convince

[Dark Web Intelligence @DailyDarkWeb]

@Europol @INTERPOL_HQ @thaipolice

This threat actor are selling access to the police forces worldwide.

Country / Agency Quantity Price

Indonesia 150+ emails stock $20

Ethiopia 2 emails stock $40

Tanzania Police 13,000 emails stock $5

Turkey 1 email stock $70

Palestine 4 emails stock $20

Serbia 3 emails stock $150

Vietnam 5 emails stock $60

Brunei 2 emails stock $40

French Polynesia 3 emails stock $70

Mongolia 20+ emails stock $35

Thailand 13 emails stock $60

Angola 3 emails stock $20

Kenya 5 emails stock $20

Zambia 650 emails stock make offer

French Justice 1 email stock $200

Brazil 3 emails stock $70

Argentina Police 1 email stock $90

Argentina .gov 2 emails stock $70

Paraguay 1 email stock $30

Nigeria Police 2 emails stock $50

Egypt Ministry of Finance 1 email stock $60

Bangladesh Police 1 email stock $70

Australia 1 email stock $400

Morocco 2 emails stock $70

Saudi Arabia 1 email stock $80

Nepal Police 3 emails stock $60

UAE 1 email stock $50

Peru Military 1 email stock $50

Argentina Judicial 1 email stock $70

Brazil Federal Military Police 1 email stock $150

Contact information

Telegram: https://t[.]me/renavol

Session: 05e58279259550de6a6338831d77ac2fe2494aa5251ba21be7d1a9d0b107789f52

Signal: convince.01

Qtox: D4DFAA0FB8C5ABB438A9D7ADB68D14CF962659EFC9254AFF93CEC1867C4C344DAD635A2481FA

Original post: https://breached[.]su/threads/domain-takedowns-forged-legal-docs-real-government-emails-police.88411/

[FrenchBreaches @Frenchbreaches]

🔴 Un hacker affirme pouvoir suspendre des domaines internet, usurper des accès gouvernementaux et contourner certaines procédures légales d’urgence grâce à des outils désormais proposés à la vente.

Parmi les contenus observés : ventes d’accès à des adresses gouvernementales compromises, faux documents judiciaires destinés à contourner des procédures d’urgence (EDR), services de suspension de domaines, ou encore outils présentés comme capables de provoquer des blocages administratifs de sites internet.

👉 Ces offres ciblent directement des entreprises, administrations, hébergeurs et fournisseurs de services, avec des risques majeurs d’usurpation, d’accès frauduleux à des données sensibles et de manipulation de procédures légales.

Dans un contexte où les cyberattaques se multiplient en France et à l’international, ce type de contenus montre une professionnalisation inquiétante des acteurs cybercriminels et l’importance de renforcer les contrôles de vérification, la sécurité des accès sensibles et les procédures internes de validation.

[IntelOps @IntelOpsV3]

How Threat Actors Abuse Legal Processes 🔥

A deep dive look at fraudulent subpoenas, warrants, EDR and the shinyhunters domain seizure

https://t.co/xYm1tqmBsJ

[FrenchBreaches @Frenchbreaches]

🔴 Un hacker affirme vendre plusieurs outils permettant de faire suspendre des domaines, usurper des accès gouvernementaux et exploiter de fausses procédures d’urgence contre des services en ligne.

https://t.co/MhlFAKZM7y

[ThreatMon @MonThreat]

🚨 Fraud-as-a-Service Campaign Targets Domain Suspension via Registrar Abuse and Legal Takedown Channels 🚨

A threat actor known as “convince” is advertising a Fraud-as-a-Service offering on underground forums, claiming the ability to forcibly suspend domains across major TLDs such as .com, .net, .org, .io, and .ai by abusing registrar abuse-reporting and legal takedown workflows. The service is marketed as a “Private Domain Suspension Method | Registrar Exploit 2026” and is positioned as a non-technical attack relying heavily on social engineering and process manipulation.

The offering is structured in two tiers, one providing a direct takedown service where the actor claims domains can be taken offline within 24 hours, and another offering a full methodology kit that teaches buyers how to replicate the process independently using prepared templates and submission channels.

According to the listing, the method focuses on bypassing frontline support and reaching registrar compliance or legal teams with forged or manipulated documentation, aiming to trigger actions such as domain suspension (clientHold status). The actor promotes the service for use against a wide range of targets, including competitors, journalists, researchers, and businesses.

Key risks highlighted by this activity include the ability to target high-value domains across multiple TLDs, the abuse of trust-based legal and compliance workflows, and the scalability of the method through resale of the toolkit.

#CyberCrime #FraudAsAService #DomainSecurity #ThreatIntelligence

[Dark Web Intelligence @DailyDarkWeb]

🇲🇾 🇦🇷 🇧🇷 🇵🇰 🇻🇳 🇧🇦 🇳🇬 🇹🇱 🇹🇭 Threat Actor Offering Abuse of Government & Law Enforcement Channels

A threat actor on BreachForums is advertising access to government and law enforcement email accounts, claiming the ability to abuse official channels for data requests and account actions.

The post suggests potential misuse of:

Emergency Data Requests (EDRs)
Subpoena-based data access mechanisms
Account suspension and content removal processes

The actor also claims to provide forged legal documents to facilitate unauthorized data access.

This highlights a growing risk: abuse of trusted legal and platform-based access mechanisms, rather than traditional exploitation.

At this stage, the claims remain unverified, but reflect an ongoing trend of attackers targeting trust-based systems.

#ddw #cybersecurity #threatintel #darkweb #infosec

[convince @c0nv1nce]

@headquartersXd @DarkWebInformer @fl33tingly how am i exposing myself

[convince @c0nv1nce]

@fl33tingly @DarkWebInformer nga you're a nobody to me, i don't even know you, and how could i possibly steal you're method... wow you're so smart dude!

[convince @c0nv1nce]

@JustWantToQ1 @XmrJon @DarkWebInformer I have an LE email, tons.

[Dark Web Informer @DarkWebInformer]

⚠️ A threat actor is selling a "domain suspension service" and a methodology kit on a popular cybercrime forum, advertising the ability to forcibly take down arbitrary domains, including .com, .net, .org, .io, and .ai, by abusing registrar abuse-reporting and legal-takedown channels.
⠀
‣ Threat Actor: convince
‣ Category: Fraud-as-a-Service / Domain Takedown
‣ Offering: "Private Domain Suspension Method | Registrar Exploit 2026"
‣ Industry: Domain Abuse / Social Engineering
⠀
The seller advertises two tiers: a one-time service to take a target domain offline within 24 hours (priced in XMR), and a full methodology package teaching buyers to replicate the attack. The listing claims the technique relies on social engineering of compliance teams using forged legal documents rather than any technical exploit.
⠀
Risk to defenders:
⠀
▪️ Targets domains across all major TLDs, including high-value .io and .ai
▪️ Designed to bypass registrar frontline support and trigger clientHold status
▪️ Marketed for use against competitors, journalists, security researchers, and legitimate businesses
▪️ Buyers are offered templates and submission channels designed to reach legal review queues

[Dark Web Informer @DarkWebInformer]

‼️ A threat actor is allegedly offering government and police email access for Emergency Data Requests (EDRs), forged court orders/subpoenas/MLAT documents, EDR services across major platforms, and domain suspension services on a popular cybercrime forum.
⠀
‣ Threat Actor: convince
‣ Category: Illicit Service / EDR Fraud
‣ Victim: Multiple governments, law enforcement agencies, and major platforms (Instagram, Facebook, WhatsApp, TikTok, Snapchat, Telegram, Microsoft, Apple, Twitter, Twitch, Snapchat, Domain Registrars)
‣ Industry: Government / Law Enforcement / Social Media
⠀
The actor claims to sell law enforcement email access tied to Law Enforcement Portals for major platforms, used to submit Emergency Data Requests and pull account data such as IP information, device details, email, phone number, and sometimes message logs. The listing also covers File Data Subpoena Requests (full Meta data including IPs, phones, emails, DMs, deleted posts, device info), Emergency Data Requests, forged legal documents, EDR submission services, and domain suspension.
⠀
What's offered:
⠀
Government / Police Emails (in stock):
▪️ Malaysia gov: $60
▪️ Argentina Police: $80
▪️ Argentina Provincia Buenos Aires: $60
▪️ Brazil Military Police: $100
▪️ Pakistan: $40 (NEW)
▪️ Vietnam: $40 (NEW)
▪️ Bosnia and Herzegovina Gov: $50 (NEW)
▪️ Nigeria Gov: $30 (NEW)
▪️ East Timor: $20
▪️ Brazil Secretaria da Administração Penitenciária: $50
▪️ Royal Thai Police: $60 (RECOMMENDED)
⠀
Forged Documents:
▪️ MLATs, Subpoenas, Court Orders for data requests: $100
⠀
EDR Services (start at $200):
▪️ TikTok, Snapchat, Twitch, Twitter, Domain Registers, Instagram, Facebook, Microsoft, WhatsApp
⠀
Domain Suspension:
▪️ Unpopular domains only: $300
⠀
Data obtainable through these requests:
⠀
▪️ IP information (last IP)
▪️ Device information
▪️ Email
▪️ Phone number
▪️ Message logs (sometimes)
▪️ Direct messages (with Search Warrant)
▪️ Deleted posts

[convince @c0nv1nce]

@DarkWebInformer
new https://t.co/fQXaB2WMo6 post!!
https://t.co/owH445SOmi

[convince @c0nv1nce]

@TeamE81909 @DarkWebInformer it's not a scam lol

[Dark Web Informer @DarkWebInformer]

‼️🌍 A threat actor is selling government and police email access along with law enforcement portal credentials for Emergency Data Requests (EDRs) across multiple countries.

The actor states the following are in stock:

▪️Argentina Police ($80)
▪️Argentina Provincia Buenos Aires ($60)
▪️Brazil Military Police ($100)
▪️Pakistan ($40, new)
▪️Vietnam ($40, new)
▪️Bosnia and Herzegovina Gov ($50, new)
▪️Nigeria Gov ($30)
▪️East Timor ($20)
▪️Brazil Secretaria da Administração Penitenciária ($50)
▪️Royal Thai Police ($50, recommended)
▪️Angola ($20)

[convince @c0nv1nce]

still alive.

[convince @c0nv1nce]

@larp1ngs silly goober

[convince @c0nv1nce]

mfs after they discover kali linux on mobile:

[convince @c0nv1nce]

@rift667678 @Convert_pls what do you except, a female owns doxbin.

[convince @c0nv1nce]

@IntelBrokerBF CYBERNIGGERS!! :3

https://t.co/uD95Roi6X5

#BreachForums