Exposing the main IP of several ransomware services and Darknet forums !

[whyban]

For some time, the main IP addresses of some ransomware servers and several markets and forums have been leaked,
for example

Bohemia Market : 37.148.211.30:89
Dread : 103.36.92.72:4000
Marxitsts : 104.37.173.99
Inthebox Malware MarketPlace : 206.166.251.11
DatabaseMarket : 45.93.201.70/login
Just-Kill MarketPlace : 195.123.214.36
Rhysida Rass : 5.255.106.234:57381
Darkrace Blog : 70.39.65.128

It is better to make the service more secure !

 

[n3xtr4n]

how was it done ?

 

[whyban]

how was it done ?

Maybe Favicon Hash

 

[Zodiac]

I think i was in talk with one user on TG who say to be behind this, he told it was misconfig. I did not verify it cannot say if it was misconfig

 

[whyban]

I think i was in talk with one user on TG who say to be behind this, he told it was misconfig. I did not verify it cannot say if it was misconfig

Yup, the wrong configuration has caused the original IPs to come out

 

[unknow2156]

For some time, the main IP addresses of some ransomware servers and several markets and forums have been leaked,
for example

Bohemia Market : 37.148.211.30:89
Dread : 103.36.92.72:4000
Marxitsts : 104.37.173.99
Inthebox Malware MarketPlace : 206.166.251.11
DatabaseMarket : 45.93.201.70/login
Just-Kill MarketPlace : 195.123.214.36
Rhysida Rass : 5.255.106.234:57381
Darkrace Blog : 70.39.65.128

It is better to make the service more secure !

Я видел их на иранском Telegram-канале АRVIN. Пока только шифровальщик Darkeace сменил сервер

Telegram: Contact @arvinclub1

t.me

 

[dkdkxkxkxxk]

Vice Society 146.70.87.159

 

[Zodiac]

some expose ips. boys of breachforums[.]vc get leaked there db. Everyone is great in there own world

Exploit.IN Send

Encrypt and send files with a link that automatically expires to ensure your important documents don’t stay online forever.

send.exploit.in

 

[whyban]

some expose ips. boys of breachforums[.]vc get leaked there db. Everyone is great in there own world

Exploit.IN Send

Encrypt and send files with a link that automatically expires to ensure your important documents don’t stay online forever.

send.exploit.in

Is the data fresh?

 

[Zodiac]

Is the data fresh?

Not sure. It was leaked yesterday

 

[whyban]

Not sure. It was leaked yesterday

Where was it leaked?

 

[blacrabbit]

https://sh1ttykids.medium.com/new-techniques-uncovering-tor-hidden-service-with-etag-5249044a0e9dhttps://sh1ttykids.medium.com/new-techniques-uncovering-tor-hidden-service-with-etag-5249044a0e9d

 

[unknow2156]

https://sh1ttykids.medium.com/new-techniques-uncovering-tor-hidden-service-with-etag-5249044a0e9dhttps://sh1ttykids.medium.com/new-techniques-uncovering-tor-hidden-service-with-etag-5249044a0e9d

Уверяю вас, что это не только проблема Etag, и если конфиги применены неправильно, реальный IP доступен.

 

[whyban]

Уверяю вас, что это не только проблема Etag, и если конфиги применены неправильно, реальный IP доступен.

Exactly !