Threat Actor Usernames Scrape: A collection of intel and usernames scraped from various cybercrime sources & forums. DarkForums, HackForums, Patched, Cracked, BreachForums, LeakBase, & more.
GitHub: https://github.com/spmedia/Threat-Actor-Usernames-Scrape
A collection of CTI stuffs and various intel 📃
I was inspired to make this because corpo threat intel companies are straight up absurd and charge 5-6 figures a year just to access this same type of data. I aint paying for that shit and oftentimes those of us in CTI cant get the needed budget approved for the tools we need/want so here we are. This is an ever changing and evolving repo that should (in theory) be updated oftenish so that it has fresh data.
If you have any neat fresh data or intel to add, submit a PR and throw it up baw.
It's easy to forget what intelligence consists of: luck and speculation. Here and there a windfall, here and there a scoop — John le Carré
If you are a researcher or cybercriminal who found your username in these lists, you should enable in the forum Settings to hide yourself when online and/or disable your acct from displaying in the Who's Online sections publicly. If you make posts on the forum, well no way to hide from that. Just make sure you use a username that is non-attributed to your other monikers or self. Also make sure to VPN and proxy up because you know law enforcement be getting their hands on these forums raw databases. Tons of nerds (like me) be scraping weird stuffs like this.
I also have private scraped intel collections that I do not list here for various reasons. If you would like access to those, hit me up!
Scraped Forums 📃
Usernames scraped from various cybercrime forums.
Forums scraped from
- BreachForums.st (rip)
- BreachForums.hn (rip)
- BlackHatWorld.com
- Breachstars.hn
- Cracked.sh
- DarkForums.st
- HackForums.net
- Leakbase.la
- OGUser.com/OGU
- Patched.sh
Scraped Username Statistics
| Metric | Count |
|---|---|
| Total usernames | 266,847 |
| Total unique usernames | 248,757 |
| Total duplicate usernames | 12,209 |
Last updated: December 1, 2025
Dead Forums
These are forums that went offline since being scraped.
BreachForums.st (rip)
A list of usernames scraped from the popular cybercrime and hacking forum BreachForums. Scraped from the "Who's Online" section of the forum.
Date Range of scrape: March 2025 --> April 15 2025 12:52 am - BreachForums went down on this date (RIP)
Amount: 57,468 unique usernames
BreachForums.hn (rip)
The forum came back online after its take down in April and the arrests of IntelBroker and other members. This is a list of usernames found and scraped from the new remix'd version. Scraped from the "Who's Online" section of the forum. Is it a fed psyop honeypot or an actual revival? Time will tell, but for now, we be scraping em.
Date Range of scrape: July 26 2025 --> Aug 11 2025 - forum went down and its been alleged it was a fed honeypot the entire time. after this came out, it went offline shortly after to never return.
Amount: 6,537 unique usernames
Active Forums
Cracked.sh
Usernames scraped from the newly launched post-takedown Cracked hacking forum.
Date Range of scrape: May 27 2025 --> current date
Amount: 72,467 unique usernames
DarkForums.st
Usernames scraped from DarkForums
Date Range of scrape: June 1 2025 --> current date
Amount: 48,091 unique usernames
Leakbase.la
Usernames scraped from Leakbase - this site has been around a while and has went thru a few different domain TLDs. It's basically where threat actors can go and leak dbs and info or DL them.
Usernames gathered from the Who's Online section, chatbox, and posted threads.
Date Range of scrape: August 22 2025 --> current date
Amount: 7,123 unique usernames
Patched.sh
Usernames that have been scraped from the Patched forum - its some basic run of the mill skid forum.
These usernames are gathered from posted threads.
Date Range of scrape: August 23 2025 --> current date
Amount: 15,585
HackForums.net
Usernames that have been scraped from HackForums. The skiddiest of skid forums. The pipeline from kids stumbling upon HF and then after a few years becoming SIM Swapper or com kids is kinda high tho.
Usernames gathered from posted threads and the Who's Online section at the bottom of the forum.
Date Range of scrape: August 25 2025 --> current date
Amount: 42,961
BreachStars.hn
A forum that recently was created from the ashes of Breached going down. Admins are Rey from the Hellcat ransomware group and a few other threat actors from the breached/RaaS/db leaker scene.
Previous domains include: BreachSta.rs, Bstars.st, breachstars.st.
The usernames in this list are scraped from posted threads.
Date Range of scrape: September 9 2025 --> current date
Amount: 607
OGUser.com/OGU
OGU/OGUsers forum has been around for a good lil while. Mainly associated with selling 'og' usernames like if you wanted to buy the handle @poop on Instagram or etc.
The usernames in this list are scraped from posted threads.
Date Range of scrape: October 7 2025 --> October 31 2025
Amount: 931
BlackHatWorld
This forum has been around forever (decades). Basically a bunch of nerds talking about how to make money online via spam, seo, affiliate marketing, social media, blah blah blah.
The usernames in this list are scraped from posted threads and users who add replies.
Date Range of scrape: October 9 2025 --> current date
Amount: 15,987
