identity/email
Observed Market Price
Observed price history
Drag or hover across the curve to trace it point by point — the trace snaps to disclosed prices only. Use the annotations below to read what each move is attributed to.
Annotations quote the cited public source for each price. The percentage is the arithmetic move against the previous disclosed price for this platform — a change in what was asked, not a measured market-wide move, and no cause is attributed beyond what the source itself states.
Dashed path and band: model projection from today onward — projection, not evidence. It is never stored as an observation or folded into the score.
3 disclosed single-account prices, each a verified observation. Points are joined for readability only; the record holds no prices between them.
Projected 12 months out: $38.76 · range $8.38–$179.28 (80% projection interval, model p0.3) · projection, not evidence. Outlook
Public asking prices only · Normalized to USD from the published currency using stored reference rates · Single-account and bulk unit pricing kept separate · Median, P25 and P75 only — prices are never inferred · Asking price may not reflect a realized transaction.
Demand drivers
Services resell one-time SMS verification codes so buyers can register accounts in bulk, in one case drawing numbers from compromised handsets.
A service rents access to established mailboxes so customers can complete sign-ups in bulk on other platforms, receiving only the verification messages.
A botnet of roughly a million machines stole account credentials and its operators ran services selling access to systems pre-loaded with them.
A civil complaint alleges the defendants harvested account login credentials at scale and sold access to machines loaded with them through paid criminal services. Court record of alleged activity, not findings of fact.
Academic measurement of a criminal impersonation market recorded 10,193 profiles sold over 161 days, with buyer preference driven by geography and the resources attached to the account.
Threat-intelligence research documents shops selling access to compromised webmail accounts, the entry point examined in that research for reaching an organisation behind the mailbox.
Every entry restates the abuse or fraud objective described in one named public source — press reporting, court filings, law-enforcement announcements, platform disclosures, security-vendor research or academic studies — and links straight to it. Nothing is inferred from other platforms, and no method, tooling or access route is described. Objectives documented in evidence are not a measure of how often they succeed.
Transparent scoring
Observed premiums
Attributes describe themes in evidence, not product recommendations.
Sanitized record
“A consumer-credit bureau summary of a published dark-web price index lists an average advertised price of 60 US dollars for a hacked Gmail account, against 20 to 25 dollars for a hacked social media account and 1 to 20 dollars for streaming service logins.”
“Academic measurement of a criminal impersonation market recorded 10,193 sold user profiles over 161 days, with estimated trade of up to roughly 700 profiles per day and buyer preference driven by geography and attached resources.”
“Krebs on Security reported on a service that pays people for access to their existing email accounts and then rents that access on to customers who need established mailboxes to complete sign-ups elsewhere in bulk. Renters receive only the verification messages, not full control of the mailbox, which is described as a way of monetising aged, reputable email addresses.”
“Threat-intelligence research documents dedicated shops selling access to compromised webmail accounts, reporting an average advertised price of about USD 25 for a single webmail account.”
“Trend Micro documents services that resell one-time SMS verification codes so that buyers can register accounts in bulk on major platforms including Google. The researchers found one such service drawing its numbers from a botnet of thousands of compromised Android handsets whose owners were unaware their devices were intercepting verification messages.”
“Google's Threat Analysis Group disclosed action against a botnet of roughly one million Windows machines whose operators stole Google account credentials and ran ancillary criminal services, including one selling access to systems pre-loaded with stolen credentials. Google terminated the associated accounts and cloud projects and filed civil litigation against the operators.”
“Google's civil complaint alleges the defendants operated a botnet that harvested Google account login credentials at scale and monetised that access through paid criminal services, including the sale of access to machines loaded with stolen credentials. The filing is a court record of alleged account-market activity rather than a marketplace listing.”
“Reporting on a published dark-web price index covering listings captured up to May 2021, which recorded an advertised price of 80 US dollars for a compromised Gmail account — higher than the figures the same index recorded for cloned payment cards or for online banking logins holding at least 100 dollars.”
“Google researchers working with university partners studied the market for phone-verified Google accounts, obtaining 4,695 such accounts from underground sellers and analysing roughly 300,000 phone-verified accounts Google had disabled for abuse. Sellers depended heavily on free internet-telephony numbers and short-lived numbers concentrated in a small number of countries, and the paper reports advertised prices for Google phone-verified accounts falling by 30 to 40 percent as that number supply spread.”
Sources & Coverage