{"id":31576144,"url":"https://github.com/spmedia/threat-actor-usernames-scrape","last_synced_at":"2026-03-01T05:35:51.512Z","repository":{"id":287495216,"uuid":"948283347","full_name":"spmedia/Threat-Actor-Usernames-Scrape","owner":"spmedia","description":"A collection of intel and usernames scraped from various cybercrime sources \u0026 forums. DarkForums, HackForums, Patched, Cracked, BreachForums, LeakBase, XSS, Dread, \u0026 more","archived":false,"fork":false,"pushed_at":"2026-02-22T23:50:05.000Z","size":13044,"stargazers_count":156,"open_issues_count":0,"forks_count":26,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-02-23T04:28:38.578Z","etag":null,"topics":["cti","cyber-security","cybersecurity","cyberthreatintelligence","cyberthreats","enrichment","osint","osint-reconnaissance","scraping","scraping-websites","threat-hunting","threat-intelligence","threathunting","threatintel","threatintel-feeds","threatintelligence"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/spmedia.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-03-14T03:50:33.000Z","updated_at":"2026-02-22T23:50:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"204a8739-b07a-4631-ac9a-697368516422","html_url":"https://github.com/spmedia/Threat-Actor-Usernames-Scrape","commit_stats":null,"previous_names":["spmedia/cti-stuffs","spmedia/threat-actor-usernames-scrape"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/spmedia/Threat-Actor-Usernames-Scrape","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FThreat-Actor-Usernames-Scrape","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FThreat-Actor-Usernames-Scrape/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FThreat-Actor-Usernames-Scrape/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FThreat-Actor-Usernames-Scrape/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/spmedia","download_url":"https://codeload.github.com/spmedia/Threat-Actor-Usernames-Scrape/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spmedia%2FThreat-Actor-Usernames-Scrape/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29960454,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T01:47:18.291Z","status":"online","status_checked_at":"2026-03-01T02:00:07.437Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cti","cyber-security","cybersecurity","cyberthreatintelligence","cyberthreats","enrichment","osint","osint-reconnaissance","scraping","scraping-websites","threat-hunting","threat-intelligence","threathunting","threatintel","threatintel-feeds","threatintelligence"],"created_at":"2025-10-05T17:17:03.038Z","updated_at":"2026-03-01T05:35:51.465Z","avatar_url":"https://github.com/spmedia.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# CTI Stuffs - Threat Actor Usernames Scraped Edition\n\n![CTI nerds vs threat actors](https://i.imgur.com/SP93Ph5.png)\n\nA collection of CTI stuffs and various intel 📃 \n\nI was inspired to make this because corpo threat intel companies are straight up absurd and charge 5-6 figures a year just to access this same type of data. I aint paying for that shit and oftentimes those of us in CTI cant get the needed budget approved for the tools we need/want so here we are. This is an ever changing and evolving repo that should (in theory) be updated oftenish so that it has fresh data.\n\nFeed this data into your TIP.\n\nIf you have any neat fresh data or intel to add, submit a PR and throw it up baw.\n\n\u003e It's easy to forget what intelligence consists of: luck and speculation. Here and there a windfall, here and there a scoop — *John le Carré*\n\nIf you are a researcher or cybercriminal who found your username in these lists, you should enable in the forum Settings to hide yourself when online and/or disable your acct from displaying in the Who's Online sections publicly. If you make posts on the forum, well no way to hide from that. Just make sure you use a username that is non-attributed to your other monikers or self. Also make sure to VPN and proxy up because you know law enforcement be getting their hands on these forums raw databases. Tons of nerds (like me) be scraping weird stuffs like this. \n\nOther uses for these lists:\n\n- combine all the usernames together to use as an interesting password list\n- enrich existing intel\n- pick a random username from these lists and adopt it for yourself on another forum or platform to mask yourself a bit and to confuse some researchers/LE\n- use the data to send PM spam on the forums\n- do some cool nerd data science things\n\n# Scraped Forums 📃\n\nUsernames scraped from various cybercrime forums.\n\nForums scraped from\n\n- [BreachForums.st](#breachforumsst-rip) (rip)\n- [BreachForums.hn](#breachforumshn-rip) (rip)\n- [NoHide.io](#nohideio--rip) (rip)\n- [ASCarding.net](#ascardingnet)\n- [BreachForums.jp](#breachforumsjp) (lol)\n- [BlackHatWorld.com](#blackhatworld)\n- [Breachstars.io](#breachstarsio)\n- [Cracked.sh](#crackedsh)\n- [DarknetArmy.io](#darknetarmyio)\n- [DarkForums.me](#darkforumsme)\n- [Dread](#dread)\n- [HackForums.net](#hackforumsnet)\n- [Leakbase.la](#leakbasela)\n- [OGUser.com/OGU](#ogusercomogu)\n- [Patched.to](#patchedto)\n- [RehubCom](#rehubcomag)\n- [Umbra.by](#umbraby)\n- [XSS.pro](#xsspro)\n\n## Scraped Username Statistics\n\n| Metric | Count |\n|--------|-------|\n| Total usernames | 423,195 |\n| Total unique usernames | 383,117 |\n| Total duplicate usernames | 26,331 |\n\n*Last updated: January 29, 2025*\u003csup\u003e*\u003c/sup\u003e\n\n\u003csup\u003e*total usernames is updated frequently. unique and dupe is monthly\u003c/sup\u003e\n\n---\n\n# Dead Forums\n\nThese are forums that went offline since being scraped. \n\n## BreachForums.st (**rip**)\n\n**[dead_forum_users_breachforums_st.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/dead_forum_users_breachforums_st.txt)**\n\nA list of usernames scraped from the popular cybercrime and hacking forum BreachForums. Scraped from the \"Who's Online\" section of the forum.\n\n**Date Range of scrape:** March 2025 --\u003e April 15 2025 12:52 am - BreachForums went down on this date (**RIP**)\n\n**Amount:** 57,468 unique usernames\n\n---\n\n## BreachForums.hn (**rip**)\n\n**[dead_forum_users_breached_hn.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/dead_forum_users_breached_hn.txt)**\n\nThe forum came back online after its take down in April and the arrests of IntelBroker and other members. This is a list of usernames found and scraped from the new remix'd version. Scraped from the \"Who's Online\" section of the forum. Is it a fed psyop honeypot or an actual revival? Time will tell, but for now, we be scraping em. \n\n**Date Range of scrape:** July 26 2025 --\u003e Aug 11 2025 - forum went down and [its been alleged](https://pastebin.com/raw/EDUtVYq2) it was a fed honeypot the entire time. after this came out, it went offline shortly after to never return.\n\n**Amount:** 6,537 unique usernames\n\n---\n\n## NoHide.io  (**rip**)\n\n**[dead_forum_users_nohide_io.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/dead_forum_users_nohide_io.txt)**\n\nIt was small hacking/carding forum.\n\nThe usernames in this list are scraped from posted threads.\n\n**Date Range of scrape:** December 14 2025 --\u003e Dec 31 2025\n\n**Amount:** 138\n\n---\n\n---\n\n---\n\n# Active Forums\n\n## Cracked.sh\n\n**[forum_users_cracked.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_cracked.txt)**\n\nUsernames scraped from the newly launched [post-takedown](https://www.justice.gov/opa/pr/cracked-and-nulled-marketplaces-disrupted-international-cyber-operation) Cracked hacking forum.\n\n**Date Range of scrape:** May 27 2025 --\u003e current date\n\n**Amount:** 126,915 unique usernames\n\n---\n\n## DarkForums.me\n\n**[forum_users_darkforums.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_darkforums.txt)**\n\nUsernames scraped from DarkForums.\n\nOld urls: DarkForums.io\n\n**Date Range of scrape:** June 1 2025 --\u003e current date\n\n**Amount:** 57,648 unique usernames\n\n----\n\n## Leakbase.la\n\n**[forum_users_leakbase.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_leakbase.txt)**\n\nUsernames scraped from Leakbase - this site has been around a while and has went thru a few different domain TLDs. It's basically where threat actors can go and leak dbs and info or DL them.\n\nUsernames gathered from the Who's Online section, chatbox, and posted threads.\n\n**Date Range of scrape:** August 22 2025 --\u003e current date\n\n**Amount:** 9,354 unique usernames\n\n----\n\n## Patched.to\n\n**[forum_users_patched.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_patched.txt)**\n\nUsernames that have been scraped from the Patched forum - its some basic run of the mill skid forum.\n\nThese usernames are gathered from posted threads.\n\nOld url(s): Patched.sh\n\n**Date Range of scrape:** August 23 2025 --\u003e current date\n\n**Amount:** 23,560\n\n----\n\n## HackForums.net\n\n**[forum_users_hackforums.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_hackforums.txt)**\n\nUsernames that have been scraped from HackForums. The skiddiest of skid forums. The pipeline from kids stumbling upon HF and then after a few years becoming SIM Swapper or com kids is kinda high tho. \n\nUsernames gathered from posted threads and the Who's Online section at the bottom of the forum.\n\n**Date Range of scrape:** August 25 2025 --\u003e current date\n\n**Amount:** 54,780\n\n----\n\n## BreachStars.io\n\n**[forum_users_breachstars.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_breachstars.txt)**\n\nA forum that recently was created from the ashes of Breached going down. Admins are Rey from the Hellcat ransomware group and a few other threat actors from the breached/RaaS/db leaker scene.\n\nPrevious domains include: BreachSta.rs, Bstars.st, breachstars.st, breachstars.hn\n\nThe usernames in this list are scraped from posted threads.\n\n**Date Range of scrape:** September 9 2025 --\u003e current date\n\n**Amount:** 733\n\n----\n\n## OGUser.com/OGU\n\n**[forum_users_oguser.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_oguser.txt)**\n\nOGU/OGUsers forum has been around for a good lil while. Mainly associated with selling 'og' usernames like if you wanted to buy the handle @poop on Instagram or etc.\n\nThe usernames in this list are scraped from posted threads and users that reply within threads.\n\n**Date Range of scrape:** October 7 2025 --\u003e current date\n\n**Amount:** 5,842\n\n----\n\n## BlackHatWorld\n\n**[forum_users_blackhatworld.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_blackhatworld.txt)**\n\nThis forum has been around forever (decades). Basically a bunch of nerds talking about how to make money online via spam, seo, affiliate marketing, social media, blah blah blah.\n\nThe usernames in this list are scraped from posted threads and users who add replies.\n\n**Date Range of scrape:** October 9 2025 --\u003e current date\n\n**Amount:** 21,986\n\n----\n\n## DarknetArmy.io\n\n**[forum_users_darknetarmy.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_darknetarmy.txt)**\n\nA forum for leaks, carding, spam, and more. \n\nThe usernames in this list are scraped from posted threads and users who respond in them.\n\n**Date Range of scrape:** December 14 2025 --\u003e current date\n\n**Amount:** 20,793\n\n----\n\n## BreachForums.jp\n\n**[forum_users_breachforumsBF.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_breachforumsBF.txt)**\n\nSigh...BF number #32423423. How long will this one last? Likely not long but until then, we be scraping it.\n\nThe usernames in this list are scraped from posted threads and users who respond in them.\n\nold tlds: BreachForums.bf\n\n**Date Range of scrape:** December 18 2025 --\u003e current date\n\n**Amount:** 26,420\n\n----\n\n## XSS.pro\n\n**[forum_users_xss.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_xss.txt)**\n\nRussians gunna Russian. This forum is pretty og in the scene. They be talking about Программирование Разработка, Malware, Мошенничество, and Уязвимости. Used to have the domain xss[.]is until July 2025 when LE seized their stuffs and arrested 1 nerd (toha aka admin) in Ukraine over it. As always, LE takedowns are largely ineffective and the forum simply just popped back up a few days later on a new TLD.\n\nThe usernames in this list are scraped from posted threads and users who respond in them.\n\n**Date Range of scrape:** December 25 2025 --\u003e current date\n\n**Amount:** 2,546\n\n---\n\n## Dread\n\n**[forum_users_dread.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_dread.txt)**\n\nThe infamous Dread. Ran by HugBunter. Mainly a darknet market (DNM) forum that grew out of when the reddit admins did a ban wave of all the DNM subs several years ago. Content includes buying and selling drugs, carding, social engineering, hacking, and all kinda fraud and sus stuffs. Honestly its a wild place but Hug seems like a really interesting fella. \n\nThe usernames in this list are scraped from posted threads and users who respond in them.\n\n**Date Range of scrape:** December 27 2025 --\u003e current date\n\n**Amount:** 8,480\n\n---\n\n## Umbra.by\n\n**[forum_users_umbra.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_umbra.txt)**\n\nThe usernames in this list are scraped from posted threads and users who respond in them.\n\n**Date Range of scrape:** January 03 2025 --\u003e current date\n\n**Amount:** 229\n\n---\n\n## Rehubcom.ag\n\n**[forum_users_rehubcom.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_rehubcom.txt)**\n\nFollowing the shutdown/raid of XSS top admin, ex-moderator Rehub launched RehubCom. A primarily RU language forum.\n\nThe usernames in this list are scraped from posted threads, users who respond in them, users who show up in the Members Online or Latest member section.\n\n**Date Range of scrape:** January 13 2026 --\u003e current date\n\n**Amount:** 1,114\n\n---\n\n## ASCarding.net\n\n**[forum_users_ascarding.txt](https://github.com/spmedia/Threat-Actor-Usernames-Scrape/blob/main/forum_users_ascarding.txt)**\n\nA financial fraud and carding forum. These people be stealing yo grandmas credit card or frauding her retirement funds.\n\nThe usernames in this list are scraped from posted threads.\n\n**Date Range of scrape:** February 5 2026 --\u003e current date\n\n**Amount:** In collection mode - coming soon\n\n---\n\n# Greetz 💌\n\nAll the CTI nerds out there scraping intel stuffs and who are in the trenches, [dc225](https://defcon225.org/), chill intel companies that dont charge people 6-7 figures a year to access intel, sp, rj2, neQx, jt, smurda, jekz, MoB, sikez, and [Cybersecurity Stickers](https://cybersecuritystickers.com/)\n\nIf you know of any cybersec researchers or CTI nerds who might find this data interesting, share it w em \u003c3\n\n----\n\n# Stars ⭐\n\n\u003ca href=\"https://www.star-history.com/#spmedia/Threat-Actor-Usernames-Scrape\u0026type=date\u0026legend=top-left\"\u003e\n \u003cpicture\u003e\n   \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://api.star-history.com/svg?repos=spmedia/Threat-Actor-Usernames-Scrape\u0026type=date\u0026theme=dark\u0026legend=top-left\" /\u003e\n   \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://api.star-history.com/svg?repos=spmedia/Threat-Actor-Usernames-Scrape\u0026type=date\u0026legend=top-left\" /\u003e\n   \u003cimg alt=\"Star History Chart\" src=\"https://api.star-history.com/svg?repos=spmedia/Threat-Actor-Usernames-Scrape\u0026type=date\u0026legend=top-left\" /\u003e\n \u003c/picture\u003e\n\u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspmedia%2Fthreat-actor-usernames-scrape","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspmedia%2Fthreat-actor-usernames-scrape","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspmedia%2Fthreat-actor-usernames-scrape/lists"}