> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Alleged ARNTREAL Dataset With 101,015 Users Offered for Sale - URL: https://darkwebinformer.com/alleged-arntreal-dataset-with-101-015-users-offered-for-sale/ - Published: 2026-09-24T16:48:35.000Z - Updated: 2026-09-24T16:48:35.000Z - Author: Dark Web Informer - Tags: Data Breaches Data Exposure Report France Dataset Sale Personal Data Social Accounts Unverified ## Alleged ARNTREAL Dataset With 101,015 Users Offered for Sale Claimed users101,015 Claimed user emails81,006 Claimed user phones39,327 Claimed dataset size3.5 GB Severity HIGH ### Overview An actor using the handle **"RedStone"** is offering an alleged **ARNTREAL** dataset for sale, claiming it contains **101,015 users, 81,006 user email addresses and 39,327 user phone numbers**. The listing describes ARNTREAL as a stats and rewards platform and advertises **more than 5.5 million rows across 10 tables, totaling 3.5 GB**. The claimed contents include social account identifiers, referral codes, affiliate revenue records, coin transactions, mission activity, support tickets and screenshots. The actor gives a data range of **March 2024 to September 2026** and says most phone numbers are French (+33). **No fixed price is stated; buyers are asked to make an offer.** The dataset's authenticity, origin, completeness and counts have not been independently verified. ### Post details PlatformARNTREAL Country France SectorStats and rewards platform Actor"RedStone" Claimed total rows5,500,000+ across 10 tables Claimed data rangeMarch 2024 – September 2026 Asking priceMake an offer Post date shownSep 23, 2026 ### What the post claims - 101,015 users and affiliate codes for all users - 81,006 user emails; 62 more in support tickets - 39,327 user phone numbers; 4 more in support tickets - Phone numbers described as mostly French (+33) - 16,455 Instagram handles - 15,865 Discord IDs - 8,596 TikTok handles - 5,490 X handles - 1,966 screenshots claimed exposed - €1,426,126.60 in affiliate revenue records - 1,605,342 coin transactions - 3,646,489 mission activities - 112,344 asset ownership rows - 16,294 affiliate rows - 3,240 support ticket rows - 456 assets (skins/cards) and 255 missions - 2 admin accounts and 6 moderator accounts - Referral fields: affiliate\_code, kanal\_code, discord\_code - 99.99% valid emails and no duplicate IDs claimed - 1,000-record sample advertised; links omitted - Offers requested; no fixed asking price - Telegram and Session contacts supplied The listed table sizes are **1.9 GB for mission\_activity**, **1.4 GB for coin\_transaction**, 70 MB for asset\_ownership, 69 MB for user, 3.5 MB for affiliate and 1.2 MB for support\_ticket. The post also names asset and mission tables. It advertises **10 tables but names eight** in the visible breakdown. All figures are seller claims. Sponsored [ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) ### Screenshots [Screenshot 1Source screenshot![ARNTREAL dataset sale listing claiming 101,015 users, email addresses, phone numbers and social identifiers, with sample-download URLs obscured](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/72378495237857286357862348762367848762.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/72378495237857286357862348762367848762.png) Listing showing the claimed dataset contents, table counts, offer-based pricing and contact identifiers. Sample-download URLs are obscured in the packaged screenshot. ### IOCs & contact identifiers Actor and contact identifiers visible in the supplied screenshot. These support correlation and do not, on their own, establish compromise. | Type | Identifier | Source | | --------------- | ------------------------------------------------------------------ | ------------ | | Actor handle | RedStone | Screenshot 1 | | Telegram handle | @redstone\_group | Screenshot 1 | | Session ID | 05c656825a879b6da23efd56f9533169ae3ba7f5710f7a225c2bae9eabab187737 | Screenshot 1 | The Session ID was transcribed from the original screenshot. Contact ownership and activity have not been verified. No Tox ID, malware hash or attacker-controlled IP address is visible. No organization domain is established by the screenshot. Data-download URLs and customer identifiers are not included in this table. URLs to any data will always be blurred out, but are available to subscribers on the threat feed or ransomware feed. ### Mapped techniques No MITRE ATT&CK technique is assigned from this screenshot alone. The listing advertises an alleged dataset but does not establish an initial-access vector, collection method or exfiltration mechanism. References to screenshots and admin or moderator accounts do not demonstrate screen capture or the use of privileged accounts. ### Potential impact If authentic, linked **email addresses, phone numbers and social account identifiers** could support targeted phishing, impersonation and cross-platform profiling. Referral codes, revenue records and activity histories could reveal user relationships and platform usage. Support tickets and screenshots could expose further context, but their contents are not visible. **The advertised 5.5 million rows span multiple tables and should not be interpreted as 5.5 million affected people.** The claimed €1,426,126.60 in affiliate revenue is neither an asking price nor a demonstrated financial loss. ### Status Unverified Dark Web Informer has **not independently verified** the dataset's authenticity, source, age, completeness, counts or the actor's access. The screenshot contains a sales listing and aggregate statistics, with no underlying user records shown. The advertised samples were not accessed. The stated March 2024–September 2026 range is a claimed data period, not an established breach timeline. Claims of email validity, no duplicate IDs and a complete user base remain unverified. The screenshot provides no independent platform confirmation or technical evidence of how the data was obtained. Want everything on this threat? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=arntreal-dataset-sale-2026-09-24&utm%5Fcontent=threat-feed) and search there for this alert. [View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=arntreal-dataset-sale-2026-09-24&utm%5Fcontent=pricing-button) [Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=arntreal-dataset-sale-2026-09-24&utm%5Fcontent=footer)