A collection of CTI stuffs and various intel 📃
I was inspired to make this because corpo threat intel companies are straight up absurd and charge 5-6 figures a year just to access this same type of data. I aint paying for that shit and oftentimes those of us in CTI cant get the needed budget approved for the tools we need/want so here we are. This is an ever changing and evolving repo that should (in theory) be updated oftenish so that it has fresh data.
Feed this data into your TIP.
If you have any neat fresh data or intel to add, submit a PR and throw it up baw.
It's easy to forget what intelligence consists of: luck and speculation. Here and there a windfall, here and there a scoop — John le Carré
If you are a researcher or cybercriminal who found your username in these lists, you should enable in the forum Settings to hide yourself when online and/or disable your acct from displaying in the Who's Online sections publicly. If you make posts on the forum, well no way to hide from that. Just make sure you use a username that is non-attributed to your other monikers or self. Also make sure to VPN and proxy up because you know law enforcement be getting their hands on these forums raw databases. Tons of nerds (like me) be scraping weird stuffs like this.
Other uses for these lists:
- combine all the usernames together to use as an interesting password list
- enrich existing intel
- pick a random username from these lists and adopt it for yourself on another forum or platform to mask yourself a bit and to confuse some researchers/LE
- use the data to send PM spam on the forums
- do some cool nerd data science things
Usernames scraped from various cybercrime forums.
Forums scraped from
- BreachForums.st (rip)
- BreachForums.hn (rip)
- NoHide.io (rip)
- Altenen.is
- ASCarding.net
- BreachForums.bf (lol)
- BlackHatWorld.com
- Breachstars.io
- Cracked.sh
- DarknetArmy.io
- DarkForums.me
- Dread
- HackForums.net
- Leakbase.la
- OGUser.com/OGU
- Patched.to
- RehubCom
- Umbra.by
- XSS.pro
| Metric | Count |
|---|---|
| Total usernames | 464,041 |
| Total unique usernames | 383,117 |
| Total duplicate usernames | 26,331 |
Last updated: January 29, 2025*
*total usernames is updated frequently. unique and dupe is monthly
These are forums that went offline since being scraped.
dead_forum_users_breachforums_st.txt
A list of usernames scraped from the popular cybercrime and hacking forum BreachForums. Scraped from the "Who's Online" section of the forum.
Date Range of scrape: March 2025 --> April 15 2025 12:52 am - BreachForums went down on this date (RIP)
Amount: 57,468 unique usernames
dead_forum_users_breached_hn.txt
The forum came back online after its take down in April and the arrests of IntelBroker and other members. This is a list of usernames found and scraped from the new remix'd version. Scraped from the "Who's Online" section of the forum. Is it a fed psyop honeypot or an actual revival? Time will tell, but for now, we be scraping em.
Date Range of scrape: July 26 2025 --> Aug 11 2025 - forum went down and its been alleged it was a fed honeypot the entire time. after this came out, it went offline shortly after to never return.
Amount: 6,537 unique usernames
dead_forum_users_nohide_io.txt
It was small hacking/carding forum.
The usernames in this list are scraped from posted threads.
Date Range of scrape: December 14 2025 --> Dec 31 2025
Amount: 138
Usernames scraped from the newly launched post-takedown Cracked hacking forum.
Date Range of scrape: May 27 2025 --> current date
Amount: 139,117 unique usernames
Usernames scraped from DarkForums.
Old urls: DarkForums.io
Date Range of scrape: June 1 2025 --> current date
Amount: 58,744 unique usernames
Usernames scraped from Leakbase - this site has been around a while and has went thru a few different domain TLDs. It's basically where threat actors can go and leak dbs and info or DL them.
Usernames gathered from the Who's Online section, chatbox, and posted threads.
Date Range of scrape: August 22 2025 --> current date
Amount: 9,697 unique usernames
Usernames that have been scraped from the Patched forum - its some basic run of the mill skid forum.
These usernames are gathered from posted threads.
Old url(s): Patched.sh
Date Range of scrape: August 23 2025 --> current date
Amount: 25,169
Usernames that have been scraped from HackForums. The skiddiest of skid forums. The pipeline from kids stumbling upon HF and then after a few years becoming SIM Swapper or com kids is kinda high tho.
Usernames gathered from posted threads and the Who's Online section at the bottom of the forum.
Date Range of scrape: August 25 2025 --> current date
Amount: 55,222
A forum that recently was created from the ashes of Breached going down. Admins are Rey from the Hellcat ransomware group and a few other threat actors from the breached/RaaS/db leaker scene.
Previous domains include: BreachSta.rs, Bstars.st, breachstars.st, breachstars.hn
The usernames in this list are scraped from posted threads.
Date Range of scrape: September 9 2025 --> current date
Amount: 733
OGU/OGUsers forum has been around for a good lil while. Mainly associated with selling 'og' usernames like if you wanted to buy the handle @poop on Instagram or etc.
The usernames in this list are scraped from posted threads and users that reply within threads.
Date Range of scrape: October 7 2025 --> current date
Amount: 6,339
This forum has been around forever (decades). Basically a bunch of nerds talking about how to make money online via spam, seo, affiliate marketing, social media, blah blah blah.
The usernames in this list are scraped from posted threads and users who add replies.
Date Range of scrape: October 9 2025 --> current date
Amount: 22,970
A forum for leaks, carding, spam, and more.
The usernames in this list are scraped from posted threads and users who respond in them.
Date Range of scrape: December 14 2025 --> current date
Amount: 22,657
forum_users_breachforumsBF.txt
Sigh...BF number #32423423. How long will this one last? Likely not long but until then, we be scraping it.
The usernames in this list are scraped from posted threads and users who respond in them.
old tlds: BreachForums.jp
Date Range of scrape: December 18 2025 --> current date
Amount: 30,585
Russians gunna Russian. This forum is pretty og in the scene. They be talking about Программирование Разработка, Malware, Мошенничество, and Уязвимости. Used to have the domain xss[.]is until July 2025 when LE seized their stuffs and arrested 1 nerd (toha aka admin) in Ukraine over it. As always, LE takedowns are largely ineffective and the forum simply just popped back up a few days later on a new TLD.
The usernames in this list are scraped from posted threads and users who respond in them.
Date Range of scrape: December 25 2025 --> current date
Amount: 2,644
The infamous Dread. Ran by HugBunter. Mainly a darknet market (DNM) forum that grew out of when the reddit admins did a ban wave of all the DNM subs several years ago. Content includes buying and selling drugs, carding, social engineering, hacking, and all kinda fraud and sus stuffs. Honestly its a wild place but Hug seems like a really interesting fella.
The usernames in this list are scraped from posted threads and users who respond in them.
Date Range of scrape: December 27 2025 --> current date
Amount: 9,485
The usernames in this list are scraped from posted threads and users who respond in them.
Date Range of scrape: January 03 2025 --> current date
Amount: 245
Following the shutdown/raid of XSS top admin, ex-moderator Rehub launched RehubCom. A primarily RU language forum.
The usernames in this list are scraped from posted threads, users who respond in them, users who show up in the Members Online or Latest member section.
Date Range of scrape: January 13 2026 --> current date
Amount: 1,349
A financial fraud and carding forum. These people be stealing yo grandmas credit card or frauding her retirement funds.
The usernames in this list are scraped from posted threads.
Date Range of scrape: February 5 2026 --> current date
Amount: 2,280
Another financial fraud and carding forum and also has some hacking sections.
The usernames in this list are scraped from posted threads and Who's Online.
Date Range of scrape: February 7 2026 --> current date
Amount: 17,270
All the CTI nerds out there scraping intel stuffs and who are in the trenches, dc225, chill intel companies that dont charge people 6-7 figures a year to access intel, sp, rj2, neQx, jt, smurda, jekz, MoB, sikez, and Cybersecurity Stickers
If you know of any cybersec researchers or CTI nerds who might find this data interesting, share it w em <3