graph TD
A[初始化] --> B[配置爬虫参数]
B --> C[启动爬虫]
C --> D[访问 web 站点]
D --> E[解析网页数据]
E --> F{"是否成功?"}
F -->|"成功"| G[抽取用户名]
G --> H[存储数据]
F -->|"失败"| I[记录错误并重试]
I --> J[重试次数控制]
J -->|"达到重试上限"| K[退出]
J -->|"继续重试"| D
A collection & lists of intel and usernames scraped from various cybercrime sources & forums. DarkForums, HackForums, Patched, Cracked, BreachForums, OGUser, XSS, Dread, & more
CTI Stuffs - Threat Actor Usernames Scraped Edition
A collection of CTI stuffs and various intel 📃
I was inspired to make this because corpo threat intel companies are straight up absurd and charge 5-6 figures a year just to access this same type of data. I aint paying for that shit and oftentimes those of us in CTI cant get the needed budget approved for the tools we need/want so here we are. This is an ever changing and evolving repo that should (in theory) be updated oftenish so that it has fresh data.
If you have any neat fresh data or intel to add, submit a PR and throw it up baw.
It’s easy to forget what intelligence consists of: luck and speculation. Here and there a windfall, here and there a scoop — John le Carré
If you are a researcher or cybercriminal who found your username in these lists, you should enable in the forum Settings to hide yourself when online and/or disable your acct from displaying in the Who’s Online sections publicly. If you make posts on the forum, well no way to hide from that. Just make sure you use a username that is non-attributed to your other monikers or self. Also make sure to VPN and proxy up because you know law enforcement be getting their hands on these forums raw databases. Tons of nerds (like me) be scraping weird stuffs like this.
Other uses for these lists:
combine all the usernames together to use as an interesting password list
enrich existing intel
pick a random username from these lists and adopt it for yourself on another forum or platform to mask yourself a bit and to confuse some researchers or law enforcement
use the data to send PM spam on the forums
do some cool nerd data science things
track a threat actor username across multiple forums to see which ones they are on
The forum came back online after its take down in April and the arrests of IntelBroker and other members. This is a list of usernames found and scraped from the new remix’d version. Scraped from the “Who’s Online” section of the forum. Is it a fed psyop honeypot or an actual revival? Time will tell, but for now, we be scraping em.
Date Range of scrape: July 26 2025 --> Aug 11 2025 - forum went down and its been alleged it was a fed honeypot the entire time. after this came out, it went offline shortly after to never return.
A forum that recently was created from the ashes of Breached going down. Admins are Rey from the Hellcat ransomware group and a few other threat actors from the breached/RaaS/db leaker scene.
Usernames scraped from Leakbase - this site has been around a while and has went thru a few different domain TLDs. It’s basically where threat actors can go and leak dbs and info or DL them.
Usernames gathered from the Who’s Online section, chatbox, and posted threads.
Date Range of scrape: August 22 2025 --> March 4 2026. Forum taken down and seized by law enforcement.
Usernames that have been scraped from HackForums. The skiddiest of skid forums. The pipeline from kids stumbling upon HF and then after a few years becoming SIM Swapper or com kids is kinda high tho.
Usernames gathered from posted threads and the Who’s Online section at the bottom of the forum.
Date Range of scrape: August 25 2025 --> current date
OGU/OGUsers forum has been around for a good lil while. Mainly associated with selling ‘og’ usernames like if you wanted to buy the handle @poop on Instagram or etc.
The usernames in this list are scraped from posted threads and users that reply within threads.
Date Range of scrape: October 7 2025 --> current date
This forum has been around forever (decades). Basically a bunch of nerds talking about how to make money online via spam, seo, affiliate marketing, social media, blah blah blah.
The usernames in this list are scraped from posted threads and users who add replies.
Date Range of scrape: October 9 2025 --> current date
Russians gunna Russian. This forum is pretty og in the scene. They be talking about Программирование Разработка, Malware, Мошенничество, and Уязвимости. Used to have the domain xss[.]is until July 2025 when LE seized their stuffs and arrested 1 nerd (toha aka admin) in Ukraine over it. As always, LE takedowns are largely ineffective and the forum simply just popped back up a few days later on a new TLD.
The usernames in this list are scraped from posted threads and users who respond in them.
Date Range of scrape: December 25 2025 --> current date
The infamous Dread. Ran by HugBunter. Mainly a darknet market (DNM) forum that grew out of when the reddit admins did a ban wave of all the DNM subs several years ago. Content includes buying and selling drugs, carding, social engineering, hacking, and all kinda fraud and sus stuffs. Honestly its a wild place but Hug seems like a really interesting fella.
The usernames in this list are scraped from posted threads and users who respond in them.
Date Range of scrape: December 27 2025 --> current date
Following the shutdown/raid of XSS top admin, ex-moderator Rehub launched RehubCom. A primarily RU language forum.
The usernames in this list are scraped from posted threads, users who respond in them, users who show up in the Members Online or Latest member section.
Date Range of scrape: January 13 2026 --> current date
Scraped from posted threads, replies, and Who’s Online sections.
Date Range of scrape: June 06 2026 --> current date
Amount: 164
Greetz 💌
All the CTI nerds out there scraping intel stuffs and who are in the trenches, dc225, chill intel companies that dont charge people 6-7 figures a year to access intel, sp, rj2, neQx, jt, smurda, jekz, MoB, sikez, and Cybersecurity Stickers
If you know of any cybersec researchers or CTI nerds who might find this data interesting, share it w em <3
评论