Under a Borrowed Banner: Tracing Uways Qarani's Claimed Ansar Allah Cyber Campaign

On 28 September 2026, the anniversary of Hassan Nasrallah's killing, a forum account called UWAYS announced that it had taken over Saudi Arabia's largest military hospital. The post promised the medical records, identity cards and movements of Saudi officers, and it was signed in the name of Uways Qarani, a group calling itself the cyber arm of Ansar Allah's Cyber Defense Organization.

That signature carries weight. The United States has designated Ansar Allah, Yemen's Houthi movement, a Foreign Terrorist Organization since 5 March 2025, and a Houthi cyber unit leaking data on Saudi military personnel would mark a new front in a long war. Uways Qarani itself is not designated, and nothing in its posts explains who runs it.

The group was barely five weeks old when the hospital post appeared. In that time it had claimed attacks on power grids, water plants, a taxi app, a chemical manufacturer and a French software vendor, across four countries. This investigation started from the hospital claim and worked backwards through the group's forum activity, website and Telegram channel to answer two questions: how the operation actually works, and how much of its Ansar Allah identity holds up.

A Hospital on the Anniversary

The case opened with a Government Monitoring alert in StealthMole. It pointed to a Raidforums thread titled "Saudi Arabia's Largest Military Hospital," posted by UWAYS on 28 September 2026. Raidforums.** is one of several forums operating under the RaidForums name since the original was seized in 2022.

• https://raidforums.**/Thread-Saudi-Arabia*************Hospital

The post named its target as Prince Sultan Military Medical City (PSMMC) in Riyadh, run by the Saudi Ministry of Defense. It claimed treatment files, ID cards, full patient and staff lists, and details of senior officers' movements and health, and it told readers a sample was already available to download. There was no price and no contact for buyers. Whatever this was, it was not a sale.

The account profile was the first thing that looked unusual. UWAYS held the forum's top "GOD User" rank, had joined in August 2026, and showed 11 posts and 11 threads. It had never replied to anyone. An account that only ever opens new threads is not taking part in a forum; it is using it as a noticeboard.

• https://raidforums.**/User-UWAYS

A StealthMole Leaked Monitoring search on the same author returned four threads in the same tone:

• Fu Pao Chemical Hacked (16 September 2026)
• France Altagem Hacked (21 September 2026)
• SAUDI Intelligence Officers’ Database (05 October 2026)
• Mohammed Hadi Al-Rasheed Co Breach (13 October 2026)

The first claimed 43 TB of data taken and wiped from a Taiwanese maker of electronic insulating materials, framed as a blow against suppliers to Israel's Rafael and Elbit. The second claimed client and user data from Altagem, a French developer of field-operations software for municipalities.

• https://raidforums.**/Thread-Fu-Pao-Chem********d
• https://raidforums.**/Thread-France-Alt*********d
• https://raidforums.**/Thread-SAUDI-Inte********se
• https://raidforums.**/Thread-Mohammed-*********ch

All three posts followed one script: a religious invocation, a campaign-style headline, a political justification, and a closing block listing:

• Site: www.uways**.**
• Telegram: https://t.me/UW******I
• Download Data Button

Built in a Day

Uways website turned out to be an Arabic-language WordPress site with a hooded figure in Yemeni colors for a logo, a Telegram button, and two pages of posts. The oldest, dated 22 August, was an "official statement" announcing the launch of the Uways Qarani electronic hacking group under a "newly established" Ansar Allah Cyber Defense Organization. Every post after it is a claim.

After this, the telegram account was further investigated in StealthMole's Telegram Tracker. It was found linked to channel ID 4301627740 titled UWAYS QARANI, with the Uways website as its bio and 199 indexed messages.

The channel's own history shows it was created on 22 August 2026, the same day as the website statement. The forum came a day later: the Raidforums profile records a joining date of 23 August 2026, the date of the group's first claim, an attack on Israeli power plants. The earliest forum trace in StealthMole is a 25 August post by UWAYS in the World News section of raidforums.**, a second forum using the same name.

Three channels set up within about 24 hours, each with matching branding and cross-links, is not how a hobbyist group grows. It points to a persona that was planned before it was switched on. The forum account confirms the impression: by 16 September it had spent 2 hours, 35 minutes and 2 seconds online in total, with no username changes. It logs in, posts a claim, and leaves.

The founding Telegram post also shows how the group wanted to be seen. Alongside the logo, it attached a screenshot of an Israeli Channel 12 news segment whose Hebrew caption reports a Houthi cyberattack on more than 45 Israeli organisations. We could not establish when that segment aired or whether it had anything to do with this group, but its use at launch is telling: the group introduced itself by pointing to someone else's headlines.

How a Claim Travels

The site's RSS feed, covered in detail below, carries exact publish times. Lining them up against the Telegram and forum records shows a fixed order: website first, Telegram within minutes, the forum later.

Claim	uways.** (UTC)	Telegram (UTC)	raidforums.** (UTC)
PSMMC hospital, 28 Sep 2026	11:14:08	11:17:33	11:28
Saudi water supply, 26 Sep 2026	08:38:03	08:38:09	not captured
Altagem, 21 Sep 2026	05:45:10	05:48:40	06:08
Fu Pao Chemical, 16 Sep 2026	10:50:24	not captured	11:18

The website is the record, Telegram is the alert to supporters, and the forum is the push to a criminal audience that trades in data. The forum footer's server clock matched StealthMole's capture times, so all three sources are on the same UTC clock. The audience is small. The channel had 422 subscribers, and its founding post drew 403 views.

StealthMole's Darkweb Tracker found the Telegram link on only two places:

• Raidforums.**
• Uways**.***

Reach comes from a handful of sympathetic channels instead. "We Are Anonymous" channel forwarded the hospital claim 88 minutes after the original, and forwarded the 4 October intelligence-officers post nine seconds after it appeared. A nine-second gap is either automation or someone watching the channel in real time. A pro-Axis of Resistance news channel reposted the Waselni claim and an earlier water threat.

Warn, Strike, Escalate

Piecing together the forum, the website and a Telegram search for the group's Arabic name ("أويس القرني") in StealthMole gives a near-complete record of six weeks of activity. The Latin-script searches had missed most of it, because the channel writes in Arabic.

Date (2026)	Claim	Target country	Proof offered
22 Aug	Founding statement	—	—
23 Aug	Several power plants knocked offline	Israel	—
24 Aug	Warning of imminent attacks on Saudi "vital infrastructure"	Saudi Arabia	—
25 Aug	Attack on K-and-Decide, a French company	France	Video
31 Aug	Breach of Al Saif Transport, "the Saudi regime's largest logistics company"	Saudi Arabia	"12K" sample file
1 Sep	Control of SCADA systems at desalination plants	Israel	Video
2 Sep	"More than 600" industrial controllers in water and power	Israel	Four videos
7 Sep	Threat that Saudi water "should not be counted on" to keep flowing	Saudi Arabia	—
13 Sep	Waselni taxi app, full driver and rider databases	Saudi Arabia	Database file
16 Sep	Warning to Taiwan, then Fu Pao Chemical an hour later	Taiwan	Defacement archive, file
21 Sep	Altagem, French municipal software	France	File, admin-panel image
26 Sep	Saudi National Day taunt, then full control of Saudi water supply	Saudi Arabia	—
28 Sep	Teaser to the Saudi MoD at 05:58, hospital claim at 11:14	Saudi Arabia	File
4 Oct	500 senior officers of the General Intelligence Presidency (GIP)	Saudi Arabia	File
5 Oct	The entire GIP database	Saudi Arabia	File

The Warning Comes First

Uways Qarani repeatedly announces an attack before it claims one. The 24 August warning to Saudi Arabia was followed by the Al Saif claim a week later. The 7 September water threat came 19 days before the water claim.

On 16 September, a warning to Taiwan's "so-called government" at 09:51 preceded the Fu Pao post by an hour. On 28 September, a teaser promising the Saudi Ministry of Defense "a very big surprise" came about five hours before the hospital post. Announcing in advance builds an audience that is already watching when the claim lands, and it makes any outage in the meantime easy to claim.

Every Target has a Grievance Attached

The targets are chosen for the message, not the access. France is hit, according to the posts, for "hostile statements" against Yemen and the "Resistance Front." Fu Pao matters because of its claimed role supplying Rafael and Elbit to Israel. The water claim follows Saudi strikes on Yemeni water facilities, which the channel mocked in a reply on 26 September. The hospital post is pinned to the Nasrallah anniversary. Saudi Arabia accounts for eight of the fourteen entries after the founding statement, and the share grows over time.

From Disruption to People

The nature of the claims changes across the six weeks. In August and early September the group claimed infrastructure effects: power plants off, controllers taken over, terabytes wiped. These are the hardest claims to check and the easiest to make, and they came with videos rather than data.

From 31 August the claims shift to data leaks with downloadable files. Then the data starts being sold as a targeting tool. The Waselni post boasted that rider data had been cross-matched to track senior officers. The hospital post claimed officers' "physical vulnerabilities and movements." The 4 October GIP post went further, saying the 500 officers had been matched against the Saudi water-subscriber data claimed the week before to find their homes. Each leak is presented as building on the last.

Whether or not any of this data is real, the framing is designed to frighten Saudi military and intelligence personnel and to suggest they can be found. If even part of it is genuine, the risk is no longer reputational.

The October threads

The two GIP threads moved from World News to the forum's Leaks section. The first, "Saudi Intelligence Officers DB" (4 October 2026), claimed full details on 500 officers and accused them of working with Mossad and the UAE under forged diplomatic cover; it named one officer outright.

• https://raidforums.**/Thread-Saudi-Intel*************DB

The second, "SAUDI Intelligence Officers' Database" (5 October 2026), raised the claim to the entire database: names, phone numbers, home addresses, positions, case files, the organizational chart and the list of stations abroad.

• https://raidforums.***/Thread-SAUDI-Inte***************se

The forum's own counters show where the attention went. By 5 October the hospital thread had 1,647 views, up from 1,449 the day before, and the Al Saif thread had 3,581, the most of any UWAYS post. The audience responds to downloadable data, not to claims about power plants. The account also made its first reply, in its own hospital thread on 29 September, and its reputation slipped from 30 to 29.

One Server Behind the Leaks

The Altagem thread linked its proof to http://146.1**.**5.**/files/altagem.zip, and the 4 October thread pointed to http://146.1*.1**.**/files/GIP.zip.

Two claims on the same address were enough to search the IP itself. StealthMole returned almost nothing on it: one domain hit (Raidforums.**) and two copies of the same file, collected on 29 September. That file was the website's own RSS feed.

Field	Value
File path	https://uways*.**/category/uncategorized/feed/
Size	144,431 bytes
SHA256	5a3f5ae**************************0f4b
MD5	979*******************************d9d
Last build	28 Sep 2026, 11:14:08 UTC
Generator	WordPress 7.1.2

The feed carries the full Arabic text of the ten claims from 23 August to 28 September, each with its WordPress post ID and exact publish time. The author field is empty on every post. It also names victims the English forum posts left vague: the 25 August French target was K-and-Decide, and the "largest logistics company" of 31 August was Al Saif Transport, whose sample file is labelled "Download 12K PoC."

Most useful are the download links. Every leak with a file points to the same folder:

Claim	File on 146.1*.1**.**/files/
Al Saif Transport	Al Saif Transport - UWAYS QARANI.zip
Waselni	Waselni UWAYS QARANI.zip
Fu Pao Chemical	IT fupao com.zip
Altagem	altagem.zip
PSMMC	PSMMC.zip
GIP, 4 Oct	GIP.zip
GIP, 5 Oct	GIP-UWAYS-QARANI.zip

Seven leaks across five weeks, all from one bare IP with no domain in front of it. That is the group's distribution point, and the most stable technical marker it has. It is not proof of ownership; the server could be rented or borrowed. The infrastructure claims, by contrast, rely on videos hosted on the WordPress site itself (plc4.mp4, plc6.mp4, plc9.mp4, plc28.mp4, wateril4.mp4, kd.mp4). The Fu Pao post's archive link is labelled "Site Deface," which makes clear that proof was a defaced web page, not data.

How the posts are written

The feed's HTML also shows how the statements are produced. Several posts carry leftover attributes such as data-start, data-end, data-is-last-node and class names like PDq2pG_selectionAnchorContainer. These do not come from WordPress; they are carried over when formatted text is copied from another web editor and pasted in. The data-start/data-end pattern in particular is typical of text copied out of AI chat interfaces.

That fits two other signs. The Altagem forum post had the same kind of pasted residue in its BBCode, and the English and Arabic versions of the Fu Pao statement read like two different translations of one source. The likely workflow is a single statement drafted once, then run through an editing or translation tool for each platform. It cannot tell us who the operators are, but it does suggest a small team, or one person, producing polished copy in more than one language.

Whose Banner?

Every statement Uways Qarani has published, from the founding post to the GIP leak, is issued in the name of "Ansar Allah's Cyber Defense Organization." Some say the group acts "under the banner" of it, others "by order of" it. If that organization is real and the link is genuine, these are leaks by a unit of a designated terrorist organization. So the obvious test was to look for the organization itself.

A search for its Arabic name, "منظمة الدفاع السيبراني", returned 33 Darkweb Tracker results and 14 in Telegram Tracker. All 33 dark-web hits were on uways.***.

Of the 14 Telegram results, 11 were posted in the UWAYS QARANI channel, two were reposts of Uways claims in other channels.

That absence matters more than any single claim. No Ansar Allah outlet, no al-Masirah channel and no Yemeni Armed Forces spokesman channel mentions the organization, the group or its website. The founding statement itself calls the organization "newly established," so parent and child appear together, and only one of them ever speaks.

The Ansar Allah-related material that did surface on the broader search does not close the gap. Ansar Allah Media is a private Telegram user account created in April 2025 with an unrelated devotional bio. "أنصار الله الإلكتروني Ansar Allah Electronic" is a pro-Houthi aggregator that forwards armed-forces statements, with no Uways content in its snapshot.

A March 2026 post on "Resistance Toast [Cyber Army]" announcing the "debut" of an "Ansar Allah cyber team" shows the brand was in use five months before Uways Qarani appeared, but nothing links the two.

The traffic that does exist runs one way. On 7 September the UWAYS channel forwarded a video about a missile strike on Saudi "mobilisation" forces, with a call to "join us." The group places itself inside the Houthi media world by sharing its content. We found nothing coming back.

What The Group Says About Itself

The founding statement is also internally awkward. It says the group will "operate independently" and also "under the direct leadership of Ansar Allah." It credits years of training and guidance not to Ansar Allah but to leaders of the "جبهة حنظلة للمقاومة الشعبية", the Handala Popular Resistance Front, and declares loyalty to that front. A Yemeni unit announcing itself by pledging loyalty to a different organization is not how a chain of command usually presents itself.

Handala is quite well known underground. StealthMole's March 2026 investigation into the pro-Palestinian Handala group recorded a Telegram channel named HANDALA_HPR2 and an X account HPRSEC. The two groups also share a style of escalation: in March 2026 Handala ran an "unprecedented disclosure" of 50 senior Israeli Air Force officers' details; in October Uways Qarani ran an "unprecedented publication" of a Saudi intelligence officers' database. Both run a Telegram hub, a self-hosted leak site and downloadable proof.

• Handala’s Digital Battlefield: Uncovering the Infrastructure of an Anti-Israel Hacktivist Campaign

These are parallels in naming and method, not shared infrastructure. No IP, domain, account or file connects the two in StealthMole's data. The evidence fits at least three readings:

1. A genuine Houthi cyber unit that took its training and playbook from Handala, as it says.
2. A Handala-linked operation adding a Yemeni identity to reach Saudi targets under a new name.
3. An independent persona borrowing two recognized names for credibility.

The group's habits lean towards the third more than the first. It launched on someone else's news coverage, posts on a forum borrowing a seized brand's name, and attributes its operations to an organization that only it mentions. That pattern is consistent with a persona built to borrow legitimacy, though it does not rule out a real link that is simply not public. On the evidence available, the Ansar Allah affiliation is a claim the group makes, consistently and loudly, and nothing more can be confirmed.

Operational Assessment

Uways Qarani should be treated as an active, Saudi-focused hack-and-leak operation whose claims are unverified but whose intent is clear. Its value to defenders lies less in any single leak than in how predictable it has become.

• Saudi military and security personnel are the primary audience. The group has moved from infrastructure claims to data presented as a way to locate individuals. If the PSMMC and GIP files are even partly genuine, the exposure goes beyond embarrassment; even if they are not, the posts are designed to make personnel feel watched.
• Warnings give defenders lead time. Advance threats have preceded claims by between one hour and 19 days. The UWAYS QARANI channel and the uways.to feed are the places to watch, since claims appear there before they reach the forum.
• Suppliers and software vendors are targets by association. Altagem and Fu Pao were chosen for who they serve, not who they are. Vendors to Israeli defence firms and firms serving governments the group calls "hostile" fit the same logic.
• The file server is the most useful indicator. Every downloadable leak so far has sat under 146.19.125.57/files/. A new file there is likely to mean a new claim; a move to a new host would be a sign the group has noticed it is being watched.
• Dates matter. The group times posts to anniversaries and national days. Upcoming Saudi, Israeli and "Axis of Resistance" commemorations are likely moments for new claims.

Conclusion

What began as a single hospital claim turned out to be the most recent post in a deliberately built operation. Uways Qarani launched its website, Telegram channel and forum persona within a day of each other, publishes every claim in the same order across them, and serves every leak from the same server. Over six weeks it moved from claiming damage to infrastructure towards releasing data framed as a way to find Saudi officers.

The question the group most wants answered for it, who it fights for, is the one the evidence answers least. Its Ansar Allah affiliation is asserted in every statement and confirmed by no other source in the data. The organisation it claims to serve exists only in its own posts, and the loyalty it actually declares is to a Handala-branded front that StealthMole has tracked before. Until Ansar Allah or its media acknowledge the group, the banner it flies should be read as a claim, not a credential.

Editorial Note

Dark-web investigations rarely end with a name and an address. This one rests on what a group chose to publish about itself, and that material is built to persuade, so much of it can be recorded but not confirmed. StealthMole's monitoring and historical indexing made it possible to set the group's own forum posts, website feed and Telegram messages side by side and see where they agreed and where the story fell away. Attribution here is limited to what the data supports, and the gaps are stated as gaps.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

The Many Hats of Lupin: Tracing a UK Password Dump Back to a Personal Telegram Past

Underground data sellers rarely stay in one place for long. A single actor might post a sale on one forum, run a storefront through a Telegram channel, and keep a personal account tucked away on a platform that has nothing to do with stolen data at all.

The identities used across these spaces are not always consistent either. Usernames get banned, channels get taken down, and the same person quietly resurfaces under a new name while keeping the same branding, the same contacts, or the same habits that gave them away in the first place.

One such actor is ImLupin, a seller who first surfaced through a leak posted on the forum patched.to. What began as a single UK email and password dump grew, over the course of the investigation, into a much wider picture of who this actor is, how their operation is structured, and where the trail eventually thins out.

This report follows that investigation from the original post through the Telegram infrastructure built around it, into a personal account that predates the ImLupin persona by years, and finally into the leaked data that was examined for attribution and found wanting.

The First Trace of Lupin

The investigation began with StealthMole's Leaked Monitoring tool, which had indexed a post from a seller operating under the name ImLupin on the patched forum. The thread advertised a fresh dump of UK email and password combinations, one of 208 similar listings tied to the same actor inside StealthMole's monitoring results.

• +15,000 PURE UK UNITED KINGDOM MAIL:PASSWORD | FRESHLY DUMPED | ULTRA HIGH QUALITY
• https://patched.**/thread-3******0.html

The forum profile behind the post told its own short story. ImLupin had joined the patched forum in May 2022, carried a negative reputation score, and was already marked as banned by the time the thread was captured. The account itself showed as offline.

None of that was unusual for a seller working the leak forums, but it was enough to justify a closer look at what the actor had left behind inside the thread itself.

Following the Storefront

Buried inside the thread was a set of contact links, the kind of detail a seller leaves behind so buyers know where to find them once a listing goes cold or a forum account gets banned.

• Telegram: https://t.me/Lu*******e
• Telegram: https://t.me/O********s
• Discord: https://discord.gg/Tw********KU

The telegram link t.me/Lu******e was further investigated in StealthMole’s Telegram Tracker, which led us to channel called Lupin | Hub. This channel carried the same branding, a top hat and monocle logo that would turn out to be a consistent signature across everything ImLupin touched.

Inside the channel, a message from September announced that the operator had lost access to their previous channels again and was posting new ones to replace them, listing an Open Ups channel at @Op*****n and a contact handle at @Lupin*****k. That single phrase, losing access again, would repeat itself several more times before the investigation was finished, and it became one of the clearer behavioral markers tying the different channels back to the same operator.

A Name Behind the Alias

The Telegram handle @Lu*******e was further run through StealthMole's Telegram Tracker, which returned something the forum posts never could: a numeric Telegram user ID, permanent and far harder to fake or recycle than a username.

• Telegram User ID: 5717234229

StealthMole's historical indexing held two snapshots of that ID. In the earlier one, dated 2 January 2023, the account carried the username @lu********e and a first name of Nordik, with a profile photo of someone standing outdoors at sunset, their back to the camera.

Nine days later, the same numeric ID showed up under a new username, @Kos*****un, this time with a close, face-forward photo. The first name Nordik stayed constant through the change, and because the underlying ID never moved, the two snapshots could be tied together with real confidence rather than a guess based on a shared display name.

This was the first indication that ImLupin was not simply a forum handle invented for the purpose of selling data. Behind it sat a Telegram account with a history stretching back years before the patched.to thread was ever posted.

A Voice in a Palembang Group Chat

StealthMole's Telegram Tracker also indexed messages sent by the user across the channels it had participated in. Eight results came back, several of them from a community called the Palembang Telegram Group, posted the same day the username changed to @Kos******un.

It is worth mentioning that Palembang is a city in South Sumatra, Indonesia, and the messages themselves were written in casual Indonesian slang, the kind of unguarded chatter that has nothing to do with a criminal persona and everything to do with an ordinary local group chat.

Actors rarely apply the same discipline to their personal accounts that they apply to their sales fronts, and this group, joined under the real-looking name Nordik rather than a leak-seller alias, was a small but genuine crack in that discipline. Taken together with the group's name, it points toward Indonesia as the actor's likely home base, a detail that would later sit alongside, and in one case complicate, a separate lead pulled from leaked breach data.

Rebuilding After Every Ban

Returning to the storefront side of the investigation, StealthMole's Dark Web Tracker was used to pull the full history behind the Telegram channels ImLupin had built. A clear pattern of rebranding emerged, each cycle triggered by the same complaint: access lost, channels rebuilt, buyers redirected.

• Personal contact: @Lu*****a (old) leading to @Lu*****k (current)
• Vouches channel: @Lu****t (old) leading to @Vou*******n (interim) leading to @Re*********n (current)
• Storefront channel: Lupin | Hub, then Lupin | Verified Accounts, then Your best option, 441 subscribers at time of capture

A channel called HitR, 74 subscribers and linked in its bio to @Lu*****k, added a different kind of detail. Rather than sales copy, the channel carried forwarded output from credential-checking tools, one run posted by an account called Chodev showing plaintext hit results, and another forwarded from a source labelled DATA LOOKUP showing a checker processing thousands of records with a live hit count. Neither Chodev nor DATA LOOKUP has been resolved to the same operator yet, but both represent a plausible next pivot into the tooling side of the operation rather than just its storefronts.

Two Storefronts Behind One Persona

The Dark Web Tracker also surfaced two dedicated websites operating under the Lupin branding, each a step up from a simple forum listing into something closer to a functioning storefront.

• Lupin | Valid Cloud, a subscription service selling checked mail access across Hotmail, Spectrum, Comcast, Yahoo, Gmail, and Seznam, priced from $29.99 for seven days up to $69.99 for thirty
• Lupin Open Ups, a marketplace for verified accounts across major banks, payment processors, crypto exchanges, and OnlyFans, accepting Bitcoin, Litecoin, Ethereum, and USDT

Neither site was a one-off listing. Both were built to look permanent, with pricing tiers, feature lists, and ongoing support, and both carried the same top hat and monocle branding seen everywhere else in the investigation. Whatever ImLupin's role in the wider leak-selling ecosystem, this was not a single seller posting one thread and disappearing. It was a small, maintained business.

A Trail Across the Forums

With the Telegram side of the operation reasonably well mapped, the investigation turned back to ImLupin's presence across the wider forum ecosystem. ImLupin username was further investigated in StealthMole's Dark Web Tracker, which led to a further set of profile pages, spread across underground platforms like cracked.**, xreactor.***g, niflheim.****d, xforums.**, leetforums.**, voided.**, and spear.**.

• cracked.**/ImLupin - 17 July 2022
• leetforums.**/members/imlupin.8***7
• xreactor.***/members/imlupin.7****9
• niflheim.*****d/members/imlupin.5****2 - 26 July 2026
• voided.**/ImLupin - 26 July 2026

The recurring join date across nearly every one of these forums, the 26th of July 2026, stood out more than any single profile did on its own. Registering across five separate forums within a day or two is not typical browsing behavior. It reads as a deliberate, coordinated rebuild, consistent with an actor re-establishing themselves after losing access elsewhere, the same pattern already seen playing out repeatedly on the Telegram side. The voided platform profile's recent threads told the rest of the story in numbers: a steady cadence of dumps through late August.

Conclusion

This investigation began with a name attached to a single UK password dump on patched.to. By the end of it, that name had unfolded into a Telegram operation rebuilt through at least three separate bans, two functioning storefront websites, a presence across seven underground forums registered within days of each other, and a personal Telegram account, tied to a permanent numeric ID, that traced back to an ordinary group chat in Palembang, Indonesia, years before any of the selling began.

Not every lead closed cleanly. The leaked MemeChat record offers the most credible thread toward a real identity, corroborated across two independent sources, but a second email search against it came back empty. The YouNow record introduced a different name that could not be tied to ImLupin with any confidence, and the shared IP address behind it argued against the connection rather than for it. What the investigation does establish, with a reasonable degree of confidence, is the shape of the operation itself: a single, persistently rebranded seller running a Telegram-based storefront and credential business, most likely operating out of Indonesia, whose full real-world identity remains an open question.

Editorial Note

Attribution in cyber investigations is rarely straightforward. Usernames change, channels disappear, and leaked data can produce misleading connections, which is why weaker leads in this case were treated with caution. StealthMole helped connect the original leak to the actor’s wider forum, Telegram, and storefront activity while separating corroborated findings from simple matches. The result was a clearer picture of the operation without overstating what the evidence could prove.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

The QYU Holdings Trail: Mapping the Corporate and Digital Footprint Behind a $100M Forex Ponzi

QYU Holdings presented itself to the world as a professional foreign exchange trading firm. U.S. federal authorities say it was a Ponzi scheme. Between at least 2015 and June 2023 it is alleged to have taken in around $100 million from investors in the United States, Canada, Panama and elsewhere, and its founder, Darren Anthony Robinson, was charged in the Eastern District of Michigan with eleven counts of wire fraud and one count of money laundering. He cut his court ordered GPS tether in November 2023, left the country, and in August 2026 was added to the FBI's Most Wanted Fraudsters list with a reward of up to $150,000.

Investigating through StealthMole's indexed dark web, credential and leaked file sources, this report follows the QYU brand through the infrastructure it left behind: the domains it registered, the mailboxes that leaked, the offshore funds it stood up, an SEC filing it signed, the corporate records it left in Florida, and a broker license it took out in Dubai. Traced this way, a single wanted poster name opened into a corporate structure spread across five jurisdictions, Wyoming, Florida, the Cayman Islands, Panama and the United Arab Emirates, and surfaced several people documented alongside it.

One principle runs through everything that follows. Darren Robinson stands charged, and the allegations against him remain allegations until a court decides. Everyone else named here is documented only as an affiliate or an officer of a QYU entity. A mailbox, a directorship, a signature or a filing shows that a person was connected to the operation. It does not show that they knew it was a fraud, and none of them appears in any charging document. Where the records prove a connection we say so, where they do not prove knowledge or intent we say that too, and the leads that could not be stood up are set out on their own. No information about anyone's current location was developed.

The Starting Point: A Most Wanted Fraudster

The investigation did not begin with an unknown alias. It began with a wanted poster. On 13 August 2026 the FBI's Detroit Field Office added Darren Anthony Robinson to its Most Wanted Fraudsters list and posted a reward of up to $150,000 for information leading to his arrest and conviction. According to the Bureau, Robinson founded and ran QYU Holdings as a purported professional investment company trading foreign currency, and from at least 2015 to June 2023 he raised an estimated $100 million from investors while, it is alleged, running a Ponzi scheme that paid earlier investors with newer money and funded his own lifestyle.

The poster gave a set of identifiers that became the baseline for every record checked afterward:

• Date of Birth (used): 31 January 1970
• Place of Birth: Brooklyn, New York
• Description: Male, 5'11", roughly 180 lbs, brown eyes, bald or shaven head
• Ties: Panama, the United Arab Emirates and Colombia, with an earlier U.S. footprint in Miami, South Florida, suburban Atlanta and Southern California
• Photograph: Taken in 2022

Two enforcement tracks anchored the case. A federal arrest warrant was issued on 11 January 2024 in the Eastern District of Michigan after Robinson was charged with eleven counts of wire fraud and one count of money laundering, and he has been a fugitive since November 2023, when he cut his GPS tether while out on bond and left the country.

Separately, the Commodity Futures Trading Commission won a default judgment and permanent injunction in April 2024 against Robinson and The QYU Holdings Inc. (QYUHI), a Wyoming corporation with a claimed principal place of business in Dallas, Texas, ordering $5,923,515.37 in restitution and a matching civil penalty and finding that the firm had taken $7,196,365.37 from 38 pool participants. The distance between the CFTC's $7.2 million and the FBI's $100 million was itself telling. The regulator had captured one slice of a much larger operation.

The charging documents also pointed past Robinson himself. A related CFTC action named Dwight A. Foster, a dual U.S. and Canadian citizen, and K.E.L. Enterprises, Inc. for soliciting not less than $13.2 million from at least 45 investors into a QYU related commodity pool (CFTC v. Foster, No. 2:23-cv-11552, E.D. Mich.). QYU had paid a network of client managers, which meant its footprint was never going to end with one person. That is where the trail into the infrastructure began.

The Brand Footprint: Domains and Web Infrastructure

With the public record in hand, the first pivot ran through StealthMole's Darkweb Tracker into QYU's own web presence. There was not one site but a family of them, and each told a slightly different story to a slightly different audience. Mapping them showed the reach of the operation and gave us a set of infrastructure selectors to carry forward.

The domains and subdomains that surfaced:

• u**.qyu*****s.com

The investor facing fund site, describing short term intra day forex, "proprietary market research techniques" and a global macro strategy, and naming a specific vehicle, the Vader Fund.

• t**qyu******scorp.com

A live placeholder branded "The Qyu Holdings Corporation" and pitched around import and export.

• r***s.qyu*********s.com

A login and password reset portal titled "QYU - Login", the account system that would have served investor statements.

• qyutech*******s.com

Tied to the Florida entity QYU Technologies Corp, with contact info@qyu****h.com, +1 (786) 6**-2***7 and an address in Miami.

• qyut******i.com

The site of the UAE broker arm, contact: info@qyut******i.com, +971 5* 6*3 **00

The inconsistency across these properties was itself worth noting. To investors QYU was a professional FX fund. To directories and registries it appeared as a holding company, an import and export firm, an online shopping mall on an abandoned LinkedIn page, and a technology company. An operation said to have raised $100 million wearing several unrelated cover identities is a familiar layering pattern, and here it is documented across five separate web properties.

Each domain went into the file as a selector for passive DNS, historical WHOIS and archive review. So did the marketing language itself, the "Vader Fund" name, the "boutique professional trading firm" self description, and the claim that $100,000 invested in 2014 would have grown past $2 million by 2021 without a single losing month. That kind of copy is distinctive enough to catch again if it were reused under a successor or sibling brand.

Following the Credentials

Pivoting on the first domain qyu*******s.com through StealthMole’s Combo Binder returned 128 credential records. This was a set of real mailboxes with passwords and per record leak dates attached, not addresses guessed from a naming pattern. The distinction mattered. A dataset that carries passwords and timestamps confirms the mailboxes existed and were in use, and it rules out the possibility that any given address is an inference.

Three of them anchored the people side of the investigation:

• Darren@qyu******s.com

The operator account

• S.jennings@qyu******s.com

Recurring across leak dates from August 2024 to December 2025, with the password changing over time, which pointed to a mailbox in steady use rather than a one off.

• Sharrief@qyu******s.com

A third active staff account

Seeing Darren next to S.jennings and Sharrief on the same corporate domain read the way a small staff on shared mail would. The naming was not consistent, first name, then first initial and surname, then first name again, which meant the rest of the roster could not be guessed by permutation.

At this stage the mailboxes established affiliation. People named Jennings and Sharrief held working QYU accounts. They did not yet tell us who those people were, or what they did. Resolving the names came next.

Putting Names to the Mailboxes

When the qyu*******s.com domain was investigated through StealthMole’s Darkweb Tracker, it returned several leaked file records drawn from third party breaches such as MGM Grand Hotels and Apollo.io. These files show where a mailbox was used to sign up for outside services. They do not indicate that QYU itself was breached, but they carry the same weight for our purposes. The address is real, it belongs to the named person, and it was used as a working email.

Two records linked s.jennings@qyu*******s.com to a full name and a location:

• Stephen, Jennings, PARK CITY, UT, s.jennings@qyu*****s.com
• a JSON record binding a spelling variant, s.jennns@qyu******s.com, to Stephen Jennings and Sacramento, CA

The first name form and the US geography of these records became the anchor for what we call Cluster A, the Jennings figure hard tied to QYU through the mailbox and a SEC filing along with a set of offshore directorships discussed later in this report.

A record in another leak did the same for the third mailbox, resolving sharrief@qyu*****s.com to a full name and adding a phone number:

• sharrief@qyu******s.com, Sharrief Shabazz, +1 (404) 5** 3***1

The 404 area code is Atlanta, which lines up with the FBI's stated suburban Atlanta ties for Robinson rather than cutting against them. The number went into the file as a passive selector.

By the end of this stage, we had three names: Robinson, Jennings and Shabazz, each documented on the QYU mail domain, with Jennings and Shabazz now carrying full names and, for Shabazz, a phone. All three were affiliates on the evidence to hand. Role and any knowledge of the scheme were still unestablished.

The Offshore Layer: Cayman Fund Directorships

Further investigation of Jennings led us to an official register. OffshoreAlert holds Cayman Islands General Registry director details, pulled on 26 June 2023 and cross linked to the Robinson criminal complaint, for a cluster of QYU branded funds. Stephen Jennings appears as a director across them.

The entities on which he is listed:

• QYU Holdings Ltd. (Cayman Islands)
• QYU CI Fund (Cayman Islands)
• QYU Guardian Fund (Cayman Islands)
• Inceptiondx Cayman (Cayman Islands)

Two things stood out. First, a corporate mailbox on the operating domain, combined with a directorship across the associated funds, is difficult to reconcile with a purely arm’s-length nominee arrangement. More importantly, the two records corroborated each other. Second, the footprint extended across three QYU funds and one additional entity, Inceptiondx, which had almost no public presence beyond the same register. The pattern was consistent with the QYU vehicles and made Inceptiondx a probable sibling entity, worth checking against the QYU funds’ registered office and co-directors.

One caution needs to be kept in mind. OffshoreAlert indexes entities linked to its own reporting and does not represent the full Cayman register. The four listings therefore establish four documented directorships, but they do not show that Jennings held no others. Confirming the full extent of his professional director activity would require checking the CIMA registered directors database rather than relying on OffshoreAlert alone.

A Signature on Record: The SEC Loan

Running Jennings through StealthMole against public filings surfaced the strongest document tying him directly to QYU: an SEC filing signed under penalty. Exhibit 10.14, filed by Predictive Technology Group, Inc., contains a revolving loan agreement between The Qyu Holdings, Inc. and Predictive Technology Group, Inc.

The agreement was effective 25 September 2019 and provided up to $3 million at 12 percent interest, with repayment due on 30 September 2021. The lender's notice address lists Stephen Jennings in Miami, Florida.

The signature block is the key piece:

• THE QYU HOLDINGS, INC. By: Stephen Jennings, Managing Director
• Predictive Technology Group, Inc. By: Bradley Robinson, CEO

This moved Jennings from a name appearing across QYU-related records to a documented executive of the core QYU entity. The filing also lines up with the QYU mailbox, the Cayman directorships and the LinkedIn profile identifying Jennings as Managing Director at Qyu Technologies in Miami.

The loan opened a second line of investigation. The $3 million went to Predictive Technology Group, a company that was facing SEC scrutiny around the same period and was later the subject of published fraud allegations. The use of QYU funds in that transaction therefore became a separate question, examined further under the Predictive Technology Group section.

The document establishes Jennings' role at QYU, but not his knowledge of or involvement in the alleged fraud. He does not appear in the charging documents reviewed, and the CFTC's findings identify Robinson as controlling the accounts into which investor funds were diverted.

The Corporate Spine: Florida Filings

The U.S. corporate structure was also documented through signed Florida Division of Corporations filings. Two QYU-related entities were registered at the same Miami Beach address.

QYU Holdings Limited LLC, document number L19********137, was filed on 5 April 2019 and later administratively dissolved on 22 September 2023. Its principal address was 1*** C***** Ave, Miami Beach, FL 33139, with earlier filings showing Apt 8C. The filing lists Darren Anthony Robinson and Andrew Anderson as authorized persons.

QYU Technologies Corp, document number P17*******659, EIN 83-2*******75, was filed on 4 December 2017 and dissolved on the same date as the LLC. It used the same Miami address. Across the available annual reports, Darren Anthony Robinson is listed as Director, President, Secretary and Treasurer. The articles describe the company's purpose as a "Commodity Trading Advisor", directly connecting the entity to the forex operation.

Separately, the charged Wyoming entity, The QYU Holdings Inc., surfaces in Austin, TX. A Dun & Bradstreet company profile lists Darren Robinson as Key Principal at the address and gives a Dallas phone number. A StealthMole leaked file independently records the same address as a QYU registration address. Street View shows the property as a single-family residence rather than a commercial premises.

The shared address and dissolution date linked the two Florida entities, with both dissolved on 22 September 2023, the same period as the CFTC complaint and the wider collapse of the scheme. Andrew Anderson also emerged as a new QYU-associated name through the LLC filing.

The physical footprint follows the same pattern. Both the Miami Beach address and the Austin address are residential properties rather than conventional business premises. This is consistent with the QYU entities operating without a clearly identifiable Florida or Texas office.

The Dubai Arm

The FBI's reference to QYU's UAE connections led to a registered entity in Dubai. A company register record lists QYU TECH COMMERCIAL BROKER L.L.C., registration number 941444, established on 15 March 2021 and listed as active.

The record provided four selectors:

• Website: qyutechdubai.com
• Email: info@qyutechdubai.com
• Phone: +971 ** 673 0**0
• Address: B*****a Heights, 1***8 Al S******r Tower 1, Dubai

WikiFX also carries a profile for the broker and describes it as unregulated. This was treated as supporting context rather than a regulatory finding, since WikiFX is an aggregator rather than a regulator. The profile did, however, provide a useful link. It describes the Dubai broker as running a "Qyu Technologies CTA" platform on MT4.

That description connected back to the U.S. side. QYU Technologies Corp's SunBiz filing lists its corporate purpose as "Commodity Trading Advisor", while the Miami-facing Qyu Technologies profile describes a CTA model where trades are executed through the client's brokerage account using MT4. The Dubai entity was therefore not just using the QYU name. Its advertised product pointed back to the same Qyu Technologies CTA model documented in the U.S.

QYU Tech Dubai - 16 May 2024

QYU Tech Dubai Contact & Address - 16 May 2024

The branding provided another link. The Miami entity uses qyutech.com, while the Dubai company uses qyutechdubai.com. The shared qyutech root is consistent with the Dubai entity being a geographic extension of the same brand rather than an unrelated company using the QYU name.

QYU Technologies - 20 March 2025

QYU Technologies Contact & Address - 13 October 2025

There is also a person-level connection. Stephen Jennings is documented as Managing Director of The Qyu Holdings Inc. in the SEC loan and separately identifies himself as Managing Director of Qyu Technologies in Miami. That is the same Qyu Technologies entity whose CTA model is referenced in the Dubai broker profile.

The Dubai registration therefore added more than another jurisdiction to the QYU footprint. Taken together with the CTA description, shared qyutech branding and Jennings' documented role, it connected the Dubai broker to a specific U.S. entity through the product it advertised.

The Predictive Technology Group Connection

The QYU loan led directly to Predictive Technology Group (PTG) and its CEO, Bradley C. Robinson. The SEC filing identifies Robinson as the person who signed the agreement on behalf of PTG.

The relationship was supported by two additional public records. An SEC Division of Corporation Finance comment letter dated 17 May 2019 addressed Robinson as CEO and raised questions around PTG's consolidation policy, variable interest entities and Juneau ownership figures. A later Hindenburg Research report also examined PTG and its management and alleged fraud.

PTG's own 10-K references the QYU loan. This makes the $3 million transaction a documented financial link between the two entities and provides a clear record to follow through the company's related-party disclosures.

Leads Documented but Excluded

Several records surfaced during the investigation but could not be tied to the QYU individuals with enough confidence to include them in the assessment.

One such lead was the name Stephen William Jennings. StealthMole returned a Bureau van Dijk record identifying a UK national and Company Secretary, a Panjiva record involving a 1979 Chevrolet Corvette shipped from Cayman to Panama, and a Dun & Bradstreet record connected to an Ontario company. The records shared the name and some of the same geography as the QYU Jennings, but no hard selector connected them to the Miami-based individual. They were therefore kept as a separate candidate identity. The idea of a Canadian branch was not supported by the available evidence.

Assessment: Entities and People

The findings are grouped by the strength of the evidence. Tier 1 covers individuals who were charged. Tier 2 covers documented affiliations or roles where the person's involvement or knowledge has not been established and no charges have been brought. Items marked as open are unresolved identity or relationship questions. Items marked as excluded are covered in the previous section, along with the reasons they were not included.

Entities

Entity Name	Jurisdiction	Identifier / Reg #	Documented Officers	Status / Role
The QYU Holdings Inc. (QYUHI)	Wyoming, USA	2013-0*******08	Darren Robinson	The charged forex pool entity
QYU Holdings Limited LLC	Florida, USA	L19******137	Darren Robinson, Andrew Anderson	Dissolved 2023
QYU Technologies Corp	Florida, USA	P17******659, EIN 83-2****075	Darren Robinson (sole)	Purpose "Commodity Trading Advisor"; dissolved 2023
QYU Holdings Ltd, CI Fund, Guardian Fund	Cayman Islands	Cayman registry	Stephen Jennings, Eric Robinson (Guardian)	Offshore funds
Inceptiondx Cayman	Cayman Islands	Cayman registry	Stephen Jennings	Probable sibling entity, to resolve
QYU Tech Commercial Broker LLC	UAE (Dubai)	94****4	Not resolved	Active; flagged unregulated (WikiFX)
QYU Holdings Corporation	Panama	Not on file	Not resolved	Offshore arm

People

Name	Hardest evidence	Status
Darren Anthony Robinson	Federal indictment; CFTC default judgment; signed Florida filings	Tier 1, charged (allegations pending)
Stephen Jennings	SEC Exhibit 10.14 signed as Managing Director of The Qyu Holdings Inc; Cayman directorships; QYU mailbox; self reported LinkedIn MD	Tier 2, documented senior officer; role and knowledge not established; not charged
Andrew Anderson	Signed Florida filing (Treasurer, 2021); Managing Member, QYU Holdings Limited LLC	Tier 2, state filed co officer; role and knowledge not established; not charged
Sharrief Shabazz	QYU mailbox; phone +1 404 5********1	Tier 2, affiliated; role and knowledge not established; not charged
Dwight A. Foster, K.E.L. Enterprises	Named in CFTC v. Foster (feeder pool)	Charged in separate civil action
Eric Robinson	Tagged on QYU Guardian Fund directors; separately named as Bradley Robinson's brother at PTG	Open, same person question unresolved
Bradley C. Robinson	PTG CEO (SEC letter, bio); signed PTG side of the QYU loan	Documented PTG executive; no established QYU fraud role; not a QYU officer
"Stephen William Jennings" (BvD, Panjiva, D&B Ontario)	Name and partial geography match to Cluster A	Open, not confirmed same individual

Conclusion

The investigation started with a single name on a wanted poster and gradually built into a wider QYU network across five jurisdictions. StealthMole's Darkweb Tracker first mapped the related domains and identities. Combo Binder surfaced the mailboxes, while leaked file records reviewed through MoleChat helped connect those mailboxes to real names. From there, each selector opened another part of the structure: offshore records showed the fund directorships, an SEC filing put Stephen Jennings' signature and Managing Director title on The QYU Holdings Inc., Florida filings documented the U.S. entities, and a UAE registration provided a hard corporate record for the Dubai operation.

The strength of the case came from how these records connected. Credential data, offshore registers, SEC filings, state records and the UAE registration repeatedly pointed back to the same QYU branding, addresses and small group of names. No single record showed the full picture, but taken together they provided a much clearer view of how the network was structured.

At the same time, the investigation did not establish more than the records could support. Darren Robinson is the individual charged in the case. Stephen Jennings, Andrew Anderson and Sharrief Shabazz are documented in QYU-related roles, but their knowledge of or involvement in the alleged fraud was not established in the material reviewed. The Eric Robinson and Stephen William Jennings identity questions remain open, while the Blunt and Montoya address link and the registered agent staff were excluded.

The QYU operation therefore did not resolve through one decisive record. It came together by following the same names, domains, mailboxes, addresses and corporate records across different sources and keeping confirmed links separate from leads that could not be verified. That process is what turned a single name into a documented, multi-jurisdiction picture of the network.

Editorial Note

Dark web and fraud investigations rarely produce a clean attribution from the start. Names can overlap, records can be incomplete, and a shared mailbox or address does not automatically establish a person's role or knowledge. In this case, StealthMole helped move the investigation from surface-level identifiers to deeper records across credentials, infrastructure, registries and corporate filings, while allowing weaker leads to be separated from the findings that could be supported.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com