A January relay post, catalogued as IA-C007, offered VPN access with domain-admin rights to a North American company in the $100M to $1B revenue band. It named the endpoint security product on the network. Bidding opened at $2,000 as advertised in the sampled post; the dollar denomination is not stated.
Those few fields are the core of the sales pitch: a way in, a privilege level, a revenue claim, a security product and a price format. We read 120 listings like it in full and counted what each field says. This article asks what the fields describe for a defender; the main investigation explains how we found the listings and what else the label contains.
The 120 are unique offers in Blackhole-collected posts dated 1 January to 27 October 2026. The collection is Telegram-dominated, and forum listings reach it through relay channels. Our search pattern may miss listings written in other words, so 120 is a lower bound.
An AI coder coded every field against a written codebook. A second, blind AI pass agreed on whether a post was a corporate offer in 38 of 40 cases, which shows consistency and not human validation. Only privilege and access method had a second check, on the 10 offers both passes called corporate. Every field is a seller’s claim, and we did not verify any listing.
Which Door Does a Listing Name?
Firewall or network devices lead the raw count with 23 listings (19%), followed by RDP and VPN with 12 each and RDWeb with 7. Fifteen offers carry one contact identifier and one fixed-price template: 14 of the 23 firewall listings and one firewall-and-VPN listing. Four more firewall relays from early February repeat the template without the contact. IA-C024 is the first seller post of that family.
Counting the contact-linked family once leaves 106 offers, and firewall listings fall to 10, below RDP and VPN. On that basis 48 of 106 offers (45%) name a firewall, network device, Citrix, Fortinet, RDP, VPN or RDWeb. RDP, VPN and RDWeb alone account for 33 of 120 (27.5%), and none of them belongs to the firewall family. Web applications, databases and admin panels follow with 17 listings, and cloud consoles or storage with 10.
The ordering matches what others report. Rapid7 reported in March 2026 that RDP, VPN and RDWeb were the most common access types in the forum offers it analyzed. CISA’s August 2026 advisory on Gunra ransomware describes initial access mainly through known flaws in internet-facing devices, including firewall and VPN appliances. The samples differ from ours, so we compare the pattern and not the levels.
What Rights Does the Listing Promise?
Privilege is the second field. Admin, root or system rights appear in 59 listings (49%), domain admin in 17 (14%) and user-level access in 24 (20%), while 17 state nothing.
These splits are one coder’s reading. On the 10-offer second check, the two passes agreed on privilege in only 4. In five of the other six, the second pass marked privilege as unstated where the first coder read stated rights.
The firewall template inflates the first figure, because all 23 firewall listings promise admin or root. Without them, 36 of the remaining 97 listings (37%) still carry admin or root rights, the largest group. A buyer is told what can be done on day one, not only that a door exists.
Security software is the third field. Thirty-two listings (27%) name an EDR or antivirus product, 3 say none was detected and 85 say nothing. All 32 mentions sit in the 97 listings that are not firewalls (33%); none of the 23 firewall listings names one.
For appliance listings, start with device admin logs and configuration changes. Absence of an EDR mention does not show which endpoint, network or device telemetry exists.
What Do Revenue Bands and Asking Terms Describe?
Revenue looks like the most analytical field. A band is stated in 76 listings (63%). The counts are 19 under $10M, 23 at $10M to $100M, 16 at $100M to $1B, 17 over $1B and one mixed. None of it is verified.
Of the 120 listings, 67 state a fixed price, 13 use an auction format, 12 negotiable terms, 27 no price and one a buy-now price only.
No common denomination and unit cohort is established, so this edition does not test a relationship between revenue and price. Dated asking or bidding terms remain in the catalogue with their own units and periods; a bare "$" leaves the dollar denomination unstated.
What Do Repetition and the Relay Path Do to These Counts?
They shape much of the set. One contact identifier appears in 15 of the 120 offers (12.5%), all of them the template above, and 45 offers carry any contact identifier. Twelve offers appear more than once, and one admin-panel template was reposted in 8 posts.
The firewall family also colors the other fields. Sixteen of the 23 firewall listings state no revenue, and 16 of the 30 offers first seen in February are firewall listings.
Three explanations compete: a few active sellers, branded templates used as marketing, and listings that are not real. Repeated branded enterprise listings fit any of the three explanations. We did not test credibility, so count listings and not sellers.
The source path matters too. Of the 120 offers, 66 reached the data only as a seller’s own post and 41 only through a relay. Six arrived both ways and 7 as list posts.
All 13 auctions came through relays, and negotiable pricing sits almost entirely in seller posts (11 of 12). The simplest reading is relay selection: what we see depends on which relays were collected, not on which sellers auction.
The same caveat covers timing. In the cleaned set, 103 offers were first seen from January to May and 17 from June to October, and two more October offers exist only among cleaning-dropped posts. Without the 22 firewall listings of February to April the split is 81 against 16. Relay collection alone can produce such a pattern, so it is not a market trend.
Scale settles the next question. Even 120 offers over ten months are small beside the rise of about 1,760 labelled posts a day. They cannot explain the September step in access-labelled posts.
What Should a Defender Take From the Listings?
First, the doors are ones a defender can inventory. Remote-access and perimeter services are what listings name most often, so internet-facing appliances with admin interfaces, VPN gateways and remote desktop services come first. For each, know who holds admin rights, because 59 listings promise admin, root or system rights and 17 domain admin (76 in all).
Second, a revenue band cannot tell you your own risk. The bands are unverified claims and cover every range, with 19, 23, 16 and 17 listings across the four. Neither a small nor a large firm can read them as exposure or safety.
Third, three records list access to an EDR console. The count is small, but a console that can switch off endpoint tools is cheap to protect with a separate admin identity and alerting.
Vendors link such listings to ransomware, with caveats. Intel 471 found at least 70 possible correlations between broker claims and later leak-site victims over one year, all circumstantial. Cisco Talos assessed with medium confidence a case where a broker’s access reached a ransomware affiliate almost a month after the intrusion. Neither says what happened to our 120.
For background, see the initial access broker glossary entry and our earlier explainer on broker listings. A practical next step is to list your internet-facing admin interfaces and remote-access gateways and check who can sign in to each. Commodity access packages are a separate product, covered in our packaging study of web shells, cPanel and RDP. The Initial Access chapter links the full set.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
