Skip to monitoring workspace

Live Intel

Connecting to the archive
Buying, selling, or accessing stolen credentials is unlawful.
Legal & Cybersecurity Compliance Advisory: This dashboard publishes defensive threat intelligence only. Buying, selling, or accessing stolen credentials is unlawful, including under the Computer Fraud and Abuse Act (18 U.S.C. § 1030) and equivalent statutes. Material is collected for victim identification, incident response, and security research. PhishDestroy does not operate, endorse, or link to underground marketplaces; source listings and seller identifiers are redacted or anonymized. Nothing here is an offer, referral, or facilitation of illicit trade.

Explore the evidence.

Historical listing evidence for researchers and platform safety teams.

Source identity & links withheld

PUBLIC THREAT INTELLIGENCE

Account exposure,in focus.

Follow the archive. Find an account. Investigate the evidence.
Historical listings across gaming, social and digital platforms.

Explore platforms
Loading archive statistics…

Browse the archive

Platforms

Open a platform to view records
Archived listings by platform. Open a platform to inspect its records.
PlatformArchived listingsArchive shareNew recordsAsking-price totalCollectionOpen platform
About this archive & how to read the data

Legal position: Content is published for security research, auditing, and victim mitigation. PhishDestroy does not facilitate, encourage, or participate in underground marketplaces. All source links are deliberately defanged and platform identifiers are anonymized. Buying, selling, or using stolen credentials is a crime (18 U.S.C. § 1030 and equivalents).

Archived listings
—
listings in this category · —
Total asking price
—
recorded asking prices · outliers excluded
Recorded spending
—
spending reported in listings
Average asking price
—
across priced listings
Inventory value
—
estimated in-game item value
Recorded game hours
—
Source-reported playtime

Category statistics

Category-wide observations. Record filters below do not change these totals.

About this data

Historical marketplace listings, retained after sale or removal. Each category + listing ID appears once; different listings may concern the same account. Totals count listings; one stolen account can appear in several listings. Origin and country are recorded in the marketplace listing. Missing fields remain unknown; legacy zeros may include missing data. The first archived snapshot is retained.

Asking prices are not sale proceeds. Missing prices and values at or above $1,080 are excluded from price totals and averages; this threshold also excludes listings with higher asking prices. Original values remain in exports. Recorded spend, inventory values and asking prices measure different things. They do not capture the damage from stolen messages, files, identity abuse, lost communities or scams against contacts.

Defensive research and incident response only. Source links and seller identities are redacted. No credentials or marketplace access are provided.

Listing archive
Export
0 archived listings
Archive · live availability unknown
—

RESEARCH & RESPONSE

From an observation to a verified response.

Find an available identifier, understand the record and pass useful evidence to the platform.

Threat Origins & Theft Methodology Details
STEALER
—
—
Infostealer Malware Harvest
Victim's PC was infected with an infostealer (RedLine, Vidar, Raccoon, Lumma etc.). The malware silently extracted saved browser logins, passwords and autofill data. The thief receives a "log" — a package of all credentials from the infected machine — and extracts Steam/game accounts from it. Victim often has no idea the infection occurred.
RedLine / Vidar / LummaBrowser credential dumpMass infection via cracked software
BRUTE
—
—
Credential Stuffing / Brute Force
Criminal bought leaked password databases (from previous breaches of other services) and ran automated tools to test email+password combos against Steam/game platforms. Works because users reuse passwords across sites. A single purchased breach database of millions of credentials may yield thousands of valid game accounts.
Password reuse exploitationLeaked DB combosOpenBullet / SilverBulletHigh-volume automated
PHISHING
—
—
Fake Login Pages / Social Engineering
Phishing steals account access through deception: fake login pages, fraudulent messages, login-code requests or malicious authorization prompts. Attackers can capture passwords, one-time codes or authenticated sessions and impersonate the victim. The damage extends to private messages, files, purchases and contacts; stolen accounts are used to scam people who trust the owner and to take over communities where the owner has permissions. Fake trade offers, giveaways and messages from already compromised friends are common lures. Browser-in-the-browser pages imitate login windows to conceal the fraudulent destination.
BitB attacksFake trade offersDiscord DM scamsFake giveaways
RESALE
—
—
Re-listed After Purchase — Multiple Use Cases
Account was previously purchased on this or similar underground marketplaces, used, and then re-listed for profit. Actor may have: (1) checked game inventories (CS2, TF2, Rust and ARK) for tradeable items worth more than account price; (2) used the account to send scam messages to friends list; (3) used Steam Wallet balance then re-listed; (4) listed on external grey-market platforms via automation. Game libraries, inventories, balances and friend counts show the financial and social reach of the stolen access.
Inventory farmingGrey-market API resellFriends-list spamWallet drain → relist
AUTOREG
—
—
Bot-Registered Bulk Accounts
Automated mass-registration of fresh accounts. Used for: bulk Discord/Telegram spamming (invite bombing, DM spam), fake review farms, CS2 cheating (new accounts per ban), boosting friends-list count for social engineering credibility, and flooding platforms with fake activity. Telegram autoreg accounts are particularly common — cheap, disposable, used for mass promotional spam and scam DMs.
Mass Telegram spamDiscord invite bombingCS2 smurf / cheat accountsFake activity farms
Criminal Use-Case Matrix
Category Dominant Attack Vector Exposure Present Indexed Count
Who Buys Stolen Accounts? (Buyer Profiles)
Cheat Resellers & Smurf Farms
Cheaters and rating boosters purchase cheap accounts (CS2, Valorant, Apex Legends) to deploy malicious hacks (aimbots, wallhacks) in high-level lobbies without risking their primary accounts, or to breed accounts for matchmaking resale.
HIGH THREAT · Elite gaming impact
Inventory Traders (Item Farmers)
Liquidators and botnet operators capture accounts with valuable game skins (CS2, Dota2, Rust, TF2) to automatically wipe out inventories, drain Steam wallet balances, and route items through cross-game P2P trading platforms.
HIGH THREAT · Wallet & Skins drainage
Spam & Scam Operators
Syndicates acquire bulk Telegram, Discord, and social media autoregs or phishing logs to run large-scale coordinate spam campaigns, invite-bombing, malicious phishing broadcasts, and fake crypto giveaway distribution.
SPAM & SCAMS · Contacts and communities at risk
Account Resellers (Arbitrage)
Arbitrage actors purchase high-value region accounts (primarily DE/US region with payment methods on file) on source markets at a discount, then re-list them at a premium on public grey-market platforms. Each resale passes stolen access and available private data to another operator, prolonging the compromise and exposing the owner and their contacts to further abuse.
REPEATED COMPROMISE · Resale of stolen access
Buyers of Stolen Account Access
These buyers use someone else’s stolen game library or paid subscription for themselves. The rightful owner can lose access, purchases and private information. Continued unauthorised access puts stored messages, linked services and trusted contacts at risk and finances the trade in stolen accounts.
STOLEN ACCESS · Identity, privacy & contacts at risk
Fraud & Money Mules
Financial cybercriminals use active compromised accounts with attached payment cards, banks, or balances to run chargeback fraud schemes, test stolen credit card details, and execute complex laundry operations.
HIGH THREAT · Financial carding & wash loops
Who Gets Targeted & Why? (Target Vectors)
LEGACY NODES
2004-2012
Account history
Established Accounts, Relationships and Security Controls
Established accounts can hold years of purchases, rare badges and relationships that criminals exploit for resale and impersonation. Age alone does not show whether MFA is enabled. Archive example: listing #253146921 records registration on 2008-05-31, last activity on 2009-12-24, origin resale, and an enabled MFA field. Those dates do not establish a completed sale or that the owner abandoned the account.
GEOGRAPHY
DE & US
Recorded region
Regional Access, Purchases and Contact Networks
Country and region fields matter alongside the account’s language, purchases, balances, payment-method flags and contact network. Criminals can use a stolen identity to target people in that region, abuse paid access and resell valuable accounts. Country labels such as Germany (DE), the United States (US), Brazil, Russia and Ukraine describe the recorded region; a country field alone does not establish an active card, inventory value or a specific malware campaign.
AI SUB
ChatGPT
New Frontier
AI Accounts: Conversations, Files and Connected Access
Stolen OpenAI, Anthropic, xAI and other AI accounts expose more than a subscription: saved conversations, uploaded documents, personal and business data, and secrets in prompts can be copied and abused. Workspace and connected-service access can extend the damage according to account permissions. Infostealer origin also signals compromise of the device and its other credentials. Paid chat access and API billing must be read separately; ChatGPT Plus does not include API usage.
The Money Flow Pipeline
1. STEAL / BRUTE LOG
Infostealer logs (RedLine, Vidar, Lumma), phishing token capture, password reuse / credential stuffing.
➔
2. BLACK MARKET LISTING
Credentials bulk-uploaded and checked live. Sorted by game library, inventory value, geo, linked payment methods.
➔
3. ABUSE THE ACCOUNT
Buyer plays with cheats / smurfs until ban. Spams and scams the friends list. Strips transferable items — including CS2 / TF2 / Rust skins and Path of Exile currency or gear where transfers are available — to other accounts. Rocket League item trading is a historical example: player-to-player trading ended on 5 December 2023. Burns wallet / store balance.
➔
4. EMPTY RE-LISTING
Stripped husk is re-sold cheap or kept as a throwaway for more spam and cheating. Victim stays locked out.
What the account is actually used for: cheats and smurfing on the victim's rank and games, scam / spam against the friends list, and liquidation of transferable in-game items (including Path of Exile, CS2, TF2 and Rust where transfers are available). Rocket League removed player-to-player trading in December 2023; stolen accounts still expose paid access, cosmetics and the owner’s identity. Platforms that force sessions dead on password change and freeze trades after a geo / device change cut the drain window before mule transfers clear.
Find an account · platform verification

Search an exact, unmasked username, display name, BattleTag, email or archive reference. Export observations for review by the platform or an account recovery team.

Exact matching only. Hidden or masked identifiers cannot be searched or reconstructed. An archive reference identifies a listing, not a person. Dates, country and game lists can support a platform review but do not establish identity.

No match means no matching identifier is visible in this archive; it does not mean the account is safe. This tool offers no credentials, purchases or access to the monitored source.

A practical review workflow

01

Match the identifier

Use an exact, unmasked login or permanent platform ID. A display name may change or be shared. A listing reference identifies an archived observation.

02

Verify with the platform

Compare the record with first-party sign-in, session, recovery and trade events. Check the observation date and establish ownership through the platform.

03

Support the response

Export the observation for a platform safety team or an official recovery request. Account restrictions and recovery decisions need corroborating evidence.

Acquisition methods

How the credentials were obtained or re-listed. Drives the recovery branch you should follow.

How To Read This Dataset
listing_id
stable row key
Quote this in support tickets. It is not a marketplace URL and cannot be traded.
listing_price_usd
asking price
What the reseller asked. Not the victim's real loss. Missing and outlier prices are excluded from price aggregates; no spend substitution.
Recorded spending / Inventory value
victim-side value
Purchase history and in-game assets recovered with the account — closer to true harm than the ask price.
origin
stealer · phishing · brute · resale · autoreg
How the credentials were obtained or re-listed. Drives the recovery branch you should follow.
Actor #N
anonymized seller
Stable alias for a source-market handle. Real handles are never published.
Growth delta
per-category · real window
Counted from collector snapshots. Window is labelled exactly (m/h/24h). No synthetic multipliers.

Account recovery · official platform support

Choose the platform for its official recovery route. Requirements differ by service; follow the evidence requests in its own support process. An archive match can support a report but cannot replace proof of ownership.