Alleged ARNTREAL Dataset With 101,015 Users Offered for Sale
Overview
An actor using the handle "RedStone" is offering an alleged ARNTREAL dataset for sale, claiming it contains 101,015 users, 81,006 user email addresses and 39,327 user phone numbers. The listing describes ARNTREAL as a stats and rewards platform and advertises more than 5.5 million rows across 10 tables, totaling 3.5 GB.
The claimed contents include social account identifiers, referral codes, affiliate revenue records, coin transactions, mission activity, support tickets and screenshots. The actor gives a data range of March 2024 to September 2026 and says most phone numbers are French (+33). No fixed price is stated; buyers are asked to make an offer. The dataset's authenticity, origin, completeness and counts have not been independently verified.
Post details
What the post claims
- 101,015 users and affiliate codes for all users
- 81,006 user emails; 62 more in support tickets
- 39,327 user phone numbers; 4 more in support tickets
- Phone numbers described as mostly French (+33)
- 16,455 Instagram handles
- 15,865 Discord IDs
- 8,596 TikTok handles
- 5,490 X handles
- 1,966 screenshots claimed exposed
- €1,426,126.60 in affiliate revenue records
- 1,605,342 coin transactions
- 3,646,489 mission activities
- 112,344 asset ownership rows
- 16,294 affiliate rows
- 3,240 support ticket rows
- 456 assets (skins/cards) and 255 missions
- 2 admin accounts and 6 moderator accounts
- Referral fields: affiliate_code, kanal_code, discord_code
- 99.99% valid emails and no duplicate IDs claimed
- 1,000-record sample advertised; links omitted
- Offers requested; no fixed asking price
- Telegram and Session contacts supplied
The listed table sizes are 1.9 GB for mission_activity, 1.4 GB for coin_transaction, 70 MB for asset_ownership, 69 MB for user, 3.5 MB for affiliate and 1.2 MB for support_ticket. The post also names asset and mission tables. It advertises 10 tables but names eight in the visible breakdown. All figures are seller claims.
Screenshots
IOCs & contact identifiers
Actor and contact identifiers visible in the supplied screenshot. These support correlation and do not, on their own, establish compromise.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | RedStone | Screenshot 1 |
| Telegram handle | @redstone_group | Screenshot 1 |
| Session ID | 05c656825a879b6da23efd56f9533169ae3ba7f5710f7a225c2bae9eabab187737 | Screenshot 1 |
The Session ID was transcribed from the original screenshot. Contact ownership and activity have not been verified. No Tox ID, malware hash or attacker-controlled IP address is visible. No organization domain is established by the screenshot. Data-download URLs and customer identifiers are not included in this table. URLs to any data will always be blurred out, but are available to subscribers on the threat feed or ransomware feed.
Mapped techniques
No MITRE ATT&CK technique is assigned from this screenshot alone. The listing advertises an alleged dataset but does not establish an initial-access vector, collection method or exfiltration mechanism. References to screenshots and admin or moderator accounts do not demonstrate screen capture or the use of privileged accounts.
Potential impact
If authentic, linked email addresses, phone numbers and social account identifiers could support targeted phishing, impersonation and cross-platform profiling. Referral codes, revenue records and activity histories could reveal user relationships and platform usage. Support tickets and screenshots could expose further context, but their contents are not visible. The advertised 5.5 million rows span multiple tables and should not be interpreted as 5.5 million affected people. The claimed €1,426,126.60 in affiliate revenue is neither an asking price nor a demonstrated financial loss.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, age, completeness, counts or the actor's access. The screenshot contains a sales listing and aggregate statistics, with no underlying user records shown. The advertised samples were not accessed. The stated March 2024–September 2026 range is a claimed data period, not an established breach timeline. Claims of email validity, no duplicate IDs and a complete user base remain unverified. The screenshot provides no independent platform confirmation or technical evidence of how the data was obtained.
