Account Market Intelligence
Every verified open-source observation, newest first. Each entry feeds the platform pages, the price index and the research registry automatically — verifying an observation recalculates that platform's score and price percentiles.
Submit evidenceSubmissions are reviewed before publication. Excerpts are sanitized: no seller identities, contact details, invite links, credentials or marketplace locations are stored or shown. Asking prices are not realized prices.
Researchers examining more than 64,000 unique cloud access keys exposed publicly between 2022 and 2026 found that around 88% of a retested sample still authenticated, and 768 granted full administrative control of a corporate cloud account.
View sourceA broadcast investigation found rideshare and delivery driver accounts openly advertised for rent or sale on mainstream social platforms, allowing people without a valid licence or completed background check to work under someone else's account.
View sourceAnalysis of published platform transparency reporting indicates LinkedIn removes an average of roughly 112 million fake accounts per year.
View sourceFederal prosecutors announced sentences for five people who created numerous fraudulent customer and driver accounts on a delivery platform to submit phantom orders, obtaining more than $2.5 million in fraudulent payouts.
View sourceA researcher found a publicly accessible database of roughly 149 million credential records, of which about 900,000 were Apple iCloud username and password pairs. The records were attributed to infostealer malware rather than a compromise of Apple infrastructure.
View sourceCoverage of an identity-vendor survey reported that 45% of gig workers surveyed said they had rented or sold access to a gig-work account, a practice the platforms prohibit.
View sourceResearchers documented credential-stealing malware sold on a subscription basis since 2025 that harvests Discord account tokens, saved credentials, payment methods and session data to enable account takeover.
View sourceResearchers found stolen consumer accounts from more than 60 businesses being sold through criminal storefronts operating across chat platforms including Discord, with the credentials obtained largely through credential-stuffing attacks.
View sourceA consumer-credit bureau summary of a published dark-web price index lists an average advertised price of 60 US dollars for a hacked Gmail account, against 20 to 25 dollars for a hacked social media account and 1 to 20 dollars for streaming service logins.
View sourceKaspersky Digital Footprint Intelligence identified more than 7 million compromised credentials tied to major streaming platforms during 2024, with Netflix accounting for the largest single share. The credentials were harvested by infostealer malware campaigns rather than a breach of the platform itself.
View sourceA watchdog investigation identified 80 social-media groups with a combined membership of over 800,000 in which rideshare driver accounts were advertised for sale or rent, enabling people to drive under another person's verified identity without passing a background check.
View sourceThe same watchdog investigation found delivery driver accounts traded alongside rideshare accounts in the groups it identified, with group names openly referencing delivery account rentals.
View sourceMeta filed a US civil action alleging that an individual had sold Instagram usernames and offered unauthorised account reinstatement services since 2022, in breach of platform terms. Meta described it as its first US legal action of this kind against account-selling services.
View sourceA vendor blog reported an underground forum post claiming to offer more than 20 million OpenAI account credentials, with sample data presented as proof. Other forum participants disputed whether the credentials granted account access, and the claimed compromise was never substantiated.
View sourceAirbnb's annual transparency report describes the categories and volumes of law-enforcement requests it received in 2024 relating to user accounts and account data, including legal process, emergency disclosure and preservation requests.
View sourceInvestigative reporting documents multiple consumers whose purchased tickets were transferred out of their accounts without authorisation, indicating demand for accounts holding transferable inventory.
View sourcePublic radio reporting on the same enforcement action described the AI-assisted operation of fake profiles on the platform and placed it in a wider pattern of state-backed fake-account activity around elections.
View sourceUS prosecutors announced the court-authorised seizure of infrastructure behind an AI-assisted bot farm that created and operated close to 1,000 fake accounts impersonating Americans between 2022 and 2024. The platform suspended the remaining accounts.
View sourceThreat-intelligence analysis attributes access to credentials harvested by infostealer malware and later circulated through underground credential trading.
View sourceReporting describes an unverified underground listing offering a claimed 560-million-record Ticketmaster customer dataset for a reported USD 500,000 lump sum.
View sourceResearchers documented users publicly offering to transfer business advertising accounts already authorised to run political ads in India, contrary to platform policy prohibiting account sale or transfer. The researchers did not transact with sellers.
View sourceA US court authorised the seizure of domains that Microsoft described as a widely used service for buying fraudulent Hotmail accounts in bulk, which were then resold to other criminal operators at scale.
View sourceReporting on the same disruption noted that the fraudulent Outlook accounts were sold through a dedicated service and that a well-known intrusion group was among the buyers, using the accounts to support further attacks.
View sourceMicrosoft and a fraud-prevention vendor disclosed the disruption of a group that Microsoft estimates created and sold roughly 750 million fraudulent Outlook and Hotmail accounts, together with automated CAPTCHA-solving services, to other criminal groups.
View sourceWire-service reporting cited Airbnb disclosing that it removed 59,000 fake listings and blocked a further 157,000 from joining the platform in a single year, as part of automated detection work against fraudulent host accounts.
View sourceAcademic measurement of a criminal impersonation market recorded 10,193 sold user profiles over 161 days, with estimated trade of up to roughly 700 profiles per day and buyer preference driven by geography and attached resources.
View sourceA second outlet, citing the same threat-intelligence dataset, described stolen ChatGPT credentials being traded inside underground log markets under subscription-style access models, most commonly harvested by three named infostealer malware families.
View sourceReporting on threat-intelligence research found more than 101,000 ChatGPT account credentials appearing in infostealer logs traded on underground marketplaces between June 2022 and May 2023, peaking at roughly 26,800 credential sets in a single month, with Asia-Pacific the most affected region.
View sourceKrebs on Security reported on a service that pays people for access to their existing email accounts and then rents that access on to customers who need established mailboxes to complete sign-ups elsewhere in bulk. Renters receive only the verification messages, not full control of the mailbox, which is described as a way of monetising aged, reputable email addresses.
View sourceCheck Point Research observed channels advertising monthly access to Netflix Premium plans at very low prices, describing the accounts as sourced from compromised credentials rather than legitimate resale. Researchers noted buyers frequently lost access after a short period, indicating unreliable fulfilment.
View sourceVendor research reports that once LinkedIn accounts are compromised, the credentials are shared, sold and packaged within cybercriminal underground communities.
View sourceThreat-intelligence research documents dedicated shops selling access to compromised webmail accounts, reporting an average advertised price of about USD 25 for a single webmail account.
View sourceA companion investigation documented cases in which sellers registered new marketplace seller accounts using stolen personal identities, bypassing identity-verification checks.
View sourceAn investigation documented a grey market in secondhand marketplace seller accounts traded through chat channels and account-swapping forums, with established accounts reportedly changing hands for thousands of dollars and sometimes used to evade seller bans.
View sourcePeer-reviewed study identified 1,003 fake LinkedIn profiles using AI-generated portrait images and outsourced account management for commercial lead generation.
View sourceTrend Micro documents services that resell one-time SMS verification codes so that buyers can register accounts in bulk on major platforms including Google. The researchers found one such service drawing its numbers from a botnet of thousands of compromised Android handsets whose owners were unaware their devices were intercepting verification messages.
View sourceGoogle's Threat Analysis Group disclosed action against a botnet of roughly one million Windows machines whose operators stole Google account credentials and ran ancillary criminal services, including one selling access to systems pre-loaded with stolen credentials. Google terminated the associated accounts and cloud projects and filed civil litigation against the operators.
View sourceGoogle's civil complaint alleges the defendants operated a botnet that harvested Google account login credentials at scale and monetised that access through paid criminal services, including the sale of access to machines loaded with stolen credentials. The filing is a court record of alleged account-market activity rather than a marketplace listing.
View sourceReporting on a published dark-web price index covering listings captured up to May 2021, which recorded an advertised price of 80 US dollars for a compromised Gmail account — higher than the figures the same index recorded for cloned payment cards or for online banking logins holding at least 100 dollars.
View sourceFacebook stated it removed hundreds of accounts linked to a forum whose members traded hijacked accounts and short, high-value usernames obtained through hacking, coercion and SIM-swapping, with intermediaries taking a percentage cut of resale transactions.
View sourceThe platform joined a coordinated enforcement action against members of a forum functioning as a marketplace for hijacked accounts and rare usernames, some obtained through SIM-swapping and extortion.
View sourceThe platform stated that hundreds of hijacked accounts, primarily on Instagram, were reclaimed from members of a username-trading forum, describing an escrow-based resale ecosystem focused on short, high-value Instagram usernames.
View sourceA mid-year update to a recurring darknet price index recorded a sharp rise in advertised prices for hijacked Airbnb account credentials in the UK sample, alongside increases across other travel and payment account categories.
View sourceA recurring darknet price index tracked listings for hijacked streaming accounts, including Netflix, across multiple marketplaces and reported year-over-year movement in advertised prices for this account category.
View sourceThe same recurring darknet price index reported a year-over-year decline in advertised prices for Apple ID accounts, which the authors read as softening demand relative to other brands in the sample.
View sourceA journalist documented purchasing a single fabricated Facebook profile, supplied with a constructed posting history and personal details, from a foreign-language site for a small cryptocurrency payment.
View sourceReporting on a darknet price study found that compromised Apple ID and iCloud accounts were among the most highly valued non-financial account types listed on several marketplaces, with an average advertised price of about $15, behind only banking and payment credentials.
View sourceAn investigation described a large-scale operation manufacturing engagement and follower accounts aimed primarily at Instagram, with production concentrated in South and Southeast Asia. Revenue and volume figures were the operator's own unverified claims.
View sourceGoogle researchers working with university partners studied the market for phone-verified Google accounts, obtaining 4,695 such accounts from underground sellers and analysing roughly 300,000 phone-verified accounts Google had disabled for abuse. Sellers depended heavily on free internet-telephony numbers and short-lived numbers concentrated in a small number of countries, and the paper reports advertised prices for Google phone-verified accounts falling by 30 to 40 percent as that number supply spread.
View sourceMarket activity is an external indicator of abuse incentives, not a measurement of fraudulent accounts on the underlying platform. Prices are never inferred — an observation without a published figure is recorded without one. See the methodology for scoring and confidence rules.