BRIEFAccess salelowP42
Sale of 535 cPanel admin and user credentials
Detected12 October 2026 · 16:53 UTC
An actor is selling 535 cPanel credentials split between admin and standard users, giving buyers hosting-panel control over compromised websites. Such access enables website defacement, malware hosting, mail abuse and lateral movement into customer data. Hosting and web teams should hunt for unauthorized cPanel logins and rotated credentials.
CategoryAccess sale
Severitylow
Priority score42
Detected12 October 2026 · 16:53 UTC
Access sale● 45
Venta de acceso de administrador a tradeasia.com (Singapur)A seller listed administrator access to tradeasia.com, a Singapore-based trading firm, on a darkweb forum. Admin access could let an attacker pivot into corporate systems, email and customer data. Any organization relying on similar platforms should review its exposure.Access sale● 56
Posible venta de acceso o datos de la teleco KPN (Países Bajos)A VIP seller posted 'KPN Netherlands' yesterday, indicating either network access to or data from the Dutch incumbent telecom, a national critical-infrastructure operator. Telecom compromises enable subscriber-data exposure, SIM-related fraud and lateral attacks. Dutch and EU defenders should treat this as a time-sensitive claim to validate.Access sale● 68
Venta de acceso completo a los servidores de GoldunitedA threat actor using the handle Blacknet00 claims to be selling full access to the servers of a company called Goldunited. Full server access implies deep compromise that can enable data theft, lateral movement and ransomware deployment against the victim and its partners. Any organization sharing infrastructure or supply-chain ties with this entity should urgently verify exposure.Access sale● 58
Base de datos de 838 GB y acceso FTP de dmp.com.tw a la ventaA seller is offering an 838 GB database from the Taiwanese firm dmp.com.tw together with live FTP server access. Live FTP credentials are a direct intrusion vector enabling data theft, defacement or lateral movement. Buyers of such access should be treated as an active threat to that network.Access sale● 35
Venta de acceso de administrador a la biblioteca vietnamita thuvienonline.com.vnA forum user is offering administrator access to thuvienonline.com.vn, a Vietnamese online library web application. Although low-value, admin access enables data theft, defacement or use of the host as a pivot for further attacks. It is marginal for LATAM/government defenders but illustrates ongoing low-tier access sales worth monitoring.Access sale● 58
Acceso admin de webmail de tienda italiana de alimentos a la ventaA seller on DarkForums is offering administrative webmail access to an Italian food and confectionery online retailer. Webmail admin control lets an attacker read all mail, trigger password resets and mount business email compromise against the company and its partners. Retailers and their supply-chain contacts should rotate mailbox credentials and monitor for suspicious logins.