Back in April, I posted about the RaidForums website – a notorious marketplace for criminals to purchase stolen data, hacking tools, and pornographic material.
I appears that the entire contents of the RaidForums database has itself now been leaked online via the newly formed website exposed.vc
The database is purported to hold the details of nearly 480,000 users, although the exposed.vc post does say that some users details have been removed. I suspect this is to hide the data of exposed.vc admins, and allies.
375MB of data
One user of the forum has already downloaded the data dump and has confirmed that the information is legitimate and that is appears to be the complete database of the RaidForums from around 2020/2021 – Roughly the same time as the FBI Operation which closed the site for good.
This date has caused a number of people to suspect that this leak has actually come from the FBI themselves and that exposed.vc is actually a honeypot set up to try to identify those who download stolen data as part of their ongoing investigations into such crimes.
Real or not?
A search of the exposed.vc HTML source code reveals the site uses a Google ADsense ID
Searching for this ID via dnslytics.com returns data which shows the same ID being used in 3 other domains:
- crackersbay.com
- dataforums.in
- vabenemium.com
These sites are all in some way related to online criminal activity:
crackersbay.com was registered as a domain on the 28th June 2021 via the domain registrar epik.com
epik is a registrar based in Spokane, Washington and touts itself as the “Swiss bank of Domain” for their long-standing reputation for protecting the registrant.
dataforums.in was registered as a domain on the 10th April 2023 via the domain registrar porkbun.com.
porkbun is a registrar based in Sherwood, Oregon who also offer free WHOIS privacy for registrants.
The dataforums domain redirects to flamebin.xyz which, at the time of writing was currently not accessible.
vabenemium.com was registered as a domain on the 20th December 2022 via the domain registrar hostinger.com
The website is written in Polish, and is dedicated to the sharing of cracked and stolen account for games and media such as Netflix, Kodi, Origin, Steam, and Playstation.
The domain registrar is based in Lithuania but also has an office in Cyprus.
