The Mindhunter Investigation: Every Trace Tells a Story

Not every influential threat actor operates a ransomware gang or runs a sophisticated hacking group. Much of today's underground ecosystem is driven by individuals who specialize in selling breached databases, cracked accounts, digital subscriptions, and other illicit services. While they may not be responsible for carrying out large-scale cyberattacks themselves, these actors help sustain the underground economy by making stolen data and compromised resources readily available to other criminals. Their activities often overlap with breach forums, Telegram communities, cryptocurrency networks, and dark web marketplaces, creating an ecosystem where cybercrime can continue to flourish.

One such actor is MindHunter, an online persona that has maintained a presence across multiple underground platforms for several years. Rather than being tied to a single marketplace or service, the alias appears across breached forums, Telegram channels, cryptocurrency infrastructure, and various underground communities, leaving behind a trail of digital artifacts that collectively reveal a much broader operational footprint than initially expected.

This report follows that trail from the point where the MindHunter alias first surfaced, gradually uncovering the infrastructure, online identities, historical activity, and cryptocurrency assets connected to the actor. Using StealthMole's historical indexing and cross-platform intelligence capabilities, the investigation demonstrates how seemingly unrelated pieces of information can be correlated to build a comprehensive profile of an underground operator and the ecosystem in which they operate.

Where the Trail Began

The investigation began during routine monitoring of StealthMole's Suspect Tracker, where an actor operating under the alias Mindhunter was identified. The profile had been categorized as a proxy seller, with additional detections linking the alias to other forms of illicit activity. While the initial profile offered only a limited snapshot of the actor, the combination of categories suggested that the alias was active across more than one segment of the underground ecosystem, making it a suitable candidate for a deeper investigation.

To better understand the actor's activity, the Mindhunter alias was next investigated using StealthMole's Leaked Monitoring module. The search returned eight indexed detections spanning August 2025 through May 2026, indicating that the actor had maintained a persistent presence across underground communities over several months rather than appearing in a single isolated incident.

Among the indexed results, one thread posted on patched immediately stood out. The post advertised Bet365 premium accounts with existing balances, suggesting that the actor was involved in the sale of compromised digital accounts alongside other services observed during the investigation. More importantly, the advertisement exposed two direct contact points that would become the foundation for the rest of the investigation:

• Telegram: https://t.me/I******s
• Discord: mindhunter****8

At first glance, these appeared to be ordinary contact details provided for potential buyers. However, rather than treating them as standalone artifacts, the investigation used them as pivot points to determine whether the same identifiers appeared elsewhere across StealthMole's indexed intelligence. That decision would ultimately reveal a far broader digital footprint than the original forum advertisement suggested.

Beyond the Advertisement

The Bet365 advertisement provided the investigation's first meaningful lead, but it was the author's patched profile that significantly expanded the available intelligence. Rather than focusing on a single marketplace listing, the profile offered additional identifiers that helped establish a broader picture of the actor's online presence.

The profile confirmed Mindhunter as an established member of the forum, showing consistent activity, community engagement, and the same Discord contact that appeared in the original advertisement. More importantly, it revealed a Bitcoin wallet address displayed discreetly within the profile:

• BTC: bc1q***********************cjz

The wallet was examined using StealthMole's cryptocurrency intelligence capabilities in an effort to identify additional infrastructure or financial activity. However, the investigation did not uncover any associated domains, indexed transactions, or other actionable intelligence linked to the address. While it served as another artifact associated with the profile, it did not provide a meaningful avenue for further expansion.

StealthMole's historical indexing, however, revealed a second Bitcoin wallet associated with the same user profile:

• BTC: 17T6S****************************A72T

Unlike the first address, this wallet produced several investigative leads. Analysis through Wallet Risk Check classified the address as Medium Risk, identifying suspicious activity and interactions with higher-risk cryptocurrency entities. The wallet was subsequently expanded using Crypto Tracker, which identified one transaction associated with Robinhood and eighteen transactions linked to Binance.

While these findings do not establish ownership of the counterparties involved, they demonstrate that the wallet associated with the Mindhunter profile had interacted with multiple cryptocurrency services over time, adding another layer to the actor's digital footprint.

Following a Single Lead

With the cryptocurrency infrastructure documented, the investigation returned to the Telegram handle @Im*****s, which had been published alongside the original patched.to advertisement. Rather than treating it as simply a contact method for prospective buyers, the handle was investigated through StealthMole's Dark Web Tracker to determine whether it had appeared elsewhere across the underground ecosystem.

The results immediately demonstrated that @Im******s was far more than an isolated Telegram account. The same identifier appeared across multiple underground forums, each exposing additional pieces of the actor's digital footprint and reinforcing the connection between seemingly unrelated platforms.

One of the earliest discoveries was a user profile on the Breached forum, where the Mindhunter persona again referenced @Im*****s as its primary contact point. The forum profile also contained historical activity and a publicly visible reputation record, providing further evidence that the alias had maintained a presence within established underground communities beyond patched.to.

• http://breached4w********************5q5uad.onion/User-MINDHUNTER

The investigation then uncovered another profile on Altenens, where the actor operated under the slightly modified username _MINDHUNTER_. Beyond confirming another long-standing account, the profile exposed additional personal details, including a listed birthday of 15 April, while once again referencing the same Telegram and Discord identifiers already observed during earlier stages of the investigation.

• https://altenens.**/members/_mindhunter_*******5/

Rather than treating _MINDHUNTER_ as a separate actor, the consistent reuse of usernames, profile branding, Telegram contact, and Discord identifier strongly suggested that both identities belonged to the same individual. This made _MINDHUNTER_ another valuable pivot for expanding the investigation.

Using the revised username, additional searches uncovered activity across several Cracked communities. One thread on cracked, advertising a doxxing method, immediately stood out because it reused the same profile picture and identical contact details that had already been observed on patched.to and Altenens. The consistency of these identifiers across independent platforms substantially strengthened the attribution linking the various accounts to the same operator.

• https://cracked.**/MINDHUNTER
• https://cracked.**/MINDHUNTER
• https://cracked.**/MINDHUNTER

The investigation also revealed that the actor maintained user profiles on both cracked.** and cracked.**, where additional infrastructure was disclosed. These profiles introduced another Telegram contact, a Discord invite, and a previously unseen Bitcoin wallet, each of which became new investigative leads.

• Discord: https://discord.com/invite/UW******f
• Telegram: @leak****e
• BTC Wallet: bc1q5tv*********************tflm

What initially appeared to be a single underground seller was now linked to multiple long-standing forum identities, reused branding, consistent communication channels, and an expanding collection of financial and operational artifacts. The newly identified Telegram channel and Bitcoin wallet would become the next focus of the investigation.

Expanding the Infrastructure

The profiles discovered across the Cracked forums introduced two previously unseen artifacts that warranted further investigation: the Telegram channel @leak***e and the Bitcoin wallet. Unlike the identifiers examined earlier, both appeared consistently across multiple forum profiles, suggesting they formed part of the actor's broader operational infrastructure rather than being isolated references.

• Telegram: https://t.me/leak***e
• BTC Wallet: bc1q5tv************************tflm

The Telegram channel https://t.me/leak****e was subsequently examined using StealthMole's Telegram Tracker, where it was identified as a channel titled "Leak Zone." Historical records showed that the channel remained active until approximately November 2024 and primarily advertised the same types of digital goods repeatedly associated with the Mindhunter persona, including premium account credentials and access to online subscription services. The overlap between the products promoted within the channel and those advertised across the actor's forum accounts reinforced the relationship between the channel and the wider Mindhunter ecosystem.

The Bitcoin wallet published on both cracked.** and cracked.** profiles also provided valuable financial intelligence. Analysis through StealthMole's cryptocurrency modules classified the address as Medium Risk, with historical blockchain activity observed between 2022 and 2023. Unlike the first wallet identified during the investigation, this address showed a considerably richer transaction history.

Further examination identified interactions with several cryptocurrency service providers and exchange-related entities, including Kraken, Coinbase, and Binance. While these observations do not imply ownership of the counterparties involved, they demonstrate that the wallet associated with the actor's forum profiles had engaged with multiple cryptocurrency services over time, providing additional context around the financial infrastructure supporting the operation.

Reconstructing the Telegram Persona

The investigation then returned to the Telegram account @Im****s, which had repeatedly appeared throughout earlier stages of the investigation. While the account initially appeared to be nothing more than another contact point used to advertise underground services, StealthMole's Telegram Tracker and historical indexing revealed that it represented one of the strongest attribution points uncovered during the investigation.

At the time of analysis, the Telegram account no longer displayed a profile picture, making visual attribution difficult through a conventional investigation. However, StealthMole's historical records preserved earlier snapshots of the account, revealing that it had previously used the same distinctive cat profile image observed across the actor's accounts on Breached, Altenens, and the various Cracked forums.

This historical continuity proved particularly significant. Rather than relying solely on matching usernames, the investigation was able to correlate historical profile images, persistent usernames, and previously identified contact information across multiple independent platforms. Collectively, these overlapping artifacts provided strong evidence that the Telegram account was operated by the same individual behind the MindHunter persona.

Historical records also showed that the account had evolved over time. Earlier snapshots identified the username as @Mindhunter_xdd, while more recent records showed a transition to @Im****s. Although the username and profile image changed over time, the underlying account remained consistent, illustrating how historical intelligence can preserve attribution even after an actor attempts to modify their online identity.

Beyond the account itself, StealthMole identified the user as a participant in at least twenty Telegram groups and channels, offering further insight into the communities in which the actor operated. Among the most notable were:

• Indian******Hub: https://t.me/indian*****hub
• Bi*****Indian: https://t.me/Bi********Indian
• Leak****nes: https://t.me/leak*******nes

Together, these communities reflected the actor's continued engagement with marketplaces and cryptocurrency-focused discussions while also revealing that the Leak Zone branding had continued into a newer Telegram community during 2025.

StealthMole also recovered multiple historical messages posted by the account across different Telegram communities. Although the messages varied in content, they consistently demonstrated active participation under the MindHunter persona and provided further evidence that the account remained operational across multiple years. More importantly, they established continuity between the forum identities documented earlier in the investigation and the actor's activity within Telegram itself.

Community Reputation and Scam Allegations

As a final step, the investigation examined whether the MindHunter persona had attracted discussion beyond its own advertisements and forum activity. This led to the discovery of a Telegram channel titled "Im*****s scam," which appeared to have been created by members of the underground community to document alleged fraudulent transactions involving the actor.

One of the most notable observations was the channel's profile image, which reused the same cat avatar historically associated with the MindHunter persona but altered it with a prominent "WASTED" overlay. The reuse of this distinctive image strongly suggests that the channel was specifically intended to target the operator behind the @Im*****s account rather than an unrelated individual.

Historical messages within the channel contained allegations from multiple users claiming they had been scammed while purchasing accounts or digital services advertised by MindHunter. Several posts accused the actor of reselling the same compromised accounts to multiple buyers, while others warned prospective customers against conducting business through the Telegram account.

These allegations could not be independently verified during the investigation and should therefore be treated as community claims rather than established fact. Nevertheless, the existence of a dedicated scam-reporting channel provides valuable context about the actor's reputation within the underground ecosystem and illustrates how trust and reputation remain significant factors even in illicit online marketplaces.

Conclusion

What began as the profile of a suspected proxy seller ultimately revealed a much broader and more persistent underground presence. Rather than operating through a single marketplace or relying on disposable identities, MindHunter consistently reused usernames, Telegram accounts, cryptocurrency wallets, profile images, and other digital artifacts across multiple forums and communication platforms. While each artifact offered only a small piece of the puzzle, correlating them through StealthMole gradually exposed a far more comprehensive picture of the actor's online footprint.

The investigation demonstrated how a single identifier can serve as the starting point for uncovering an entire ecosystem of interconnected infrastructure. Beginning with an entry in Suspect Tracker, the investigation expanded through Leaked Monitoring, Dark Web Tracker, Telegram Tracker, Wallet Risk Check, Crypto Tracker, and StealthMole's historical indexing capabilities. Each stage contributed new evidence that strengthened attribution and revealed relationships that would have been difficult to identify through isolated searches or conventional investigation techniques.

Beyond profiling a single threat actor, this case highlights the value of correlating historical intelligence across multiple underground environments. Even as online personas evolve through new usernames, migrated platforms, or updated profile information, historical artifacts often remain interconnected. By preserving and correlating those records over time, investigators can reconstruct operational histories that extend well beyond what is immediately visible.

Editorial Note

Attributing activity within underground communities is rarely straightforward. Threat actors frequently change aliases, migrate between platforms, and modify their operational infrastructure in an effort to reduce their visibility. As a result, reliable attribution depends not on any single indicator but on the careful correlation of multiple independent artifacts over time. This investigation illustrates how StealthMole can help transform scattered observations into a coherent investigative narrative while maintaining an evidence-based approach to attribution.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

Hitmen for Hire: Inside the Mexican Mafia Marketplace

Dark web has long been home to marketplaces advertising services that range from financial fraud and forged documents to far more serious offerings such as contract violence. While many of these platforms are little more than scams designed to steal cryptocurrency from unsuspecting buyers, others attempt to build credibility by presenting structured marketplaces, vendor profiles, discussion forums, escrow systems, and cryptocurrency payment infrastructure. Whether genuine or fraudulent, these platforms provide valuable insight into how criminal operators market themselves, establish trust, and maintain an online presence within underground communities.

One such platform is Mexican Mafia, a long-running dark web marketplace that presents itself as a directory of gang members and contract killers offering services worldwide. Beyond promoting alleged hitmen, the site also advertises other criminal services, including weapons, fraudulent documents, and opportunities for affiliates to earn commissions by driving traffic to the platform. The marketplace claims to operate through built-in and external escrow services, accepts cryptocurrency payments, and promotes anonymity for both customers and vendors.

This investigation examines the digital footprint surrounding the Mexican Mafia marketplace using StealthMole, tracing its infrastructure across historical and active onion domains, Telegram, cryptocurrency wallets, vendor profiles, and related underground resources. Rather than focusing on the claims made by the platform itself, the investigation follows the artifacts it left behind to understand how its infrastructure evolved and how different components of its ecosystem remain interconnected over time.

Behind the Landing Page

The investigation began with the discovery of an onion domain, which was indexed in StealthMole's Dark Web Tracker under the title "Mexican Mafia." The landing page presented itself as a marketplace where users could allegedly hire contract killers and other criminal service providers through an anonymous, cryptocurrency-based platform.

• qjq35*********************************************acid.onion

At first glance, the website resembled many other illicit marketplaces operating on the dark web. It promoted a network of "gangsters" offering a range of criminal services, including contract killings, forged documents, and assistance with what it described as "difficult people." The site claimed to protect both buyers and vendors through anonymous communication, cryptocurrency payments, built-in and external escrow services, and a policy of not collecting personal information. It also advertised a workflow where payments would only be released after a requested task had been completed, presenting these features as safeguards intended to build trust among prospective users.

Rather than relying solely on the current version of the website, StealthMole's historical indexing immediately revealed that the marketplace had been observed over an extended period, with more than twenty archived snapshots available for analysis. This indicated that the platform had maintained an online presence across multiple points in time, making it a suitable candidate for a deeper infrastructure investigation. The focus therefore shifted from the marketplace's advertised services to the digital footprint surrounding it, with the objective of determining whether additional infrastructure, recurring identifiers, and historical artifacts could be uncovered beyond what was visible on the landing page.

Beyond a Single Onion Site

To determine whether the Mexican Mafia marketplace extended beyond its primary landing page, the original onion domain was further investigated using StealthMole's Dark Web Tracker. This quickly revealed that the marketplace was not operating from a single onion service. Historical records identified another active domain using the same "Mexican Mafia" title, suggesting that the operators maintained multiple versions of the platform over time.

• tdmb4*****************************************gulyd.onion

The investigation also uncovered another onion service that functioned as a directory reviewing alleged murder-for-hire websites. The page assigned the Mexican Mafia marketplace a five-star rating and described it as "one of the few real hitman services around." While these statements cannot be independently verified and should be regarded as promotional claims published by another dark web service, the listing confirmed that the marketplace had visibility beyond its own infrastructure.

• cnpwz**********************************************zead.onion

More importantly, this review page exposed several contact artifacts associated with vendors advertising on the marketplace. Rather than focusing solely on the websites themselves, the investigation shifted towards these reusable identifiers, which often provide more reliable pivot points for uncovering related infrastructure. Among the artifacts recovered were three email addresses together with their associated PGP fingerprints:

Email Address	PGP Fingerprint
L****@dnmx.cc	B384*******************************295
way****@proton.me	1C16*******************************CF2
isellguns@m******com	0786********************************523

Of these, isellguns@m******com stood out as the most promising investigative lead. Unlike the other contact points, this identifier continued to reappear across multiple datasets during subsequent analysis, eventually linking together additional onion domains, vendor profiles, marketplace functionality, cryptocurrency artifacts, and Telegram activity. As a result, the remainder of the investigation pivoted away from the landing page itself and began following this single identifier to determine how extensively the Mexican Mafia marketplace was connected across the underground ecosystem.

Following a Single Identity

The vendor email isellguns@m******com was selected as the next investigative pivot due to its recurring appearance within the marketplace. Rather than serving only as a contact point, reusable identifiers such as email addresses often reveal infrastructure that is not directly linked from a website itself. To determine whether the address appeared elsewhere within the underground ecosystem, it was further investigated using StealthMole's Dark Web Tracker.

The search immediately uncovered two additional onion domains. The first was an inactive directory titled "Best List of Dark Web Vendors", where the same email address was listed alongside other underground vendors. Although the directory itself could not be directly attributed to the Mexican Mafia marketplace, it demonstrated that the contact information had been advertised beyond the marketplace's own infrastructure.

• bestlieb**********************************************ryd.onion

The second discovery proved considerably more valuable. StealthMole identified another active onion service, which presented another version of the Mexican Mafia marketplace. While maintaining the same overall branding and purpose, this deployment contained noticeably different content and exposed parts of the platform that were not visible on the original landing page. Rather than simply functioning as another access point, it provided a broader view of how the marketplace attempted to present itself to prospective customers and vendors.

• ocqren76bqb5vdggsialpskvdn53aryyimhp4hpbufn3f6qq36o4p6ad.onion

Compared to the original homepage, this version placed greater emphasis on explaining the marketplace's operating model. It promoted features such as encrypted communication, PGP support, built-in and external escrow services, an integrated Bitcoin mixer, and anonymous customer registration. The marketplace also described an order submission process in which customers could provide detailed information about a target, select a preferred service provider, or allow the platform to assign one automatically. Throughout the site, considerable effort was made to portray the marketplace as an organised service rather than a simple criminal advertisement.

Historical snapshots recovered through StealthMole also exposed features that were absent from the current landing page. These included an unmoderated discussion forum, an affiliate programme rewarding users for referrals, publicly accessible vendor profiles, recent forum discussions, and lists of active marketplace members. Together, these sections suggested that the operators were attempting to cultivate an ongoing user community rather than relying solely on one-off transactions.

One particularly interesting observation was the marketplace's repeated effort to establish credibility. Badges promoting "Top Service," "External Escrows Accepted," and "$0 Down Payment" appeared throughout the site, while separate pages attempted to reassure visitors about anonymity, operational security, and payment protection. Although none of these claims can be independently verified, they illustrate how the operators attempted to reduce scepticism and encourage engagement from potential customers.

Further investigation of this onion service uncovered several additional domains associated with the Mexican Mafia infrastructure:

• uuss*********************************************o6pr5yd.onion
• wyfa**********************************************4bo6yd.onion
• teclqm5qcfue7tnkpwkj63nodq77kppaqtacvr2gdubxx24kjadt55ad.onion
• 35cuaq55z6d2jods.onion
• lj5ponocadanu2vi7ol2g7o5h5btsql7twh6vlmys6ejvgybbfp22kyd.onion
• Killers6e7jq7a7z.onion

The investigation then shifted to StealthMole's Telegram Tracker, where the same email address, isellguns@m******com, was found in a Telegram channel. Unlike a forwarded message, the email appeared in a post published directly by the channel administrator together with the contact @TheC******y, indicating that it was being actively used as a point of contact. The channel also advertised additional payment methods, including PayPal and the Bitcoin address.

• PayPal: PayPal.me/gu****in
• Bitcoin Wallet: 1Jac********************fBQ

The repeated appearance of the same email address across onion services and Telegram made it one of the strongest correlation points identified during the investigation. What initially appeared to be a single vendor contact ultimately connected multiple marketplace deployments, vendor profiles, communication channels, and payment infrastructure, significantly expanding the digital footprint associated with the Mexican Mafia marketplace.

Following the Mirrors

The investigation of isellguns@m*****m also led to the discovery of another Mexican Mafia mirror domain.

• 4cfw************************************************xid.onion

Further analysis of this domain using StealthMole's Dark Web Tracker revealed that the platform itself pointed towards another active onion service, indicating that the operators maintained multiple deployments of the Mexican Mafia marketplace over time.

• i43v6*****************************************zyqd.onion

Unlike the previously recovered domains, this mirror provided additional historical context about the platform and became another valuable investigative pivot. Examination of its archived content uncovered several more onion domains associated with the same marketplace, many of which were no longer active but remained indexed through StealthMole's historical records.

The following mirror domains were identified during this stage of the investigation:

• uusssy2bf4bg2umkampjk2twps7hgrj7nnpv3z3nodxqh6agnz26tbyd.onion (inactive)
• uusssyqq7mwaja5o7phdcil2zjqcaujl4e6m67ftyjlb5eujd7e4phad.onion (inactive)
• uusssyqrsk3enryp2mg4hnuad5ogecgm4w3z2wltlm6s6i3xouvgvnqd.onion (inactive)
• mexican**********************************************kid.onion (active)

The recovery of multiple inactive mirrors demonstrated that the marketplace's infrastructure had evolved over time rather than relying on a single persistent onion service. Although several of these domains were no longer operational, StealthMole's historical indexing preserved their relationship to the broader Mexican Mafia ecosystem, allowing the investigation to continue beyond infrastructure that had already disappeared from the live dark web.

One historical mirror proved particularly useful. Investigation of

• uusssyqrsk3enryp2mg4hnuad5ogecgm4w3z2wltlm6s6i3xouvgvnqd.onion

revealed two Bitcoin wallet addresses embedded within the archived content:

• bc1q*********************************7pu6j
• bc1q**********************************ym3m

Both wallets were examined during the investigation and, at the time of analysis, neither had recorded any blockchain transactions. While this does not indicate how the addresses were intended to be used, it demonstrates that historical marketplace infrastructure preserved payment artifacts that could be investigated independently of the live website.

Hidden in Plain Sight

By this stage, the investigation had already uncovered multiple historical mirrors of the Mexican Mafia marketplace. To determine whether these archived domains contained additional intelligence beyond their webpages, one of the inactive mirrors was examined further using StealthMole's Dark Web Tracker.

• mexican******************************************kid.onion

Rather than exposing only archived webpages, StealthMole also preserved media files associated with the marketplace. These included numerous images hosted by the onion service, many of which were used as profile photographs and avatars for vendors and marketplace users. While these images did not independently identify real-world individuals, they provided additional artifacts that could be used to extend the investigation beyond conventional webpage content.

One of these indexed media files proved particularly valuable. Analysis of its associated metadata led to the discovery of another previously unseen mirror of the Mexican Mafia marketplace:

• mexicanw7smag2cf722ibcx3dgyluwxk4mfcwhtd3zsqsgptixxhieyd.onion

Unlike earlier mirrors, this version contained updated marketplace content that offered additional insight into how the platform continued to evolve over time. Historical snapshots recovered through StealthMole showed that the marketplace retained its core operating model while refining its presentation, expanding navigation menus, and further developing features aimed at both customers and vendors. New sections such as Top Vendors, Top Hitmen, and expanded marketplace guidance reflected an effort to present the platform as an established criminal marketplace rather than a collection of individual advertisements.

The archived pages also continued to promote customer registration, vendor recruitment, affiliate opportunities, and escrow-based transactions, demonstrating a consistent attempt to build trust within the underground community. Although these operational claims cannot be independently verified, their persistence across multiple generations of the marketplace illustrates how the operators sought to maintain a consistent identity despite repeatedly changing infrastructure.

The recovery of yet another mirror through indexed media files highlights an investigative advantage of StealthMole's historical indexing. Rather than relying solely on active onion services, archived media artifacts provided an additional pivot that exposed infrastructure which would have been difficult to identify through conventional browsing alone.

A Trail of Bitcoin

The investigation of this domain marked another turning point. Unlike the previously recovered mirrors, this version exposed a substantial amount of embedded financial infrastructure that could be used as new investigative pivots.

• mexicanw7smag2cf722ibcx3dgyluwxk4mfcwhtd3zsqsgptixxhieyd.onion

StealthMole identified ten embedded Bitcoin wallet addresses within the archived content of the marketplace:

• bc1q***********************************0fj
• bc1q***********************************unp
• bc1q***********************************nzk
• bc1q***********************************nuy
• bc1q***********************************dxm
• bc1q***********************************s2l
• bc1q***********************************arn
• bc1q***********************************2mm
• bc1q***********************************m7l
• bc1q***********************************uum

The same recurring email address was once again identified within this mirror, reinforcing the pattern observed throughout the investigation. By this stage, the email had already linked multiple onion domains, vendor profiles, and marketplace deployments. Its continued presence alongside newly recovered cryptocurrency artifacts further strengthened its value as a recurring investigative identifier.

• isellguns@m*****m

Conclusion

What began as the discovery of a single onion domain ultimately revealed a much broader ecosystem surrounding the Mexican Mafia marketplace. By pivoting through recurring identifiers, historical snapshots, archived media, mirror domains, and cryptocurrency artifacts, the investigation reconstructed multiple generations of the platform and uncovered how its infrastructure evolved over time. Rather than relying on a single website, the marketplace maintained a network of interconnected domains while repeatedly reusing contact information and other operational artifacts across different deployments.

Although the authenticity of the services advertised by the marketplace cannot be independently verified, its digital footprint provides valuable intelligence. This investigation demonstrates how StealthMole can move beyond surface-level discovery by correlating historical infrastructure, recurring identities, and cross-platform artifacts, enabling analysts to build a more complete picture of underground operations that would otherwise remain fragmented.

Editorial Note

Dark web investigations rarely rely on a single piece of evidence. Meaningful attribution is built by correlating multiple independent artifacts across different platforms and periods of time. This case illustrates how StealthMole helps investigators reconstruct hidden infrastructure, preserve disappearing evidence, and connect seemingly unrelated indicators into a coherent investigative narrative.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

The Many Doors of RansomHouse: Mapping an Evolving Ransomware Ecosystem

Ransomware groups rarely disappear when their infrastructure goes offline. Domains change, communication channels are abandoned, and public leak sites evolve over time, leaving behind fragments that can make long-term investigations difficult. While many ransomware reports focus on a single attack or victim, understanding how these groups maintain their presence across multiple platforms often provides a more complete picture of how they operate.

Among the many ransomware operations that have emerged in recent years, RansomHouse has established itself as a distinct actor. Since appearing in 2021, the group has publicly positioned itself as a data extortion operation, frequently claiming that victims are targeted for poor cybersecurity practices rather than relying solely on traditional ransomware deployment. Over time, it has published numerous victim disclosures through its leak site while continuously adapting the infrastructure used to support those operations.

This investigation takes a different approach. Instead of examining a single breach, it follows the digital footprint left behind by RansomHouse across its public infrastructure. Using StealthMole, the investigation reconstructs pieces of the group's online presence that are no longer readily accessible, revealing how websites, communication channels, and supporting infrastructure evolved over time.

Where the Trail Began

The investigation began with StealthMole's Ransomware Monitoring module, where RansomHouse was identified as an active ransomware operation. The group's most recent claimed victim at the time of investigation was a U.S.-based construction company, which appeared on the platform with an attack date of 29 June 2026. While the individual incident was noteworthy, it also raised a broader question: how extensive was RansomHouse's activity, and what digital footprint had the group left behind over the years?

To answer that, a broader search was conducted within the Ransomware Monitoring module using the RansomHouse identifier. The results showed that between May 2022 and June 2026, the group had claimed responsibility for more than 186 victim organizations, spanning multiple industries and geographic regions. The steady stream of disclosures over a four-year period suggested that RansomHouse was not a short-lived operation but one that had maintained a consistent presence within the ransomware landscape.

Beyond victim statistics, the platform also identified the group's primary leak site:

• zohlm7********************************************2yid.onion

The leak site served as the public face of the operation, hosting victim listings and data disclosures. Rather than ending the investigation with the group's victim count, this onion domain became the next investigative pivot. By tracing the infrastructure connected to the leak portal through StealthMole's Dark Web Tracker, the investigation aimed to determine whether RansomHouse relied on additional websites, communication channels, or supporting infrastructure that could help reconstruct its broader operational ecosystem.

Inside RansomHouse

Pivoting from the leak site into StealthMole's Dark Web Tracker provided a closer look at how RansomHouse presents itself beyond its victim listings. Rather than functioning solely as a repository for leaked data, the website is structured as a centralized platform that explains the group's operating model, manages victim interactions, and facilitates communication with external parties.

At the center of the website are two categories used to organize victims: Evidence and Disclosed. Organizations listed under Evidence have samples of stolen data published as proof of compromise, while those marked as Disclosed have had their full datasets released publicly. This staged approach allows RansomHouse to apply pressure during negotiations before proceeding to a complete disclosure if an agreement cannot be reached.

The website also contains a detailed Frequently Asked Questions (FAQ) section that offers insight into how the group portrays its activities. One of the recurring themes is its attempt to distinguish itself from conventional ransomware operations. Rather than describing itself simply as a group that encrypts systems for financial gain, RansomHouse claims to target organizations with weak cybersecurity practices and presents data disclosure as a consequence of inadequate security rather than the primary objective of the operation.

For affected organizations, the FAQ explains how victims can establish contact, negotiate, or request the removal of published material. It also provides guidance for organizations wishing to purchase their undisclosed data before it is made public, illustrating that the website serves not only as a disclosure platform but also as a negotiation and transaction portal.

Interestingly, RansomHouse also dedicates a section of the website to journalists and researchers. Media representatives are encouraged to contact the group directly for additional information or clarification regarding published breaches, reflecting an effort to shape public reporting around its activities. Alongside its Tor-based infrastructure, the group also advertises alternative communication methods, including an I2P address, providing additional resilience should parts of its infrastructure become unavailable.

Following the Mirrors

With a clearer understanding of how RansomHouse presents itself, the investigation shifted from examining the contents of the website to tracing the infrastructure supporting it. Using the group's primary onion domain as the investigative pivot, StealthMole's Dark Web Tracker revealed that the public leak site represented only a small portion of a much larger network of interconnected services.

One of the first discoveries was the existence of an additional RansomHouse-branded onion domain:

• xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion

Although no longer active, the domain hosted a mirror of the RansomHouse leak site during its operational lifetime. The preserved records indicate that it remained active throughout 2022 before eventually disappearing. Its discovery suggests that RansomHouse maintained multiple public-facing portals over time, providing redundancy while preserving access to victim disclosures.

As the investigation expanded, StealthMole identified a much broader layer of infrastructure supporting the operation. Rather than storing stolen data directly on the main leak portal, RansomHouse relied on numerous dedicated onion-based file servers to host disclosed datasets. Hundreds of these domains were identified, many of which are now inactive. Examples include:

• vopa354z4toilkjn4ileaf6rinkzn2givaokvj4yguq5kbiqoulxnzyd.onion
• m7vtnbsgctdcsccqmpnmi6igg3pcuiliqqqsq6uonkzg4blpa4eysiad.onion
• nuhnnxg3owawo36mwdffyblbzplhthfswny55mh7yhbxq74en6jihyad.onion
• q2bwuip5xq4qjn2vyevprcddhk26cigyqfqfu6yki7korjys2rposaad.onion
• ge74uts2ybu22kzwahiayovxelbq5fwhywl73agev5w4fef2e5ikplid.onion

The use of separate file hosting infrastructure demonstrates a deliberate separation between the group's public leak portal and the servers responsible for distributing stolen data. This layered approach not only improves operational resilience but also allows individual file servers to be rotated or abandoned without disrupting the primary website.

Additional infrastructure was uncovered while examining individual victim disclosures. One example involved Prince George County, where the published disclosure page directed investigators to another onion domain:

• yvqyd**********************************************raid.onion

The domain appeared to function as another dedicated file server containing the victim's disclosed data, reinforcing the pattern of decentralized data hosting observed throughout the investigation.

Beyond data hosting, StealthMole also identified two onion-based negotiation portals associated with the operation:

• secxrosqawaefsio3biv2dmi2c5yunf3t7ilwf54czq3v4bi7w6mbfad.onion
• am26uhnrvhikyekz7h5qgjhv6x4arnzpcr2tw4wxqdg7hw525xs4o2qd.onion

These portals appear to facilitate direct communication between RansomHouse and affected organizations, complementing the public-facing leak site and supporting the negotiation process described within the group's FAQ.

More Than Just a Hash

While the infrastructure analysis revealed how RansomHouse managed its public-facing operations, StealthMole also uncovered a technical artifact that offered another avenue for investigation. Unlike onion domains or communication channels, malware hashes can serve as persistent identifiers, helping investigators associate malicious files with related infrastructure and previously observed activity.

During the investigation, StealthMole identified the following SHA-256 malware hash associated with RansomHouse:

• efe27717*****************************************6a582

Rather than examining the hash in isolation, it was used as the next investigative pivot. This led to the discovery of another onion domain:

• jqmxd4j***************************************fktqd.onion

Although the domain appeared in connection with the malware artifact, the available evidence did not conclusively establish that it belonged to RansomHouse. No additional infrastructure, communication channels, or operational artifacts were identified that could confidently attribute the onion service to the group.

For that reason, the domain has been retained as an investigative lead rather than a confirmed component of the RansomHouse ecosystem. Maintaining this distinction is important, particularly in cyber investigations where infrastructure may be shared, repurposed, or coincidentally linked through third-party reporting. Treating every associated artifact as confirmed infrastructure risks creating inaccurate attribution.

Beyond the Onion

By this stage, the investigation had revealed a substantial network of websites, file servers, and negotiation portals supporting RansomHouse's public operations. However, ransomware groups rarely rely on websites alone. Communication platforms often provide a more dynamic view of how these groups announce new victims, interact with followers, and direct users across their infrastructure. With this in mind, the investigation expanded into StealthMole's Telegram Tracker to identify any channels or accounts associated with RansomHouse.

One of the first artifacts identified was the Telegram channel:

• https://t.me/ransom*******e

The channel primarily served as a public announcement platform, publishing updates on newly disclosed victims while directing users back to the group's onion infrastructure. During its investigation, StealthMole also identified another RansomHouse-branded onion domain referenced through the channel:

• xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion

Although the domain is now inactive, its discovery further supports the observation that RansomHouse maintained multiple public-facing portals throughout its operation.

The investigation then shifted to another Telegram artifact:

• https://t.me/R********s

Unlike the announcement channel, this account contained very little publicly available information. No significant digital footprint or public activity was observed, suggesting that it primarily functioned as a point of contact rather than a channel used for publishing operational updates.

Further analysis led to https://t.me/RH****s, which proved to be considerably more active. StealthMole identified both the associated user account @RH******s and the public Telegram channel of the same name. Historical records also showed that the account had changed its username on three separate occasions, indicating that its identity had evolved over time while remaining connected to the group's communication ecosystem.

Within the channel, investigators also identified an invitation to a private Telegram group named RH_Group:

• https://t.me/+VzR**********DUx

Alongside the invitation, the channel directed users to @RH******s as the primary contact point, illustrating how RansomHouse separated public announcements from direct communication.

Conclusion

What began as a routine review of a ransomware operation in StealthMole's Ransomware Monitoring module quickly evolved into a broader investigation of RansomHouse's digital footprint. Rather than identifying a single leak site, the investigation uncovered an interconnected ecosystem consisting of historical mirror domains, dedicated file servers, negotiation portals, malware artifacts, and a structured Telegram presence that supported the group's public operations.

The findings also highlight an important aspect of cyber threat investigations: the visible leak site is often only one component of a much larger infrastructure. By following each investigative pivot, it was possible to reconstruct parts of RansomHouse's operational ecosystem that are no longer publicly accessible, while also distinguishing verified infrastructure from artifacts requiring further validation. Maintaining this level of attribution discipline is essential, particularly when infrastructure overlaps or redistributed content can easily create misleading associations between unrelated threat actors.

This investigation demonstrates how StealthMole enables analysts to move beyond individual ransomware incidents and develop a broader understanding of how threat actors build, maintain, and adapt their digital infrastructure over time. By connecting historical records, dark web infrastructure, malware artifacts, and communication channels, investigators can reconstruct operational ecosystems that would otherwise remain fragmented across multiple sources.

Editorial Note

Attributing cybercriminal infrastructure is rarely straightforward. Domains are abandoned, communication channels change, and leaked data is frequently redistributed by unrelated actors, making careful validation an essential part of any investigation. This case illustrates StealthMole allows investigators to piece together a more complete picture while avoiding unsupported attribution, reinforcing the importance of evidence-driven intelligence throughout the investigative process.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com