https://github.com/spmedia/cti-stuffs
A collection of CTI stuffs - intel scraped from various cybercrime sources & forums
https://github.com/spmedia/cti-stuffs
cti cybersecurity cyberthreatintelligence cyberthreats osint osint-reconnaissance scraping scraping-websites threat-hunting threat-intelligence threatintel threatintel-feeds threatintelligence usernames
Last synced: 3 months ago
JSON representation
A collection of CTI stuffs - intel scraped from various cybercrime sources & forums
- Host: GitHub
- URL: https://github.com/spmedia/cti-stuffs
- Owner: spmedia
- License: other
- Created: 2025-03-14T03:50:33.000Z (8 months ago)
- Default Branch: main
- Last Pushed: 2025-07-22T18:59:17.000Z (3 months ago)
- Last Synced: 2025-07-22T20:38:03.139Z (3 months ago)
- Topics: cti, cybersecurity, cyberthreatintelligence, cyberthreats, osint, osint-reconnaissance, scraping, scraping-websites, threat-hunting, threat-intelligence, threatintel, threatintel-feeds, threatintelligence, usernames
- Homepage:
- Size: 1.16 MB
- Stars: 8
- Watchers: 2
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# CTI Stuffs
A collection of CTI stuffs and various intel 📃
I was inspired to make this because corpo intel companies are straight up absurd and charge 5-6 figures a year just to access this same type of data. I aint paying for that shit and oftentimes those of us in CTI cant get the needed budget approved for the tools we need/want so here we are. This is an ever changing and evolving repo that should (in theory) be updated oftenish so that it has fresh data.
If you have any neat fresh data/intel to add, submit a PR and throw it up baw.
> It's easy to forget what intelligence consists of: luck and speculation. Here and there a windfall, here and there a scoop -- *John le Carré*
If you are a researcher or cybercriminal who found your username in these lists, you should enable in the forum Settings to hide yourself when online and/or disable your acct from displaying in the Who's Online sections publicly. Tons of nerds (like me) be scraping weird stuffs like this.
# Scraped Forums 📃
---
## BreachForums.st (rip)
**[forum_users.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users.txt)**
A list of usernames scraped from the popular cybercrime and hacking forum BreachForums. Scraped from the "Who's Online" section of the forum.
**Date Range of scrape:** March 2025 --> April 15 2025 12:52 am - BreachForums went down this morning (**RIP**)
**Amount:** 57,468 unique usernames
---
## BreachForums.hn
**[forum_users_breached_hn.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users_breached_hn.txt)**
The forum came back online after its take down in April and the arrests of IntelBroker and other members. This is a list of usernames found and scraped from the new remix'd version. Scraped from the "Who's Online" section of the forum. Is it a fed psyop honeypot or an actual revival? Time will tell, but for now, we be scraping em.
**Date Range of scrape:** July 26 2025 --> current date
**Amount:** 15 unique usernames
---
## Cracked.sh
**[forum_users_cracked.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users_cracked.txt)**
Usernames scraped from the newly launched post-takedown Cracked.sh hacking forum.
**Date Range of scrape:** May 27 2025 --> current date
**Amount:** 25,463 unique usernames
---
## DarkForums.st
**[forum_users_darkforums.txt](https://github.com/spmedia/CTI-Stuffs/blob/main/forum_users_darkforums.txt)**
Usernames scraped from DarkForums
**Date Range of scrape:** June 1 2025 --> current date
**Amount:** 16,728 unique usernames
----
# Greetz 💌
All the CTI nerds out there scraping stuffs and who are in the trenches, [dc225](https://defcon225.org/), sp, rj2, and [Cybersecurity Stickers](https://cybersecuritystickers.com/)