Initial Access Offers: The Report
We coded posts under Blackhole's "Initial Access Selling" label one by one. Most of the offers were footholds on websites and servers. Corporate network access was a thin, repetitive slice.
- 4.3x
- Step-up in posts under the access-sales label on 12 September 2026From about 530 to 2,290 a day. De-duplicated access-offer posts went from about 24 to about 38 a day: a ratio of about 1.6 (approximate 95% range 0.8 to 3.1), so no detectable change.
- 120
- Unique corporate network access offers in ten monthsFound by a full-text search; a lower bound.
- 166,612
- Posts carry the label "Initial Access Selling"1 Jan-27 Oct 2026. Posts, not offers, sellers or accesses.
Brandefense / Cybercrime Report 2026 / Initial Access Initial Access Offers 1 January-27 October 2026. Dataset v1.0. Posts, not offers; offers, not working accesses. Get The Initial Access Report.
Read the report, open the evidence records and reuse the charts with their source and limits.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Four Investigations. The Label Is Not The Trade.
In September the label's count rose 4.3 times while access offers did not change detectably.
The full-year PDF edition follows in early 2027. The accessible edition carries the same text, tables and numbers as a web page that works with screen readers, zoom and text search.
- 01 Most Initial Access Offers We Read Sold Websites, Not Networks We coded 350 posts and read 469 corporate candidates to separate website footholds from network access. Read online →
- 02 The September Surge in Access-Labelled Posts Posts labelled as access sales rose 4.3x on 12 September 2026. Five tests show why de-duplicated offer posts per day did not change detectably. Read online →
- 03 Anatomy of a Corporate Network Access Listing We read 120 corporate network access listings in full. Remote-access doors and admin rights lead; revenue bands remain unverified seller claims. Read online →
- 04 Why Web Shell, cPanel and RDP Prices Do Not Add Up Web shell prices, cPanel logins, SMTP and RDP are sold as bulk lots, curated sites and rentals. See why their prices cannot be averaged. Read online →
- 05 Method, limits and the evidence catalogue. A post is not an incident, and an ad does not prove a sale or show that a tool works.
Inspect The Evidence Behind The Report.
Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01Counts are Blackhole-collected posts, Telegram-dominated, with limited forum coverage. They are not offers, sellers, victims, accesses or incidents.
- 02The label is a classifier output. In an AI-coded sample only 38.2% of January–August posts and 4.9% of 12 September–27 October posts were access offers.
- 03No claim is made about dark web growth or decline, or about the access-selling market size. The 12 September step is a step in labelled posts, not evidence of more access sales.
- 04No trend is claimed across the May–July classifier taxonomy break.
- 05The corporate catalogue (120 offers) is a lower bound with unknown pattern recall; revenue, sector, EDR and privilege are unverified seller claims; counts are offers, not sellers.
From Research To Monitoring.
See when your company's passwords, data or name show up on criminal forums and markets.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.