BRIEFAccess salelowP35
Admin access to Indonesian website whatsva.id for sale
whatsva.id (Indonesia)
Detected10 October 2026 · 01:21 UTC
DarkForums user OnlineSh0p3 is offering administrative access to the Indonesian site whatsva.id. The target is a small website rather than a strategic organization, so impact is limited and it lies outside the region of interest. It is surfaced only as a low-priority access-sale datapoint.
CategoryAccess sale
Severitylow
Priority score35
Detected10 October 2026 · 01:21 UTC
Access sale● 42
Venta de acceso interno con webshells y credenciales a entidades gubernamentalesA seller on DarkForums is advertising internal access bundles containing webshells, credentials and databases, explicitly mentioning government targets. Access of this kind gives an attacker a foothold to move laterally and exfiltrate sensitive data. The post is roughly two months old and names no specific victim or region, so it is only marginally actionable now.Access sale● 42
Venta de acceso al portal gubernamental francés economie.gouv.fr (TRACFIN)An actor on DarkForums is offering access to economie.gouv.fr, the French Ministry of Economy and Finance portal that hosts TRACFIN, the country's financial-intelligence unit handling anti-money-laundering data. Compromise of this system could expose sensitive financial-crime investigations and state financial data. The thread is dated January 2026, so it is not a fresh alert, but it remains a high-value government target worth tracking.Access sale● 30
Acceso a un panel (dashboard) de usuario ofrecido en foro clandestinoA forum user claims to have gained access to a dashboard belonging to a user and is advertising it for resale, posted within minutes of discovery. Details are scarce and no victim organization is named, but freshly harvested web-panel access can be resold and used for lateral movement. Defenders should watch for related credential-stuffing or panel-takeover attempts.Access sale● 42
Venta de 60.000 accesos a correos corporativosA seller is listing 60,000 'corporate' mailbox access credentials, refreshed on 08.10, intended for phishing and BEC-style abuse. Corporate mail access sales are a common precursor to invoice fraud and lateral movement against named organizations. The lack of an identified victim keeps impact moderate, but defenders should watch for credential-stuffing and inbox-rule abuse.
Access sale● 55
Venta de acceso de administrador y buzones de multinacionales de EE. UU.A seller is offering administrative and mailbox access to multiple large US multinational companies. This kind of persistent access enables business email compromise, internal phishing and lateral movement across corporate networks. Security teams at affected enterprises should review recent admin-account and mailbox activity.Access sale● 58
Venta de acceso a una organización médica de Estados UnidosA threat actor is advertising access to a US-based medical organization, typically via stolen credentials or remote access. Healthcare access sales feed ransomware deployment and theft of protected health data. Defenders in healthcare should treat this as an active intrusion opportunity to hunt for.