else to go and I fucking rotted here for the longest time, not knowing that I could very simply just walk out of my house and talk to people. I've only discovered that recently and I am a far, far happier person then I ever used to be, I actually feel like that I'm making something of my life now and it is fucking fantastic. I left that shithole and deleted Telegram as a whole about a week ago and I feel as if a massive weight has been lifted off of my shoulders, I can't really put into words how great this feels.

I really want to write an entire book about everything I have discovered on my journey. I'm pretty much an oldfag on my main acc here and contribute info to multiple threads so this is just a temporary account I made specifically for this purpose as I don't want this shit chapter in my life tied back to me. I used to be a furry many many many moons ago and was quite active in the fandom, the fandom is a cesspit of itself. It's the crossroads between blind intersectionality (without seeing the consequences), grooming and emotional abuse, retarded troons trying to be the hero of their own story by labelling XYZ as a Nazi because they disagree with them on one small topic and everyone else who just sits from the sidelines being ok with what was supposed to be a collective of fluffy animals on the internet turn into a cancer for minds young and old. I have had much experience with the furry fandom and when I moved from there to com after I got sick of it, I expected it to be very different. Needless to say that in some ways it was and in other ways it wasn't. It still had the same vitreal towards your siblings and hatred for those who are doing better for you (the same as I experienced in the fandom), but in many ways it did not have the political brainrot which the fandom had which I was very happy about. The furry fandom is a... complicated topic with many different viewpoints, but com is so simple and it was like jumping from the Sahel to Antarctica when I finally made the switch. I know this sounds simple stupid but everyone in com, every, single, fucking, person follows the exact same story. They were a young gifted child, they got bullied immensly in school for it, they came to the internet to look for friends and saw a video or played a videogame of some guy hacking one day, decided "that looks cool" so they research more about it, end up making a Telegram account and get sucked into the static that eventually forms in their brain. From there the next step is to form a God ego complex where they believe that everybody is beneath them because their Python ChatGPT script is better than the other guys Python ChatGPT script. They were once bullied in school, and now they get to BE the bully and all of the dopamine and serotonin they recieve directly comes from that feeling plus the attention they get from others if/when they hit something big. It is quite literally that simple, every single fucking com kid I have met and gotten close to has told me the exact same fucking story and it's becoming rather monotomous by this point but still extremely horrifying.

I got so fed up with hearing the same story and seeing these 16 year olds ego complexes playing out into a fucking Russian messaging app. I knew I was destined for greater things then short term popularity amongst other kids so I left and made something of myself.

That's basically the story in a nutshell, but now that I'm out I want to tell my story of all that I have learned, everything from individuals themselves to different threat groups and the people and motives behind them to the themes, drama and attitudes of other chats. I am an open book and I want to share my story. But the issue is that I have zero idea where to start. My name is still rife in the community so I don't want to do some basic bitch 'callout' posts which will bring attention to myself, but I am more than happy to share my experiences, screenshots, recordings, archives of the history of com within the past 3 or so years.

If there is anyone you had an inkling that may be a bit dodgy or maybe didn't understand what a certain chat was about, please let me help. I am more than happy to answer any questions that come my way as this past 3 years have been hell and there is a lot to tell.

This is probably the most I have ever contributed to a thread in my 6 or so years here. I really want you to ask me questions so I can put some stuff out there, once again, I am an open book, I have seen the start and (what is probably about to be) the end of this chapter of com.

Many thanks.

 

[Avenue]

I am more than happy to answer any questions that come my way as this past 3 years have been hell and there is a lot to tell.

First of all good on you for making progress in you life socially. I am sure you'll find great friendships with real people out there even if you can't joke or talk about the things netizens enjoy.

Deciding where to begin a story is always a tricky task but I think in the spirit of this thread and the forum in general I would be interested in knowing the following. From your perspective what was the most funny / extraordinary person/group or escapade you came across. Not framed as a callout but more as a retelling of something so "out there" that it could have only occurred in the com. Something the general cybercrime slop YouTube channels have missed but still something worth preserving.

I hope you understand that while I respect your choice of using a throwaway this does come with the caveat of you needing to share at least some proof of authenticity to what you're telling. i.e. screenshots/recordings.

Also please don't overestimate anyone's knowledge of events here in the thread, no one here as a complete timeline of all chats / personalities so please feel free to give extra context where you think its necessary.

 

[resigned]

I've been hesitant about making this post, but the situation has gone as far as making my best friend feel disgusted. I apologize if this derails the thread.

Over the past three weeks, I've been dealing with some business in BreachForums, which has required me to be active on the site. About a week ago, I exposed a pedophile known as Paw (aka AmStaff) for falling in love (not kidding) with my online persona and for messaging known minors in a disturbing way.

Paw ran out from the community almost instantly, but came back a couple of days later when Loki made him moderator (lol). Of course, Loki also defended paw's pedophilic behavior, because it's "just post - a 17 year old". Even though AmStaff knew he was a minor, because I told him a month before.
​

This event resulted in an considerable amount of hate directed at me, for exposing a pedophile. Around this time, my VM got corrupted, and I lost several screenshots of death threats and rape threats from when it happened, but my friend Jasmine has been helping me take more.

You may wonder what I said to provoke such a reaction. The reality is that I have not engage with them. The shoutbox has an "Active Users" list, and these individuals wait for me to log in so they can mention me, even when I rarely participate in the chat. It's quite unsettling. I've never interacted with any of them, yet there have been times when I logged out while they were talking about me, and when I logged back in hours later, they were still on-going.

On one occasion, Jasmine had logged into my account (for the business I mentioned), sent 1 message to a common friend, and got freaked out by the sexual content of the almost-instant comments. When I attempted to address the situation with a moderator, who defends his pedophile friend AmStaff, his response was the following:

A hacking forum should be a place for people who are passionate about cybersecurity, malware, and development. For many of us, being social IRL is difficult, and I believe this should be a safe space for everyone, regardless of gender, race, or background. It's really disheartening to see this kind of behavior.

Now, imagine if I actually did care about the threats. There have always been a significant number of minors (as low as 13 year olds) in this community, and if I actually cared about any insults or instead of me, it was a minor, what do you think it would happen? This is the same behavior com groups use to extort children.

The irony of it all is that those who accuse others of extorting minors have ended up behaving even worse than the very people they condemn.

I didn't want to give these freaks any more attention. However, I'm worried they might repeat this behavior with minors in the future, so I felt it was important to shed some light on the issue, especially because I am not the first one to suffer from this harassment.

Yesterday, I finally closed the deal I had been working on and decided to bait them for a while. Needless to say, they all fell for it. At the time, there were three moderators present, yet none of them did anything to stop the harassment. But it proved my point.

It's clear that the breached community is in its final stages; it's not what it used to be, and now it's a shadow of its former self. This is Pom's legacy. Pedophile owner, pedophile staff, pedophile members.

 

[dumbledore]

A hacking forum should be a place for people who are passionate about cybersecurity, malware, and development. For many of us, being social IRL is difficult, and I believe this should be a safe space for everyone, regardless of gender, race, or background. It's really disheartening to see this kind of behavior.

What the fuck did I just read

 

[resigned]

What the fuck did I just read

Perhaps it is too much to expect not to be told that I was going to be raped while walking home alone—particularly coming from what should be intellectual individuals—just for asking about the source of a database. What do I know though? I guess it is my fault for having a "female username".

 

[heartBleed]

I was there when he started grooming minors over Minecraft

Glad you're an OG

 

[Markass the Worst]

Perhaps it is too much to expect not to be told that I was going to be raped while walking home alone—particularly coming from what should be intellectual individuals—just for asking about the source of a database. What do I know though? I guess it is my fault for having a "female username".

I wouldn't rape you. That being said, the bigger problem here is the alleged pedophile(s) in the staff, so please focus more on that than some edgy retarded jokes.

From what I've seen so far I can't say for sure they're pedos, but I wouldn't be surprised.

 

[resigned]

I wouldn't rape you. That being said, the bigger problem here is the alleged pedophile(s) in the staff, so please focus more on that than some edgy retarded jokes.

From what I've seen so far I can't say for sure they're pedos, but I wouldn't be surprised.

I may have gone too far with it, but as you can imagine, it is really upsetting to see the most kind-hearted person I’ve ever met having to read these threats, especially when she already struggles with English. I was already very tired of this situation, as these comments have been happening daily for weeks.

Regarding the accusations, I’ve been searching for instances where the staff were implicated in pedophilia. As far as I know, there was an incident when a known member of the forum was caught asking Tanaka (the moderator) for CP. I had the screenshot saved in my VM, and I believe it was also in emo's now deleted tg channel. I've been requesting an export, but no one seems to have it.

 

[LoveniaDressika]

Glad you're an OG

you doxxed and swatted a 14 year old and there is mc logs of you talk with cuddly and say you going to rape her when she only 15

 

[Sprate Header]

you doxxed and swatted a 14 year old and there is mc logs of you talk with cuddly and say you going to rape her when she only 15

Post the evidence instead of just saying there is evidence, please.

 

[Sprate Header]

Double post, but new ironic video about the recent Bybit heist carried out by the North Korean group Lazarus:

(PreserveTube)

Hearing all the technical details of the heist laid out in relatively plain-English was a) insanely fascinating, and b) insanely humbling. How the fuck were the North Koreans able to carry out such a complex operation? I genuinely can't fathom how the hell anyone, let alone the most isolated country on the planet, was able to find and exploit the attack vector they did. It was genius. Really puts into perspective how little you really understand about computers, lmfao

 

[nekoelf]

New documentary about the FTX hack that was carried out by a sim-swapping gang right as the company was falling apart:

(PreserveTube)

ETA: noticed that Thinker also put out a doc a few months ago about an old incident in the 90's of an international heist against CitiBank. Apparently a lot of the hackers involved literally first met each other while already inside of CitiBank's network after the latest issue of a hacking e-zine called Phrack had gone into detail about how the company worked

(PreserveTube)

The admin, Lucas Sohn, was clearly a fall guy. He was the admin, but not owner of Nulled.

He had pretty bad opsec, the most obvious of them being that his username on Nulled was "Lucas".
Here is a image he posted on his personal Facebook of him logged into Nulleds chat.

Kinda feel bad for the poor fella, he wasn't a pedophile or an extortionist, and would middleman many transactions without issue. Oh well.

 

[heartBleed]

you doxxed and swatted a 14 year old and there is mc logs of you talk with cuddly and say you going to rape her when she only 15

The "14 year old" that was doxed has his full name under the same username he was frequenting hacking forums with (and still does) (A)
I didn't have any involvement and I'm pretty confident he was not swatted, unless the British police took it upon themselves to visit him.

The Minecraft chat logs are fake and were created by a pedophile who was raided in 2023 for having child pornography, and later arrested in 2024 (Article)

 

[Ferryman]

Doxbin has allegedly been compromised after they accused a member of a group named "Tooda" of being a pedophile.


source (a)

Any word on whether they scraped the site itself, i.e. all the pastes and whatnot, and if they'd be dumping it? Been meaning to scrape it for a hot minute but never got around to it. Damn dogshit timing.

 

[karz]

An interesting writeup:

An inside look at NSA (Equation Group) TTPs from China’s lense
https://www.inversecos.com/2025/02/an-inside-look-at-nsa-equation-group.html (archive.ph)

I honestly believe this one. I have a few reasons why. In no particular order:

• NSA-style zero-days (à la the ones used in Stuxnet) are very hard to come by.
  • I recall meeting with a former NSA employee during my undergrad days. They said that at any given time, the NSA has one dozen to two dozen unpatched zero days in various operating systems for surveillance and data exfiltration.
  • NSA doesn't like using their zero-days, because once they're used, target state actors usually close them off quickly.
  • NSA does its best to be careful with these zero days, as some can be so broadly useful and harmful. The NSA keeps a lid on their zero days for as long as possible to maintain a cyber advantage; except on one occasion in 2020 (archive), the NSA has never published a good-faith vulnerability disclosure.
• Custom exploit tools take time to develop.
  • It would not surprise me if the NSA still occasionally uses a framework or similar tools to EternalBlue.
• Counterintelligence purposes - or perhaps purposefully sloppy?
  • The NSA could have been purposefully sloppy for this operation. The article you linked states that the NSA allegedly penetrated a university campus network.
  • Universities are (generally) not known for their excellent cyber hygiene and for locking down network resources like open ports.
    • A determined and state-funded APT could breach the network with little social engineering.
  • TAO may have determined that putting their white gloves on was unnecessary while snooping around.
    • TAO was not penetrating the classified networks of MSS or the Politburo.

In conclusion, I believe TAO is behind the hack, but the rationale for being sloppy doesn't make sense, to me anyway. It was during COVID, it could have been a more inexperienced set of employees and soldiers working at TAO at that time. But, the COVID-19 vaccine was also widely available at that point.
I also fully believe that the exploit times are the giveaway for the threat actor. I've passed by the NSA side of Fort Meade multiple times on weekends or after work hours. The parking lot outside headquarters is almost empty by 5:45 PM local time during the work day, with some straggler vehicles in the parking lot.
Zero cars are present on weekends unless a grave geopolitical event is stirring in the Middle East or Europe.

 

[nekoelf]

Thought this was funny, here is an edit of a spongebob themed live coinbase panel (phishing page) I found.

 

[9xcosette]

Is Ryan from lizardsquad going to be okay?

 

[heartBleed]

Here is a detailed write-up on the identity of the current owner of DoxBin and Scattered Spider member 'Operator'

Spoiler: Dox

=======================================================================================

***Pre-Doxbin Ownership***

Aliases:
• SmokePuppet
• Clark

Telegram Account:
• Username: [https://t.me/SmokePuppet]
• Telegram ID: 6007006083
• Account Creation: Between 2022 & 2023
• Nickname: 'Clark'

On September 15, 2023, Operator joined the well-known Scattered Spider Ransomware Telegram chat: [https://t.me/star] using this account.

=======================================================================================

***The Start of Doxbin***

Aliases:
• MaxRax
• scarcity

First Discord Account:
• Username: MaxRax#8307
• Discord ID: 1117392573082894416
• Email: operator@doxbin.com
• Usage: Created to "scout" the at-the-time Doxbin Discord server.
• **Duration**: Used for a couple of days, kept private to avoid identification.

Second Discord Account:
• Username: driventowards2
• Discord ID: 584493449135259773

Aliases:
• Operator
• DrivenTowards: [https://t.me/driventowards]
• DrivenTowards2: [https://t.me/driventowards2]

=======================================================================================

***Moving on from Doxbin, onto Breachforums***

Alias: ArKaT
Alias: ArKat_001

Details:
• On January 24, 2023, a post was made on the well-known hacking forum https://breached.vc/ mentioning that the **League of Legends** source code was being auctioned.
• The post was uploaded by the user 'ArKaT'.
• User: https://web.archive.org/web/20230125220411/https://breached.vc/User-ArkaT

Links:
• Thread: [Selling League of Legends Source Code Auction]https://web.archive.org/web/2023012...Selling-League-of-Legends-Source-code-Auction

• Telegram: https://t.me/ArkaT_001
• Tree Directory: https://web.archive.org/web/2023012...reached.vc/share/league_src_tree_arka.pdf.zip


Additional Information:
• The Breachforums database was leaked privately by the at-the-time owner Pompompurin months later.
• Pompompurin did not create backups after November 29, 2022**, meaning 'ArKaT' is not in this database.
• It’s likely that ArKaT was an account used by multiple people, though Operator has been confirmed to be one of them.

=======================================================================================

***Operator Purchasing Doxbin for the 2nd Time***

Alias: Decimal

Details:
• Telegram Handles Purchased:
- @yeah
- @Nope
• Purpose: To run with Paula
• Doxbin Purchase Price: $125,000
• Date of Purchase: December 22nd

Middlemen Used:
1. Ritual Middleman: [https://t.me/ritual]
2. Cupid Middleman: [https://t.me/cupid]

=======================================================================================

# Everlynn's dox was removed from the doxbin database under operator's ownership.

# Flexed:
• $15,401,876.70 USD / 73742.58689299357 XMR
• Date: March 18, 2025

Transaction Details:
• TX ID: 530285613d21e582b3d21963b4f5d7f03a4350a9b8b30dfaa0f7c05ad348ae08
• TX Secret: 579570752506a983e2712671014aa2435040ef4b111cb9bd67455ca9e1c2bb02
• Address: 8BjvBLiirRmeVR7PqDKBxvcVgdiHi1xNdbg65Ju6nM3h4PrJLDK9zsfAsYre3gyfPHYfX8r9DfMhcTeWRt3cR8EHKywo9wn
• Proof: https://qu.ax/zDkiM.png

Wallet Info:
• Wallet Type: Feather Wallet

Telegram Info:
• Username: @IlIlIlIIllIIIllIIllIIlI
• Account ID: 7346581580

=======================================================================================

Groups:
1. Team Stokma (Roblox Scripting) ........... (2016 → 2019)

2. Infinity Recursion Team (EDRs/Phishing) .. (2020 → 2021)

3. Lapsus (Phishing/Ransomware) ............. (2021 → 2022)
→ On the 28th of March 2022, he was doxed by white in the Lapsus channel.

4. Scattered Spider (2022/2023 → Current)


Aliases Used:
• Everlynn
• everlynn_xoxo
• everlynn-xoxo
• Ryuzzi
• raiyuwu
• RyumiiHaxz
• HeyItsArbitray
• YaBoiArbitary
• recursionontop
• Miku
• Anitsu
• azmg
• lovedokidoki
• ThalhaJubair
• thalha12321
• robloxexploiterpro
• PerryHaxz
• MaxRax
• scarcity
• Operator
• DriverTowards
• ArKaT
• ArKaT_001
• Decimal
• SmokePuppet
• Evelynn


Pseudonyms Used:
• Misery Blue
• Raiyu Haxwell
• Raiyu Tekanashi


Name: Thalha Jubair
DOB: March 18, 2006

Address:
Flat 18, Berkeley House 14 Wellington Way London E3 4NG
→ Occupants:
• SAMIA AKTER (2005) .................. (2024)
• MASTER THALHA JUBAIR (2007) ......... (2024)
• MASTER T JUBAIR (2007) .............. (2024)
• TAHSHIN RAHMAN (1994) ............... (2024)
• MRS ROKSANA AKTER (1977) ............ (2017 → 2024)
• MR MOHAMMED WAHIDUR RAHMAN (1975) ... (2017 → 2024)
• MISS ASMA A BURALE (1992) ........... (2014 → 2024)
• MR ABRIRASHID R GULAID (196 ....... (2011 → 2019)
• MISS SAMIRA A GULAID (1996) ......... (2017 → 201
• MISS SAMIYA ABDIRASHID GULAID ....... (199 (2014 → 2017)
• MISS FOSIA SAID (1974) .............. (1998 → 2017)

Old Vehicle:
• Make: Volkswagen Golf 7 R
• Plate: ???5 UWN
• Color: White
• Picture: https://qu.ax/ZfyVx.png

IRL Pictures:
https://qu.ax/QrKaE.png (2020)
https://qu.ax/ZfyVx.png (Early 2022)

Phone Numbers:
1. +44 7769 273897
└─ Linked:
• instagram.com
• ebay.com
2. +44 7••• ••4619
3. +44 7••• ••4432
4. +44 7*** ****30

Mobile Device:
Profile: https://iosgods.com/profile/1072746-thalha12321/
• Date: September 14, 2018
• Model: iPhone 5s
• iOS Version: 11.2.1
• Jailbroken: Yes
• Rooted: No

=======================================================================================

Telegram Accounts:

1. https://t.me/IlIlIlIIllIIIllIIllIIlI
• ID: 7346581580
Relevance: Most recent

2. https://t.me/yeah
• ID: 1525876576
Relevance: Deleted

3. https://t.me/SmokePuppet
• ID: 6007006083
Relevance: Scattered Spider related

4. https://t.me/DrivenTowards
• ID: 6118340447
Relevance: Old/first Doxbin telegram

5. https://t.me/DrivenTowards2
Relevance: Old main Doxbin telegram

6. https://t.me/oppywoppy69
• ID: 6918956227
Relevance: Inactive

7. https://t.me/zzaustin
• ID: 7005734829
Relevance: Deleted

8. https://t.me/zzzaustin
Relevance: Deleted

9. https://t.me/jfjgicjdks
• ID: 6907192868
Relevance: Deleted

10. https://t.me/ArkaT_001
• ID: 5531029826
Relevance: Scattered Spider LoL source code sale

11. https://t.me/everlynn_uwu
• ID: 5078961962
Relevance: Recursion.team
@lolol226 (Mar 28, 2022)

12. https://t.me/raiyu_xd2
• ID: 1992283110
Relevance: Recursion.team / Lapsus
1. 20/01/22 22:10:10 Eliza Akeno
2. 29/12/21 19:31:29 Daniel Lightwood
3. 12/12/21 22:14:34 Xavier Evans
4. 18/11/21 21:33:40 John derald
Old Users:
1. 31/12/21 17:24:33 @forgiven
2. 12/12/21 22:14:34 @xavierxoxo
3. 18/11/21 21:33:40 @EngineOwning

13. https://t.me/dormantcookies
• ID: 5318842389
Relevance: LAPSUS$ (Oct 11, 2022)
@Lapsussaudechat


Old Discord: driventowards2
• ID: 584493449135259773

Account Email History:
1. ja.ylen.wi.lkerso.n.23.5@googlemail.com / jaylenwilkerson235@gmail.com
2. fantasticsleep38@proton.me
3. morarejudeev@outlook.com
4. bkchppk456@tormails.com
5. anna.hanna@opoczta.pl


Old Discord: MaxRax#8307
• ID: 1117392573082894416

https://namemc.com/profile/xx.1

https://namemc.com/profile/Mojangsta.2

https://namemc.com/profile/Wealthy.3

https://www.roblox.com/users/5381489472/profile

https://steamcommunity.com/profiles/76561199560091148

E.PN Card Details:
Account Email: operator@doxbin.com

Card Number: 4288520009995798
Expiry: 03/27
CVV: 302
Name: Retha Dach
Address: 99797 Armando Circle, Trenton, NJ 08601

Old Card Number: 48655501****4700
Created: 04:45PM 1.10.2024

Old Card Number: 48655501****9529
Created: 11:30AM 1.4.2024

Notable Purchases:
Cloud Storage (pcloud.com)
Date: 03.04.2024
Time: 17:01
Card: Universal 1.10.2024, 04:45PM 48655501****4700
Charge: $150.00 & $399.00

Cloud Storage (pcloud.com)
Date: 09.02.2024
Time: 20:11
Card: Universal 1.10.2024, 04:45PM 48655501****4700
Charge: $1,445.99

Cloud Storage (pcloud.com)
Date: 04.01.2024
Time: 22:26
Card: Universal 1.4.2024, 11:30PM 48655501****9529
Charge: $190.20 & $252.33

Cloud storage was purchased via https://pcloud.com/ on January 4th, February 9th, and April 3rd. Most likely for ransomware-related purchases.


Domains:
https://perryhaxz.moe/
→ https://app.any.run/tasks/2c2ac604-0f77-48eb-b7cd-e9678f500fe3/

https://recursion.team/

https://zenno.club/discussion/members/lovedokidoki.64063/#recent-content
→ Registered: Apr 2, 2021
# Is trying to purchase a captcha solver for amazon/aws

https://web.archive.org/web/20220125084825/https://solo.to/megumin

https://web.archive.org/web/20200415001401/https://lewd.cat/

https://web.archive.org/web/20220316064101/https://lewd.cat/

-> https://web.archive.org/web/20230127153020/https://solo.to/megumin
-> https://open.spotify.com/user/♫
-> https://www.tiktok.com/@raiyuwu
-> https://www.snapchat.com/add/slim
-> https://namemc.com/profile/750.2
-> https://lewd.cat/

https://instagram.com/raiyuwu
→ Is followed by: https://instagram.com/oxf_arion
→ oxf = oxfordshire, arion = arion kurtaj aka white/breachbase

https://steamcommunity.com/id/raiyuwu/

→ Has Recursion member "Loric" added: https://steamcommunity.com/id/loricc/
Bio:
→ Hi there!
My name is Raiyu and I like anime and playing games, programming and more!
Name: Raiyu Tekanashi
Country: United Kingdom
Age: 16
PC Specs:
CPU: Intel Core i5-10300H
RAM: 8GB DDR4 @ 2933 MHz
SSD: 512GB
GPU: Nvidia Geforce GTX 1660 Ti


YouTube:
- https://www.youtube.com/channel/UCKDJkI--S869yufrNlb7qpg

iOS Gods:
- https://iosgods.com/profile/1072746-thalha12321/

CrackingPro:
- https://www.crackingpro.com/profile/90590-thalha12321/

HTDark:
- https://htdark.com/index.php?members/thalha12321.24794/

Wattpad:
- https://www.wattpad.com/user/Ryuzzi
- https://www.wattpad.com/user/RyumiiHaxz

Instagram:
- https://www.instagram.com/robloxexploiterpro
- https://www.instagram.com/yaboiarbitary

Reddit:
- https://www.reddit.com/user/RobloxExploiterPro/

Kik:
- https://kik.me/robloxexploiterpro

Pastebin:
- https://pastebin.com/u/robloxexploiterpro

Twitch:
- https://www.twitch.tv/robloxexploiterpro/

Spotify:
- https://open.spotify.com/user/robloxexploiterpro

IFTTT:
- https://ifttt.com/p/robloxexploiterpro

Quora:
- https://www.quora.com/profile/YaBoiArbitary

Snapchat:
- https://www.snapchat.com/add/yaboiarbitary

YouTube:
- https://www.youtube.com/@yaboiarbitary5853/videos

Quizlet:
- https://quizlet.com/user/PerryHaxz/sets

Roblox:
- https://www.roblox.com/users/977026555/profile

Replit:
- https://replit.com/@PerryHaxz

Doxbin:
- https://doxbin.org/user/NyannersDoxxed
→ https://t.me/everlynn_xoxo

- https://doxbin.com/user/azmg
→ Created: Sep 21, 2020
→ Email: canaryworks@protonmail.com

- https://doxbin.com/user/decimal


OGUsers:
- https://ogusers.com/azmg
→ Created: August 8, 2020
→ Email: azmg@tuta.io
→ IPs:
→ Last: 89.45.90.234
→ Reg: 89.45.90.240

RaidForums:
- https://raidforums.com/user-azmg
→ Last Activity: August 9, 2020 (updated PFP)
→ Email: azmg@tuta.io
→ Description:
→ Website: https://doxbin.org
→ Discord: azmg#6666

RaidForums:
- https://raidforums.com/user-everlynn_uwu
→ ID: 99349
→ Registered: March 30, 2021
→ Last Visit: April 02, 2021
→ Thread: https://rf-archive.com/thread.php?tid=130911&fid=12



=======================================================================================

Email:
- ryumii@email.com

Registered Websites:
- unity
- activision.com
- callofduty.com
- eventbrite.com
- apple.com (DOB is not 03/18/2006)
- dhgate.com
- twitter.com
- digitalocean.com

PayPal:
- paypal.com
→ Phone Number: +44 7769 273897
→ Email: canaryworks@protonmail.com

GitHub:
- https://github.com/throwaway1119

eBay:
- https://www.ebay.com/usr/thajub_78
→ Phone Number: +44 7769 273897
→ Created: March 29, 2020
→ Location: UK
→ Feedbacks: 1

--------------------------------------

Email:
- megumin@outlook.my

GAIA ID:
- 109640356377309337997

Associated Websites:
- grammarly
- codeacademy
- github
- nvidia
- gumtree
- adobe

Skype:
- live:.cid.b5f2dcc56f880afc (Megumin Sensei)

PayPal:
- paypal.com
→ Phone Number: +447 *** 4619
→ Email: megumin@outlook.my
→ Account Number: 2265********3191

GitHub:
- https://github.com/PvP

Duolingo:
- https://www.duolingo.com/profile/Raiyu5
→ Name: Raiyu Tekanashi ツ
→ Username: Raiyu5
→ Created: April 11, 2022 20:56 PM +02:00
→ Learning: Spanish (ES) from English (EN)
→ Motivation: School
→ Total XP: 1017 (Spanish: 946 XP, Japanese: 71 XP)

-----------------------------------------------------

Email:
- everlynn_xoxo@protonmail.com
→ PGP Created: April 8, 2021 00:32:38
→ Associated Websites:
- ea.com
- github.com
- freelancer.com
- https://github.com/everlynn-xoxo
→ ShitExpress IP: 18.130.196.252

-----------------------------------------

Email:
- everlynn_uwu@protonmail.com
→ PGP Created: March 27, 2021 22:35:27
→ Associated Website:
- https://github.com/recursionontop

-----------------------------------------

Email:
- canaryworks@protonmail.com
→ PGP Created: June 30, 2020 15:42:32

-----------------------------------------

Email:
- azmg@tuta.io
→ Associated Websites:
- wix.com
- twitter.com
- beatstars.com: aimg2085
- https://raidforums.com/uer-azmg
- https://ogusers.com/azmg
- https://doxbin.com/user/azmg

-----------------------------------------

Email:
- thalha12321@gmail.com
→ GAIA ID: 103111516906761752731
→ Associated Websites:
- paypal
- pokemon
- instagram
- digitalocean
- cprewritten
- dropbox: "Gamer Boyzz"
→ Trello: https://trello.com/u/talha69

-----------------------------------------

Email:
- robloxexploiterpro@gmail.com
→ Recovery: ••••• ••••32
→ PFP: Roblox: Thalha12321
→ GAIA ID: 114530644860992225540

Websites:
- disqus
- spotify
- activision
- pokemon
- callofduty
- mygames
- facebook
- github
- nvidia
- codeacademy
- replit
- ashampoo
- digitalocean
- grammarly
- adobe
- cracked.to: "Talha101"
- dropbox: "Gamer Boyzz"

Links:
- Replit: https://replit.com/@robloxexploiter
- GitHub: https://github.com/PerryHaxz
- eBay: https://www.ebay.com/usr/talhjubai0
→ Number: 7*******30
→ Created: 11 March, 2017

---------------------------------------------

Email:
- robloxexploiterpro2@gmail.com
→ Recovery: ••••• ••••32
→ GAIA ID: 108962287048449492799

Websites:
- deliveroo
- edx
- spotify.com
- callofduty.com
- bethesda
- vrchat
- ea
- replit
- nvidia
- no-ip
- github
- pinterest
- redhat
- grammarly
- digitalocean

Links:
- GitHub: https://github.com/YaBoiArbitary
- Replit: https://replit.com/@PerryHaxz
- Quora: https://www.quora.com//profile/YaBoiArbitary

Accounts:
- Dropbox: "YaBoiArbitary"
- Aliexpress: "ThalhaJubair"
- Blackhatprotool: "123asd"

----------------------------------------------------

Email:
- robloxexploiterpro3@gmail.com
→ Recovery: robloxexploiterpro2@gmail.com, 7769 273897
→ GAIA ID: 107405572476900323073

Websites:
- spotify
- activision
- callofduty
- steam
- nvidia
- github
- deviantart
- digitalocean
- wattpad: "RyumiiHaxz"
- paypal: +44 7••• ••4432‬
- codeacademy
- microsoft

Microsoft Info:
- Name: aewsdfg sdfsdf

Links:
- Quora: https://www.quora.com//profile/Team-Stokma
- GitHub: https://github.com/Ryumii123

---------------------------------------------------

Email:
- robloxexploiterpro4@gmail.com
→ GAIA ID: 113333662010519800932

Websites:
- activision
- callofduty
- steam
- nvidia
- weleakinfo
- dropbox: "lol asd"
- microsoft

Microsoft Info:
- Name: iiHaxRBLX asd

---------------------------------------------------

Email:
- robloxexploiterpro5@gmail.com
→ Recovery: ••••• ••••32, 7769 273897
→ GAIA ID: 105377325509933059978

Websites:
- vimeo
- spotify
- digitalocean
- codeacademy
- fitbit: Name: A P., ID: 3MP6LH

Links:
- Quora: https://www.quora.com//profile/Asd-Asd-1531



Common Passwords:
- roksana12
- Roksana12
- Roksana12!


=======================================================================================

IP Address: 2.124.220.158
- Type: Home
- Location:
- City: Ilford
- Region: England
- Country: GB
- ISP: sky.uk

IP Address: 207.148.8.127

proxy scrapes:
{"acceptlanguage": "en-US,en;q=0.9", "block_reason": "This payment method is currently unavailable.", "created": 1609035458, "email": "ryumii@email.com", "ga_clientid": "1941111413.1609035421", "gateway": "paddle", "id": "aa1e846c-a9d0-42ae-8195-2c8e5d284e9c", "ip": "5.180.221.80", "maxips": 5, "months": 1, "price": 20, "pricing": {"1": 4, "10": 30, "20": 45, "2_5": 9, "30": 60, "40": 75, "5": 17, "7_5": 24}, "proxies": 1, "refferal": "head", "riskscore": 99, "status": "blocked", "type": "new", "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36"},

{"acceptlanguage": "en-US,en;q=0.9", "block_reason": "This payment method is currently unavailable.", "created": 1609035457, "email": "ryumii@email.com", "ga_clientid": "1941111413.1609035421", "gateway": "paddle", "id": "959e05af-1da5-4714-9563-f8bdd389c5f2", "ip": "5.180.221.80", "maxips": 5, "months": 1, "price": 20, "pricing": {"1": 4, "10": 30, "20": 45, "2_5": 9, "30": 60, "40": 75, "5": 17, "7_5": 24}, "proxies": 1, "refferal": "head", "riskscore": 99, "status": "blocked", "type": "new", "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36"},

{"acceptlanguage": "en-US,en;q=0.9", "created": 1609035462, "email": "ryumii@email.com", "ga_clientid": "1941111413.1609035421", "gateway": "alipay_cn", "id": "2e5783a7-67b8-4a55-9036-c5e14de76fb2", "ip": "5.180.221.80", "maxips": 5, "months": 1, "notify_sig": "4da17a16c3bc1bed28fb342d10e4db2b", "price": 20, "pricing": {"1": 4, "10": 30, "20": 45, "2_5": 9, "30": 60, "40": 75, "5": 17, "7_5": 24}, "proxies": 1, "refferal": "head", "riskscore": 99, "status": "expired", "type": "new", "updated": 1609039068, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36"},

18.130.196.252
- shitexpres logs to vtuber nyanners (paste is in the db posted by everlynn)
- arions/white/breachbase intelx ip log - https://intelx.io/?did=592495b2-c2ff-417d-a6b9-9b499ae44c4c

2021-05-06 22:53:12,sso,info,69dbacd8-fa37-4520-be00-3747b5db7722,18.130.196.252,GB,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '61d46049-7ed2-4d33-953f-5c1e083747f0'

Same UA & some IPs matching the IntelX account that was banned by the CEO for being owned by Lapsus$

2021-05-02 21:09:53,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,18.206.83.168,US,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session 'ba05aca0-07b1-4a1e-8298-3f88f4659c86'

2021-05-03 18:13:49,sso,info,69dbacd8-fa37-4520-be00-3747b5db7722,18.206.83.168,US,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '67441c6d-15f8-4dae-925d-bf5738111a4e'

2021-05-06 20:40:25,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,63.32.110.120,IE,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '3dc369ea-ee47-4978-85b9-da4e2bf6bdde'

2021-05-06 20:40:25,sso,info,69dbacd8-fa37-4520-be00-3747b5db7722,63.32.110.120,IE,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '711653a0-e12c-4f26-9196-eb1e407e755c'

2021-05-06 22:52:36,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,18.130.196.252,GB,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session 'ab6004ca-9ec6-4315-8f98-71d78b670750'

2021-05-06 22:53:12,sso,info,69dbacd8-fa37-4520-be00-3747b5db7722,18.130.196.252,GB,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '61d46049-7ed2-4d33-953f-5c1e083747f0'

2021-05-07 16:43:17,login,warning,69dbacd8-fa37-4520-be00-3747b5db7722,63.32.110.120,IE,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' invalid password

2021-05-07 16:44:02,login,warning,69dbacd8-fa37-4520-be00-3747b5db7722,63.32.110.120,IE,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' invalid password

2021-05-07 16:45:52,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,63.32.110.120,IE,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '6785356a-8656-41e6-a24d-aa588cfe0089'

2021-05-07 22:24:14,login,warning,69dbacd8-fa37-4520-be00-3747b5db7722,79.79.211.161,GB,TalkTalk,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' invalid password

2021-05-08 16:22:13,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,18.130.196.252,GB,Amazon.com,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '96b52219-da1e-4c00-9449-0fd60237cf61'

2021-05-08 16:34:47,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '3f3f2faf-6c4e-4500-bc7d-1b6203d318d1'

2021-05-08 16:34:47,sso,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '7e407253-4f9f-4eb9-91b2-c9d55cc3bce0'

2021-05-08 17:07:27,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,154.17.93.65,US,Altus Communications,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session 'cd3e3161-a8b0-4f63-ae6c-cd7be7a84ec1'

2021-05-19 21:51:55,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '1ca27a36-bcf7-4107-9fa7-4e148824494d'

2021-05-19 21:53:01,sso,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session 'f771835f-b6db-4702-93b0-b3dc4cd9fdc5'

2021-05-24 20:10:35,login,warning,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' invalid password

2021-05-24 20:10:45,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session '9c6580b6-9e5e-4188-a66d-db25b0fd5356'

2021-05-26 22:22:50,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session 'fb0e1d77-f175-45a7-90bc-f5b792f37665'

2021-05-28 23:21:23,login,info,69dbacd8-fa37-4520-be00-3747b5db7722,185.56.83.15,SC,,Windows 10,Chrome,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",Username 'admin@leaks.direct' session 'b654bf11-985b-413a-9fe4-b76468ea4652'

Unique IPs from ^:
154.17.93.65
18.130.196.252
18.206.83.168
185.56.83.15
63.32.110.120
79.79.211.161

recursion.team

https://web.archive.org/web/20210411081515/https://recursion.team/

Zero Two - https://t.me/Issenpai
Peter - https://t.me/pornpeternew (white/breachbase)
Purge - https://t.me/notpurge
Jihadi John - https://t.me/yaekithretardedxd ID: 1463774425
Sipher - https://://t.me/Sipher
Emiraldo - https://t.me/EMIRELADERO
Loric - https://t.me/LORlC (#ESM Founder Loric)
Uni - NA
ToString - https://t.me/tostring_uwu