The September Surge in Access-Labelled Posts
Posts labelled as access sales rose 4.3x on 12 September 2026, but de-duplicated offer posts per day showed no detectable change. Five tests show why.
Read the investigation →
Brandefense Cybercrime Report 2026 · Initial Access Offers
1 January–27 October 2026 · Research edition 1.0
In These Posts, Access Offers Sell Sites And Servers.
We coded posts under Blackhole's "Initial Access Selling" label one by one. Most of the offers were footholds on websites and servers. Corporate network access was a thin, repetitive slice.
In September the label's count rose 4.3 times while access offers did not change detectably.
Access offers under the label 38.2% → 4.9%
Share of posts under Blackhole's "Initial Access Selling" label that were access offers: 1 Jan–31 Aug vs 12 Sep–27 Oct 2026 Collected posts, not incidents or market totalsAdvertised terms, not tested services What this number measures →
01Key findings
Websites, Perimeters And Mixed Access Lots
Each finding below is stated in its own unit, with the limit that comes with it. The investigations give the full reasoning and the evidence records.
The increment · posts a day
Change in posts a dayWhere the extra 1,760 posts a day came from.
Change in posts a day by content. Category shares come from samples of 1 Aug–11 Sep and 12 Sep–27 Oct, scaled to the daily means of 530 (1 Aug–10 Sep) and 2,290 (12 Sep–23 Oct).
Consumer account or combo selling +809
Carding, mule or SIM trade +380
Repeated spam or scam ad +256
VPN or proxy config sharing +143
Chat or discussion +121
Unclear +121
Other +76
News +36
Hosting or VPS ad +29
Tutorial or tool +4
Buyer request (want to buy) −38
Access offers −176
Change in posts a day (left of centre = fall)Access offers
Access offers fall because one repeated bot ad shrank; the rise is mostly account selling, carding and mule trade, spam and config sharing.Shares of posts, not of distinct messages. Bands are rough normal approximations for guidance. AI coder, single pass.
Source: Brandefense Blackhole, posts labelled Initial Access Selling, 1 Jan–27 Oct 2026. Posts, not sellers or accesses.
Chart dataCSV · 917 BOriginal chartSVG · 100.6 KB
+View as table
| Content | Change a day | Share of increment | Rough 95% band |
|---|---|---|---|
| Consumer account or combo selling | +809 | 46% | +563 to +1,055 |
| Carding, mule or SIM trade | +380 | 22% | +170 to +589 |
| Repeated spam or scam ad | +256 | 15% | +170 to +342 |
| VPN or proxy config sharing | +143 | 8% | −18 to +304 |
| Chat or discussion | +121 | 7% | −7 to +249 |
| Unclear | +121 | 7% | −28 to +269 |
| Other | +76 | 4% | −36 to +189 |
| News | +36 | 2% | −57 to +130 |
| Hosting or VPS ad | +29 | 2% | −60 to +117 |
| Tutorial or tool | +4 | 0% | −6 to +14 |
| Buyer request (want to buy) | −38 | −2% | −79 to +4 |
| Access offers | −176 | −10% | −302 to −50 |
- 01A label count is not a threat level. Posts labelled as access sales stepped up 4.3x on 12 September 2026, while de-duplicated offer posts per day did not change detectably.
- 02The extra ~1,760 posts a day were mostly consumer account selling (+809), carding and mule buying (+380) and repeated spam (+256). De-duplicated access-offer posts per day did not change detectably, although a smaller rise cannot be ruled out.
- 03A keyword rule that looked for words like revenue, bank and gov was right about corporate access in 1 of 39 sampled hits. Most hits were web shell lists on government and education sites.
- 04Corporate network access is a thin, repetitive slice: 120 unique offers, read in full. Counting one repeated firewall family once, 48 of 106 name an edge device or remote-access service, and privilege is stated far more often than verified detail.
- 05Commodity access ads describe bulk lots, single named sites and rentals by spec tier with replacement terms. Their stated units describe different products; dated asking terms remain separate.
02The investigations
Four Questions. One Data Set.
Each investigation answers a different question from the same collected posts. Start with the main one, then follow the question that matters to your team.
Main investigation
Most Initial Access Offers We Read Sold Websites, Not Networks
Among posts labelled as access sales, most were not offers. The offers we read mostly sold web shells, cPanel, SMTP and RDP; corporate network access was a thin slice of 120.
Read the investigation →Anatomy of a Corporate Network Access Listing
We read 120 corporate network access listings in full. Perimeter services and admin rights lead; revenue bands remain unverified seller claims.
Read the investigation →Why Web Shell, cPanel and RDP Prices Do Not Add Up
Cheap web shells, cPanel logins, SMTP and RDP are separate products with different price units. Averaging their prices describes none of them.
Read the investigation →03For defenders
Which Access Details Matter For Triage
These are implications of what the posts say, not measured control results. Each one points to a different decision.
-
Ask what the object is before you act: a website foothold, a rented server or a network. Each points to a different owner and check.
-
Know who can reach your firewall, VPN and remote-access admin interfaces: edge and remote-access services dominate the corporate listings once the repeated firewall family is counted once.
-
Treat a list that names your domain as a lead to check against your own logs, not as proof of a breach; lists carry sold and lost items.
-
Do not read a classifier's label count as a threat level; ask whether a feed number counts posts, distinct messages or coded offers.
Module
Dark Web Monitoring
See when your company's passwords, data or name show up on criminal forums and markets.
See how it works →
Free exposure check
Request a demo
Check Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
04 / From research to monitoring
From Research To Monitoring.
05Method & limits
Inside The Access-Offer Classification
- Source
- Brandefense Blackhole.
- Period
- 1 January–27 October 2026, by post time. October is partial.
- Edition
- Research edition 1.0.
Seeded, stratified random sample of posts carrying the classifier label (n=150 Jan–Aug, n=180 after 12 Sep). Each post was coded in full by an AI coder against a written codebook; shares are population-weighted with Wilson 95% intervals (28.1–49.5% and 2.0–11.4%). A blind second AI pass agreed on offer vs not-offer in 89 of 90 posts.
06Get the research
The Research. Ready To Inspect.
Read the report, open the evidence records and reuse the charts with their source and limits.
HTMLEdition 1.0 Research reportAccessible reading edition · full-year PDF in early 2027 HTML132.5 KB Evidence catalogueThe records the investigations cite HTML11.5 KB Charts & press kitOriginal chart files and attribution
Original aggregate tables, charts and editorial paraphrases: CC BY 4.0. Keep the source, version, date range and measurement limits with reused figures.
30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
07 / All chapters
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
01 · Ransomware 64.7% of claims came from just 33 of 177 groups 02 · Fraud 831 of 2,448 retained financial-account posts match one narrow recruitment signature (33.9%) 03 · Data Breach & Leaks 63% of Blackhole-collected posts that mention "data breach" are news retellings, not leak posts 04 · Stolen Accounts & Combolists 6.3% of hand-read Botnet Log posts are strict stealer-log clouds (weighted estimate) 05 · Infostealers 97.5% of January-April raw "stealer" keyword posts carried one brand's notification template 07 · Exploits, Tooling & AI 37 of 93 exploit seller posts using the word 0-day that were coded as unnamed-exploit claims 08 · Hacktivism & DDoS 578 distinct NoName057(16) DDoS claim events (1 Jan–27 Oct 2026), carrying 2,920 claimed target entries All eight chapters Open the Cybercrime Report 2026 Eight chapters. Eight units.