{"id":29746627,"url":"https://github.com/spmedia/cti-stuffs","last_synced_at":"2025-07-26T07:17:09.837Z","repository":{"id":287495216,"uuid":"948283347","full_name":"spmedia/CTI-Stuffs","owner":"spmedia","description":"A collection of CTI stuffs - intel scraped from various cybercrime sources \u0026 forums","archived":false,"fork":false,"pushed_at":"2025-07-22T18:59:17.000Z","size":1217,"stargazers_count":8,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-07-22T20:38:03.139Z","etag":null,"topics":["cti","cybersecurity","cyberthreatintelligence","cyberthreats","osint","osint-reconnaissance","scraping","scraping-websites","threat-hunting","threat-intelligence","threatintel","threatintel-feeds","threatintelligence","usernames"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/spmedia.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-03-14T03:50:33.000Z","updated_at":"2025-07-22T18:59:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"204a8739-b07a-4631-ac9a-697368516422","html_url":"https://github.com/spmedia/CTI-Stuffs","commit_stats":null,"previous_names":["spmedia/cti-stuffs"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/spmedia/CTI-Stuffs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FCTI-Stuffs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FCTI-Stuffs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FCTI-Stuffs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FCTI-Stuffs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/spmedia","download_url":"https://codeload.github.com/spmedia/CTI-Stuffs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FCTI-Stuffs/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267133958,"owners_count":24040789,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-26T02:00:08.937Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cti","cybersecurity","cyberthreatintelligence","cyberthreats","osint","osint-reconnaissance","scraping","scraping-websites","threat-hunting","threat-intelligence","threatintel","threatintel-feeds","threatintelligence","usernames"],"created_at":"2025-07-26T07:17:04.891Z","updated_at":"2025-07-26T07:17:09.828Z","avatar_url":"https://github.com/spmedia.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# CTI Stuffs\n\n![CTI nerds vs threat actors](https://i.imgur.com/SP93Ph5.png)\n\nA collection of CTI stuffs and various intel 📃 \n\nI was inspired to make this because corpo intel companies are straight up absurd and charge 5-6 figures a year just to access this same type of data. I aint paying for that shit and oftentimes those of us in CTI cant get the needed budget approved for the tools we need/want so here we are. This is an ever changing and evolving repo that should (in theory) be updated oftenish so that it has fresh data.\n\nIf you have any neat fresh data/intel to add, submit a PR and throw it up baw.\n\n\u003e It's easy to forget what intelligence consists of: luck and speculation. Here and there a windfall, here and there a scoop -- *John le Carré*\n\nIf you are a researcher or cybercriminal who found your username in these lists, you should enable in the forum Settings to hide yourself when online and/or disable your acct from displaying in the Who's Online sections publicly. Tons of nerds (like me) be scraping weird stuffs like this. \n\n# Scraped Forums 📃\n\n---\n\n## BreachForums.st (rip)\n\n**[forum_users.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users.txt)**\n\nA list of usernames scraped from the popular cybercrime and hacking forum BreachForums. Scraped from the \"Who's Online\" section of the forum.\n\n**Date Range of scrape:** March 2025 --\u003e April 15 2025 12:52 am - BreachForums went down this morning (**RIP**)\n\n**Amount:** 57,468 unique usernames\n\n---\n\n## BreachForums.hn\n\n**[forum_users_breached_hn.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users_breached_hn.txt)**\n\nThe forum came back online after its take down in April and the arrests of IntelBroker and other members. This is a list of usernames found and scraped from the new remix'd version. Scraped from the \"Who's Online\" section of the forum. Is it a fed psyop honeypot or an actual revival? Time will tell, but for now, we be scraping em. \n\n**Date Range of scrape:** July 26 2025 --\u003e current date\n\n**Amount:** 15 unique usernames\n\n---\n\n## Cracked.sh\n\n**[forum_users_cracked.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users_cracked.txt)**\n\nUsernames scraped from the newly launched post-takedown Cracked.sh hacking forum.\n\n**Date Range of scrape:** May 27 2025 --\u003e current date\n\n**Amount:** 25,463 unique usernames\n\n---\n\n## DarkForums.st\n\n**[forum_users_darkforums.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users_darkforums.txt)**\n\nUsernames scraped from DarkForums\n\n**Date Range of scrape:** June 1 2025 --\u003e current date\n\n**Amount:** 16,728 unique usernames\n\n----\n\n# Greetz 💌\n\nAll the CTI nerds out there scraping stuffs and who are in the trenches, [dc225](https://defcon225.org/), sp, rj2, and [Cybersecurity Stickers](https://cybersecuritystickers.com/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspmedia%2Fcti-stuffs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspmedia%2Fcti-stuffs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspmedia%2Fcti-stuffs/lists"}