Infrastructure observations

Threat Surface

A defensive index of source-reported domains, onion services, IP addresses, ASNs, server software, and exposed ports associated with monitored threat infrastructure.

Dataset summary

Records: 16
Categories: Forum, Fraud shop, Malware service, Ransomware, Ransomware / Hacktivism, Stresser
Records with reported IPs: 13
Records with onion services: 6
Source snapshot: Threat-Surface, 13 May 2026
License: MIT License, copyright Dark Web Informer

Values reproduce a source snapshot and are not live scan results. Domains are defanged and non-clickable. OpenSpy excludes credentials, password fields, database salts, administrative paths, and other unnecessary access details.

Infrastructure records

Name	Category	Domains	Reported IP / ASN	Services	Source
4Cheat	Forum	4cheat[.]org	84.38.185.219 · AS49505 · Russia	nginx · ports 22, 80, 443, 9002	Dark Web Informer →
Alligator Cash	Forum	alligator[.]cash	185.81.128.106 · AS43513	nginx IP and ASN were reported as exposed on 2025-05-15.	Dark Web Informer →
BreachForums	Forum	breachforums[.]bf · breachedmw4otc2lhx7nqe4wyxfhpvy32ooz26opvqkmmrbg73c7ooad[.]onion	91.215.85.48, 45.134.26.22 · AS200593, AS198953	Apache 2.4.65 (Debian)	Dark Web Informer →
CrackingX	Forum	crackingx[.]com	185.206.215.219 · AS204601 · Netherlands	nginx; PHP 7.4.33 · ports 21, 22, 80, 110, 143, 443, 465, 587, 993, 995, 2525, 3306, 8083	Dark Web Informer →
Dark Shinigamis	Ransomware	darkshiz4d5ayumjvgbdhchwc7oeuc5jgbqkkgr2jj3ga5nvpjsswdad[.]onion	Not supplied	Not supplied · ports 8080	Dark Web Informer →
DarkForums	Forum	darkforums[.]hn	185.196.11.58	nginx 1.18.0 (Ubuntu) · ports 22, 80, 443 Source dataset includes a service scan and TLS certificate metadata.	Dark Web Informer →
Enclave	Forum	enclave[.]cc	213.32.48.179 · AS16276 · France	LiteSpeed The source reports that the service later moved behind Cloudflare.	Dark Web Informer →
Handala Hack	Ransomware / Hacktivism	handala-hack[.]to	185.208.156.82 · AS42624	LiteSpeed; WordPress · ports 21, 22, 80, 110, 143, 443, 465, 587, 993, 995	Dark Web Informer →
Max Stresser	Stresser	maxstresser[.]com	Not supplied	Not supplied	Dark Web Informer →
MintEye	Ransomware	i6575ykikb3yvut4btucoqjshbktouxxyu3eb3ffa3ukvyvtam5y5pqd[.]onion	85.121.48.68 · AS9009 · Romania	nginx 1.18.0 (Ubuntu) · ports 22, 25, 53, 80, 443	Dark Web Informer →
Orion	Ransomware	cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion	Not supplied	Apache 2.4.58 (Ubuntu)	Dark Web Informer →
Osiris	Ransomware	ausare[.]net · osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid[.]onion	144.31.76.21 · AS213877 · United States	nginx 1.29.3 · ports 22, 80, 443	Dark Web Informer →
PwnForums	Forum	Not supplied	209.99.188.105	Not supplied	Dark Web Informer →
RONDA	Fraud shop	rondastore[.]org · r4hyxmieadsyhnqzccmib45qtwa3x74gpnp24ovicuiuc5jzj3jxj2ad[.]onion	5.188.86.67 · AS49453	nginx 1.18.0 (Ubuntu) · ports 80, 443, 2947	Dark Web Informer →
Rootsploitt	Forum	rootsploit[.]org	89.35.130.51 · AS214309	nginx · ports 21, 22, 80, 110, 143, 443, 993, 995, 1500, 1501, 5414, 27356	Dark Web Informer →
STARKILLER	Malware service	starkiller[.]su	213.177.179.183 · AS208137	Not supplied · ports 22, 80, 443, 8080, 8888, 9999 Reported as a phishing-as-a-service platform targeting MFA protections.	Dark Web Informer →

Use and limitations

An IP address, open port, software banner, or domain association is an observation from the cited source snapshot. It does not establish ownership, continued control, criminal liability, or current reachability. Infrastructure can be shared, reassigned, proxied, or taken over.