A January post offered 1,000 cPanel logins, described as valid, for $30 as advertised, which comes to three cents a login (IA-P012). A February post asked $100 for a single cPanel login on a government-domain site and quoted its authority metrics (IA-P027). A January buyer, meanwhile, offered $2 to $5 for a random shell (IA-P002).
All three posts advertise website access, but one is a bulk lot, one a named site and one a buyer bid. Their different units and unstated dollar denominations prevent a common price comparison.
We read 200 priced texts from posts labelled as access sales: 139 commodity offers, 18 buyer bids and 43 texts that were not commodity offers. The draw over-represents small subtypes on purpose, so pooled shares are not population estimates.
An AI coder coded units and terms, and no second coder checked those fields. Every price is an asking or bidding price in sampled posts, never a market price. Most posts write “$” without naming a currency, so dollar amounts are given as written.
Why Does No Single Price of Access Exist?
Three separate products share one vocabulary, and the buyers’ bids add a different good again. Each attaches its price to a different thing, as the table shows.
| Selected dated record | Advertised product and role | Term as written |
|---|---|---|
| IA-P012, January 2026 | Seller: 1,000 cPanel logins | $30 for the lot; denomination unstated |
| IA-P027, February 2026 | Seller: one cPanel login, site metrics quoted | $100; denomination unstated |
| IA-P002, January 2026 | Buyer bid: random shell | $2 to $5 per shell; denomination unstated |
Seller listings use eight stated units: piece, item, bulk lot, month, plan, period, subscription or offer. Fourteen of the 139 offer posts state no unit. These categories describe packaging, not a common price cohort.
Prices remain separate dated asking or bidding terms with their stated units and periods. The legacy USD code combines explicit USD and bare "$" with an unstated denomination. No common denomination and unit cohort is established, so this edition publishes no cross-advertisement price median, rank, ratio, range or inferred price relationship. Same-advertisement arithmetic remains attached to that advertisement.
What Does a Cent-Per-Login Lot Promise?
It advertises volume. A January post offered 1,000 cPanel logins for $30 (IA-P012); a separate post offered 1,000 root-level logins for $100 with refund and warranty wording (IA-P119). Each asking term stands with its own product; no dollar denomination or transaction was verified.
Validity claims are rare, with only 5 of the 139 offers making one. A selected lot can include refund or warranty wording. Those promises are part of its advertised product; their delivery was not tested.
What Do Site Metrics Add to the Pitch?
Eight of the 139 offers quote authority metrics and four more quote traffic. These coded terms describe the pitch; they do not measure a price effect.
Authority and traffic metrics appear as packaging terms. Their presence does not establish that reputation commands a price premium.
Curated listings advertise a named site. Itemised lists appear in 21 offers, nine of them web shell lists that go site by site. One selected list of 19 education shells marked 5 as lost or sold (IA-P017).
Buyer bids are a separate role: 13 of the 18 bids concern shells or panels and five concern cloud accounts. The dated bid terms remain separate catalogue records.
Bids and asks therefore describe different goods and not a spread around one price. A bid is only an opening position, and we cannot show that any of them traded.
Why Do Rentals Come With Replacement Windows?
Rentals are advertised like hosting. Of 25 RDP posts, 22 list hardware tiers by memory or cores. Ten carry a warranty or replacement term; across all 139 offer posts, 24 carry such a term. These are post-level packaging counts, not seller counts.
Ordinary hosting resale is an alternative explanation for a replacement promise. Such a promise does not establish how long access lasts; that was not measured. Selected SMTP advertisements also attach their asking terms to sending limits.
One RAM-tier template turned up in two languages. Repeated templates mean these 139 offer posts are not 139 independent advertisements; the number of sellers is unknown.
What Do These Packages Mean for Website Owners and Hosts?
The terms point to three practical steps. First, lists name sites one by one. A website owner or brand-protection team that sees its own domain in a list has a concrete lead to check against its own logs. Authority metrics appear in only 8 of 139 offers, so an unremarkable site is not safe because nobody quotes its score.
Second, hosting providers can watch the spec advertised with an account. Selected SMTP posts state sending limits, so a sudden jump in outbound mail from one shared account is a concrete lead to investigate.
Third, a listing is evidence about the list, not proof that access still works. Six offers carry sold or lost markers inside a list, and one list marked 5 of 19 shells that way. Sellers re-post inventory with dead or sold items still in it, so check your own records before treating a named site as compromised.
Remote desktop exposure belongs in the same review. See our guide to RDP attacks, the remote desktop protocol entry and the web shell entry.
How Does This Differ From Corporate Access Sales?
It is a separate trade. Kaspersky’s 2026 SMB report lists RDP and web shells among the access types sold in the forum posts it analyzed. Our corporate sample describes another product, covered in what corporate network access listings promise.
The main investigation covers the whole label, and the September step analysis shows what filled the label after 12 September. The Initial Access chapter links all three studies.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
