Security Boulevard

The Shadow AI Trap: Why Your AI Inventory is Your Biggest EU AI Act Compliance Risk – FireTail Blog

Security Boulevard
1 month ago

Apr 16, 2026 - Alan Fagan - The EU AI Act cares about evidence, not intentWhen National Competent Authorities begin enforcement on August 2, 2026, they will ask organisations what AI systems they operate, how those systems are being used, and what controls are in place. Many organisations will struggle to answer these questions.The Shadow AI Problem is Bigger Than You ThinkWe have been here before. When cloud computing arrived, IT departments spent years chasing down unauthorised SaaS subscriptions, known as Shadow IT. Shadow AI is the same problem running at a dramatically higher speed.More than 80% of workers, including nearly 90% of security professionals, use unapproved AI tools in their jobs. The people responsible for enforcing your security policies are among the most likely to be circumventing them with AI tools you have never reviewed or approved.The channels are varied and often invisible to security teams:Browser extensions. A marketing employee installs an AI writing assistant. A lawyer uses a browser-based summarisation tool to review contracts. Neither is reviewed by legal or IT.Embedded features. Enterprise software vendors have rolled out AI features that activate without a separate purchase decision. Your existing vendor agreements may not adequately govern what those features do with your data.Developer shortcuts. Engineers use unapproved large language models to refactor code, write tests, or debug production issues. Proprietary source code and data enter third-party model APIs without any review of where that data goes or how it is stored.About 38% of employees share confidential data with AI platforms without approval. Every one of those interactions is a potential compliance issue under the EU AI Act.Why the Spreadsheet Audit FailsMost GRC teams begin their AI Act readiness work with what might be called a stock take. Department heads receive a survey and fill it in based on what they know about, or feel comfortable disclosing. The results get compiled into a spreadsheet. A compliance tick appears next to "AI Inventory."This approach has three fundamental problems under the EU AI Act.First, it captures a moment in time. AI adoption inside organisations moves faster than any quarterly audit cycle. A new tool can be adopted by an entire department in an afternoon. A CRM platform can enable a new AI feature overnight, rendering the inventory obsolete.Second, it relies on self-reporting from people who may not understand what they are using. A department head who approves an AI-assisted analytics tool may not know it routes queries through a third-party LLM, or that it qualifies as a high-risk system.Lastly, it creates a false sense of control. A documented inventory that misses 60% of actual AI usage is not an adequate compliance asset in a regulatory investigation.The High-Risk SystemThe EU AI Act classifies AI systems used for recruitment, employee evaluation, credit scoring, and access to essential services as high-risk under Annex III.In practice, this means if an employee in your HR team is using an AI tool to screen CVs or score candidates without formal approval, your organisation has deployed a high-risk AI system. You are subject to the obligations that come with that classification, even if you didn’t know about it.Article 12 states that deployers of high-risk systems must ensure those systems allow for the automatic recording of events throughout their lifetime, retained for a minimum of six months. You cannot log systems you have not discovered, or govern what you cannot see.Regulation RequirementsThe Act defines two primary roles. Providers, who develop and place AI systems on the market, and deployers, who use those systems in their own operations. Most European enterprises are deployers.Article 26 places ongoing monitoring obligations on deployers of high-risk AI systems. Article 9 requires a documented risk management system. Article 10 governs data quality and data governance. Together, these obligations require a technical foundation, not a document library.Under Article 99, non-compliance with high-risk AI system requirements can result in fines of up to €15 million or 3% of total worldwide annual turnover. For violations of Article 5's prohibited practices, that rises to €35 million or 7% of global turnover. The 15-Minute StandardThe question for every CISO and GRC leader is not whether they have completed an AI inventory, it’s whether their inventory is accurate, continuous, and audit-ready.FireTail takes a different approach. Rather than relying on surveys and spreadsheets, we deploy automated discovery across your entire environment, covering cloud infrastructure, browser-based activity, and application-level AI integrations. Within 15 minutes of deployment, you have a living, continuously updated inventory of every AI model, integration, service and prompt.This inventory is the foundation for everything else the EU AI Act requires: risk classification, logging, monitoring, and governance.The August 2026 DeadlineThe prohibited practices provisions of the Act have been in force since February 2025 and the governance rules for general-purpose AI models became applicable in August 2025. But the full obligations for high-risk AI systems take effect on August 2, 2026.Organisations without a verified, technical AI inventory will not be able to demonstrate compliance with the most basic requirement the Act imposes. Regulators will not accept outdated spreadsheets as evidence of ongoing governance.The first step to EU AI Act compliance is knowing what you are governing. This requires automation, not administration.

The post The Shadow AI Trap: Why Your AI Inventory is Your Biggest EU AI Act Compliance Risk – FireTail Blog appeared first on Security Boulevard.

FireTail - AI and API Security Blog

Article 12 and the Logging Mandate: What the EU AI Act Actually Requires – FireTail Blog

Security Boulevard
1 month ago

Apr 16, 2026 - Lina Romero - When GDPR arrived, the organisations that had mistaken documentation for capability were the ones that struggled the most. They had policies about data retention but no technical controls enforcing those policies. They had breach notification procedures but no systems capable of detecting a breach in time to use them.The EU AI Act is heading for a similar reckoning. And Article 12 is where most organisations will feel it first.Article 12High-risk AI systems shall technically allow for the automatic recording of events over the lifetime of the system.‍Technically means the logging capability must be built into or applied to the system itself. A manual process for exporting logs, or a human who periodically reviews AI outputs and writes notes, does not satisfy this requirement.‍Automatic means logs are generated without operator intervention at the moment events occur. Scheduled exports do not count. Human-triggered captures do not count.‍Lifetime means from the moment a high-risk AI system is deployed until it is decommissioned. Not from the point at which you decided to start logging or your compliance program went live.Article 26(6) requires automatically generated logs to be retained for a minimum of six months. For biometric identification systems, additional specific data must be captured including precise usage periods, reference databases consulted, and the identities of individuals responsible for verifying results.Who This Applies ToThe first question many organisations ask is whether Article 12 applies to them. The answer, for most enterprises using AI in operational contexts, is yes.Under Annex III of the Act, high-risk includes any operation where AI affects hiring, finances, access, healthcare, resource allocation, or fundamental rights. This covers recruitment screening tools, credit and insurance models, employee performance management systems, customer service AI with access to account data, and healthcare triage or administration tools.The regulation draws a clear line between providers, who build and place AI systems on the market, and deployers, who use those systems within their own operations. Most European enterprises are deployers. Deployers must ensure that logs are kept in formats suitable for analysis and must retain them in a way that supports regulatory review and investigation.If you are a deployer using a third-party AI system, the obligation to ensure logging is in place does not disappear. You need to verify that the systems you use can generate the required logs, and that those logs are accessible to you when needed.The Six Gaps Most Organisations Have Right NowBased on what we see across enterprise environments, these are the most common Article 12 failures:Fragmented log sources. AI usage is spread across multiple systems, some cloud-hosted, some embedded in SaaS tools, some running in developer environments. Each generates logs in different formats, stored in different places without a unified view and no reliable way to produce a complete picture when required.Incomplete coverage. Logging may exist for officially sanctioned AI systems but not for the shadow AI running alongside them. An organisation that logs its approved AI but cannot account for the screening browser extension used by three team members has a compliance gap.Log integrity. Article 12 says nothing about how to protect records from tampering. A log file can be modified, overwritten, or deleted without trace unless it is secured through mechanisms independent of the system that generated it. If logs need to hold up in regulatory or judicial proceedings, chain of custody matters.Insufficient retention. Many organisations apply general IT log retention policies that fall short of six months, or apply the six-month requirement inconsistently across systems.No connection to monitoring. Logs that sit in a storage system and are never reviewed until something goes wrong are not a monitoring system. Article 26 requires deployers to actively monitor AI systems for performance and anomalies. Discovery gaps. You cannot log what you cannot see. The organisations most exposed under Article 12 are those that do not have a complete picture of their high-risk AI deployments in the first place.The 15-Minute Discovery StandardThere is a practical metric that every CISO and GRC leader should apply to their organisation's AI readiness. How long does it take to produce a complete, verified inventory of all AI systems currently in use across your environment?If the answer is days or weeks, you are working from a compliance model that cannot keep pace with how AI is actually being adopted inside your organisation. If the answer is never, or only through a manual survey process, you have a fundamental gap.FireTail deploys automated discovery across cloud infrastructure, browser-based activity, and application-layer integrations. Within 15 minutes, you have a living inventory. That inventory drives everything else, automatic log capture from every discovered system, centralised retention with tamper-evident storage, real-time alerting on anomalous activity, and the audit-ready reporting that demonstrates compliance to regulators.FireTail captures the specific data Article 12 requires for high-risk systems. Interaction timestamps, input data classifications, output records, and human review events. Logs are centralised, retained, and exportable for regulatory review.The Enforcement TimelineThe EU AI Act entered into force on August 1, 2024. The full obligations for high-risk AI systems become applicable on August 2, 2026. Prohibited practices have been enforceable since February 2025. National Competent Authorities across EU member states will move into active enforcement mode after that August 2026 date.The organisations that will be best positioned have automated, continuous logging in place now, generating the six months of retained audit trail the regulation requires before enforcement begins. If you start your logging program the day the Act is enforced, you are already behind.Article 12 reflects what the regulation is actually trying to achieve: the ability to understand, retrospectively and in real time, what high-risk AI systems are doing and what impact they are having. Manual documentation is no longer enough.

The post Article 12 and the Logging Mandate: What the EU AI Act Actually Requires – FireTail Blog appeared first on Security Boulevard.

FireTail - AI and API Security Blog

Beyond the Spreadsheet: Why Manual AI Audits Are an EU AI Act Compliance Liability – FireTail Blog

Security Boulevard
1 month ago

Apr 16, 2026 - Alan Fagan - When it comes to the EU AI Act, many organisations take a manual approach to auditing, which looks impressive on paper but collapses under regulatory scrutiny. They use policies, surveys, working groups, and a well-formatted risk register. However, a manual approach does not provide the continuous, automated, technical control needed to stay compliant under the Act.For European CISOs and GRC leaders who have built their compliance programs on periodic auditing, the EU AI Act represents a shift in what regulators will accept as evidence. Understanding this shift before August 2026 is the difference between being prepared and being penalised.What Made Manual Audits Work BeforeTraditional compliance frameworks like SOC 2, ISO 27001, and even GDPR were largely designed around periodic assurance. You documented your controls. You tested them at intervals. You produced evidence that things were operating as intended at a point in time. Auditors reviewed that evidence and issued an opinion.This model works reasonably well for relatively stable systems where the risk landscape changes slowly, but breaks down entirely in environments where the risk surface is changing continuously, where the subject of the audit can be adopted or modified without any central approval, and where the regulation itself requires not just documentation but demonstrable technical capability.Why Manual Audits Fail the EU AI ActThe velocity problem. AI models iterate frequently. New tools appear constantly. Organisations now manage an average of 490 SaaS applications, with only 47% of those applications authorised. The AI layer on top of that SaaS estate is growing faster than any quarterly audit cycle can track. A manual audit that was accurate in January may be wrong by March, and legally dangerous by August.The self-reporting problem. Manual audits depend on people accurately describing the systems they use. Nearly half of workers admit to adopting AI tools without employer approval, and a significant majority of C-suite executives appear to be doing the same while remaining reluctant to disclose it. An audit that relies on employees and managers to self-report their AI usage will systematically undercount compliance risks.The technical evidence problem. The EU AI Act does not ask whether you have a policy. It asks whether you can prove that policy is being enforced. Article 12 requires that high-risk AI systems technically allow for the automatic recording of events throughout their lifetime. Manual recording does not count. A system that generates logs because someone remembered to export them is not compliant. The logging capability must be built in and automated.The Real Compliance GapThe most common mistake GRC teams are making right now is treating the EU AI Act as a documentation exercise. They are producing AI registers, drafting governance policies, and mapping their systems to risk classifications. All of that work has value, but it addresses the wrong problem.Most compliance failures under Article 12 are not technical shortfalls, but rather failures to capture and prove every obligation in real time. Organisations that have thoughtful policies but incomplete logs will not be able to demonstrate compliance when regulators ask for evidence of what was happening inside their AI systems six months ago.Consider a concrete scenario. A financial services firm uses an AI model to assist with credit assessment, a clear Annex III high-risk use case. The firm has a governance policy, an AI register, and a risk assessment. What it does not have is a centralized log of every query passed to that model, every output it produced, and every human review decision made in response. When a customer challenges a credit decision under Article 86's right to explanation, or a regulator requests evidence of ongoing monitoring under Article 26, the firm cannot produce what is required. The technical infrastructure was never built.Continuous MonitoringShifting from periodic auditing to continuous monitoring requires rethinking the compliance stack. The components that matter under the EU AI Act are:Continuous discovery. Automated identification of AI traffic across your environment, covering cloud workloads, user-facing browser activity, and application-level integrations. This runs constantly, not quarterly.Automated risk classification. Discovered AI tools mapped in real time against the EU AI Act's risk categories. When a new tool appears, it is classified immediately, not at the next audit cycle.Centralised logging. Every interaction with a high-risk AI system is captured automatically, timestamped, and retained. Article 26 requires that automatically generated logs be kept for a period appropriate to the intended use, but at least six months. This cannot be achieved with manual exports or patched-together log management.Real-time alerting. When something anomalous happens, like a system detecting unexpected outputs, a prompt that matches prohibited practice patterns, a data leakage event, your team needs to know immediately. Reactive incident response is not enough.Technical policy enforcement. Rules for what AI can and cannot be used for, enforced at the point of use rather than reviewed after the fact.The GDPR LessonGDPR taught European organisations about the difference between compliance as documentation and compliance as operational reality. Many organisations spent the first two years after GDPR's 2018 enforcement date discovering that their Subject Access Request processes did not work, their data maps were incomplete, and their policies had never been technically enforced.The EU AI Act's obligations are more technically demanding than GDPR, its enforcement timeline is clear, and the fine structure is more severe, making AI Act violations potentially more expensive than even the most serious GDPR breaches.Organisations that treat the Act as a documentation exercise will repeat the GDPR experience. Those that build technical compliance infrastructure now will be in a fundamentally different position when enforcement begins.FireTail was built for exactly this transition. From periodic auditing to continuous governance, from policy documents to automated enforcement, from reactive incident response to real-time detection and control.The question is not whether you have completed your AI Act checklist. It is whether your AI systems are actually being governed, right now, in a way you could prove to a regulator today.‍

The post Beyond the Spreadsheet: Why Manual AI Audits Are an EU AI Act Compliance Liability – FireTail Blog appeared first on Security Boulevard.

FireTail - AI and API Security Blog

Production-first Security: Why Runtime Intelligence Should Drive Application Security

Security Boulevard
1 month ago
TL;DR

Traditional application security focuses on finding vulnerabilities before code ships. However, pre-production scanning identifies theoretical risks while production reveals what is actually reachable, exploitable, and under active attack. Production-first security leverages runtime intelligence to prioritize remediation, giving teams visibility into real-world attack patterns rather than hypothetical weaknesses.

The post Production-first Security: Why Runtime Intelligence Should Drive Application Security appeared first on Security Boulevard.

Jake Milstein

[un]prompted 2026 – Glass-Box Security: Operationalizing Mechanistic Interpretability

Security Boulevard
1 month ago

Author, Creator & Presenter: Carl Hurd, Co-Founder & CTO, Starseer

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations' YouTube Channel.

Permalink

The post [un]prompted 2026 – Glass-Box Security: Operationalizing Mechanistic Interpretability appeared first on Security Boulevard.

Marc Handelman

The AI Content Crisis: How LLMs Are Draining Media Revenue – and the Technologies Fighting Back

Security Boulevard
1 month ago

LLMs scrape publisher content thousands of times per single referral, destroying the ad and subscription revenue that funds journalism. Cloudflare, TollBit, and new licensing models are fighting back.

The post The AI Content Crisis: How LLMs Are Draining Media Revenue – and the Technologies Fighting Back appeared first on Security Boulevard.

Deepak Gupta - Tech Entrepreneur, Cybersecurity Author

Payouts King Takes Aim at the Ransomware Throne

Security Boulevard
1 month ago

IntroductionIn February 2022, BlackBasta emerged as a successor to Conti ransomware and quickly rose to prominence. BlackBasta was operational for three years until February 2025 when their internal chat logs were leaked online, exposing the group’s inner workings. This led the group to disband and shutter the operation. However, similar to many ransomware groups, BlackBasta was largely driven by initial access brokers that launch attacks against organizations and then steal sensitive information and encrypt files. Although the BlackBasta brand disappeared, the group’s former affiliates have continued attacks by deploying different ransomware families such as Cactus. Zscaler ThreatLabz has observed continued ransomware activity that is consistent with attacks launched by former affiliates of BlackBasta. Some of these attacks have been attributed to a relatively unknown ransomware group that calls itself the Payouts King.In this blog, we will provide an in-depth technical analysis of the Payouts King ransomware including the techniques that are implemented to evade detection by antivirus and endpoint detection and response (EDR) software. Key TakeawaysThreatLabz has observed ransomware-related activity consistent with previous BlackBasta initial access brokers starting in early 2026.Many of the attacks follow similar techniques, tactics, and procedures (TTPs) as prior attacks such as leveraging spam bombing, Microsoft Teams, and Quick Assist. ThreatLabz has been able to attribute some of these attacks to the Payouts King ransomware group with high confidence.Payouts King is a relatively unknown ransomware group that emerged in April 2025 that steals large amounts of data and selectively performs file encryption.Payouts King ransomware leverages 4,096-bit RSA and 256-bit AES counter mode for file encryption. Technical AnalysisThe technique of spam bombing combined with phishing and vishing continues to be an effective technique that we previously discussed in our annual ransomware report back in 2024. These attacks typically involve a threat actor sending spam email to a targeted victim and then impersonating an IT staff member from the victim’s organization. The victim is instructed to join a Microsoft Teams call and initiate Quick Assist. If the victim falls for the ruse, the threat actor deploys malware onto the victim’s system to establish a foothold on the organization’s network. ThreatLabz has been able to attribute some of these attacks to Payouts King ransomware, a group that until now has largely remained under the radar over the last year.Obfuscation and evasion techniquesPayouts King implements several common obfuscation methods such as building and decrypting strings on the stack, importing and resolving Windows API functions by hash, and hashing important strings instead of hardcoding them. Payouts King uses a combination of FNV1 hashes and a custom CRC checksum algorithm for obfuscation. The latter has been replicated below in Python.def payouts_king_crc32(input_string: bytes) -> int:
checksum = 0
poly = 0xBDC65592
for char_val in input_string:
char_val |= 0x20
checksum ^= char_val
for _ in range(8):
if checksum & 1:
checksum = (checksum >> 1) ^ poly
else:
checksum >>= 1
checksum &= 0xFFFFFFFF
return checksumInterestingly, when Payouts King uses FNV1 hashes to resolve strings, the seed value is unique per obfuscated value. This defeats tools that utilize large precomputed hash tables to quickly determine the original string. Payouts King also contains a significant number of strings that are obfuscated through stack-based arrays of QWORDS, which are used to construct individual encrypted strings and the corresponding XOR keys to decrypt them.Command-line argumentsSimilar to most ransomware families, Payouts King supports command-line arguments to enable or disable specific functionality. However, the Payouts King command-line arguments are obfuscated by the custom CRC checksum function described in the section above. Despite this, ThreatLabz was able to determine the original string arguments for all of the command-line checksum values. The Payouts King command-line arguments are summarized in the table below.CRC ChecksumParameterDescription0x40e9525-backupUse backup files when performing file encryption.0xf7fc5542-noelevateDo not try to elevate privileges.0xd0956b64-nohideDo not hide the window.0xc66b13e4-i [string]Identity (used for verification)0xc66d24e4-log [filename]Log file path.0x2d617286-mode [all, local, share]Encryption mode (encrypt all files, local disks, or network shares)0xe7ef1cf4-noteDrop the ransom note to the disk.0x3659830f-path [path]Encrypt files starting at the specified path.0x115feaa8-percent [integer]Percentage of file content to encrypt.0x3c145344-nopersistDo not establish persistence.0x7a50b8b4-time [seconds]Time delay in seconds before starting file encryption.Table 1: Payouts King command-line parameters.By default the ransomware will not perform file encryption unless the -i parameter is specified with a value whose CRC checksum matches an expected value. This is likely an anti-sandbox evasion technique.If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks by executing the following command:schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\UpdateTask /TR "<path_to_payouts_king.exe>"If the -noelevate parameter is not specified, Payouts King will schedule another task to elevate privileges and run as the SYSTEM user as shown below:schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\ElevateTask /TR "<path_to_payouts_king.exe>"In order to run these scheduled tasks, Payouts King creates two pipes to read and write to standard input and standard output. The code then calls CreateProcess to launch cmd.exe without any arguments and redirects standard input and output to one end of the pipe. The ransomware code then writes the commands to the other end of the cmd.exe pipe, which creates the scheduled tasks. Payouts King reads the result from the pipe and checks for the string SUCCESS to determine if the task was created. If the elevation task is successfully created, the command schtasks.exe /run /tn \Mozilla\ElevateTask is sent through the pipe to execute the task immediately, followed by schtasks.exe /delete /tn \Mozilla\ElevateTask /f to delete the task and remove forensic evidence. Payouts King will then terminate the current process to allow the elevated process to perform the file encryption.File encryptionPayouts King ransomware uses a combination of 4,096-bit RSA and 256-bit AES in counter (CTR) mode. The encryption code leverages the OpenSSL library, which is statically linked. Each file is encrypted with a pseudorandom key and nonce. The format of an encrypted file is the AES encrypted data followed by the RSA encrypted file encryption parameters as depicted below.Figure 1: Depicts the format of an encrypted file where the AES encrypted data is followed by the RSA file encryption parameters.The RSA encrypted parameters contains the following 487-byte structure:struct payouts_king_rsa_encrypted_data {
DWORD magic_bytes; // "CRPT" (little-endian)
QWORD encryption_type;// 0x825456 (AES) or 0x233567 (ChaCha20)
BYTE aes_key[32]; // pseudorandomly generated per file
BYTE aes_iv[16]; // pseudorandomly generated per file
QWORD total_filesize; // the original file size
QWORD encrypted_size; // the number of bytes encrypted
DWORD num_encrypted_blocks; // full encryption (1), partial encryption (0xd)
BYTE padding[407]; // random data
};While Payouts King contains code to support AES or ChaCha20 encryption, the samples identified by ThreatLabz have only used AES.The file content is encrypted according to the following algorithm:If the file extension matches any of those listed in Table 3 (shown in the Appendix), the full file content will be encrypted.If the file size is less than 10,485,761 bytes (10MB), the full content of the file will be encrypted.Otherwise, the file will be divided into 13 (0xd) blocks. Half of each block will be encrypted and the other half will not be encrypted. This is a performance optimization for encrypting large files that is commonly implemented by ransomware.If the -percent command-line option is specified, the corresponding percentage of the file will be encrypted in 13 blocks.When encrypting files, Payouts King attempts to open the targeted file. If opening fails due to an error code 32 (ERROR_SHARING_VIOLATION), the ransomware will enumerate the running processes and compute a checksum value for each process name and compare the result against a list of 131 hardcoded DWORD checksum values. Many of these process checksums correspond to antivirus and EDR applications. ThreatLabz was able to recover most of the original process names, which are provided in the Appendix. If the process name checksum value matches, Payouts King will attempt to terminate the process. However, instead of using standard Windows API calls, the ransomware uses low-level direct system calls to evade antivirus and EDR hooks. The system call numbers are determined at runtime by manually walking the loaded ntdll module’s export table for function names that start with a Zw prefix to build a table of Zw* function names and addresses. Note that the table is sorted by the Zw* function addresses, and therefore the index in the table can be used to map the system call with the corresponding system call number. Payouts King ransomware then calculates a CRC for each Zw* function name with the malware’s custom CRC algorithm and compares it against an array of expected DWORD checksum values. These checksum values correspond to the following functions:Function NameCRC ChecksumZwQueryInformationFile0x806e69a7ZwQueryInformationProcess0x1993a634ZwOpenProcess0x58ad11eeZwTerminateProcess0x469424d5ZwOpenFile0x28a29ebfZwQuerySystemInformation0xa0595508Table 2: Payouts King system call checksum mapping used to terminate security-related processes.If the -backup command line parameter is specified, Payouts King creates temporary files to hold the original file data in case the encryption process is interrupted.These files use a 56-byte structure in the following format:struct payouts_king_backup_file_hdr {
QWORD magic_bytes; // 0x1F2013150205BEF3
QWORD num_bytes_encrypted; // current number of bytes encrypted
BYTE reserved[16]; // unused
QWORD file_data_offset; // current offset in file being encrypted
QWORD block_size; // size of the data to encrypt in the next block
QWORD custom_crc_checksum; // checksum of current block; performed only on the first byte of the block (likely a bug)
};This data structure is updated for each block that is encrypted, and can be used to determine the last block of data that was encrypted if the process is interrupted. The following files are not encrypted since they are relevant to file encryption:.esVnyj (temporary backup file extension used during file encryption).ZWIAAW (encrypted file extension)readme_locker.txt (ransom note filename)The following Windows files are also not encrypted:desktop.inintuser.datntuser.iniThe following file extensions are also not encrypted:.bat.cat.dll.exe.lnk.msi.mum.sysThe following directories are also skipped::$recycle.bin\:$winreagent\:\programdata\microsoft\:\program files\windowsapps\:\recovery\:\system volume information\:\windows\After the content of a file is encrypted, the file is renamed with a hardcoded extension appended to the original filename. The file is renamed by using a more obscure technique via the function SetFileInformationByHandle using the FileRenameInfo class. This is likely designed to avoid antivirus and EDR detection that monitors calls to MoveFile and MoveFileEx.Similar to most ransomware families, Payouts King deletes Windows shadow copies with vssadmin.exe delete shadows /all /quiet (to delete backups), empties the recycle bin via SHEmptyRecycleBinW (to remove deleted files), and clears the Windows event logs using EvtClearLog (to hinder forensic analysis).Interestingly, the ransom note is not written to disk unless the -note parameter is specified on the command-line at runtime. The ransom note is written to the file named readme_locker.txt on the victim’s desktop as shown below.Figure 2: Example of Payouts King ransomware note.The ransom note contains information about how to contact Payouts King via TOX and provides a link to the group’s data leak site via Tor. The Payouts King data leak site is shown below.Figure 3: Payouts King ransomware data leak site. ConclusionThe emergence of Payouts King, driven by former BlackBasta affiliates, highlights the persistent and adaptive nature of the ransomware ecosystem. Ransomware threat actors continue to use effective TTPs like spam bombing with vishing, and misuse legitimate tools such as Microsoft Teams and Quick Assist. Payouts King itself is a sophisticated ransomware family, featuring robust encryption utilizing RSA and AES-256, alongside anti-analysis techniques like stack-based string obfuscation, API and string hashing, along with direct system calls for process termination.To defend against this evolving threat landscape, organizations must focus on a defense-in-depth strategy. This includes enhanced user training to recognize and report social engineering attacks (spam bombing, vishing, and fake tech support scams), strict enforcement of multi-factor authentication (MFA), and monitoring for the anomalous use of remote access tools like Quick Assist. The continued success of Payouts King underscores the necessity for proactive threat hunting and continuous adaptation of security controls to match the ransomware groups' relentless pursuit of the next lucrative payout. Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to the threats mentioned in this blog at various levels with the following threat name:Win64.Ransom.KingW64/Payoutsking-ZRaa!Eldorado Indicators Of Compromise (IOCs)IndicatorDescription335ad12a950f885073acdfebb250c93fb28ca3f374bbba5189986d9234dcbff4Payouts King ransomware sample SHA256  d68ce82e82801cd487f9cd2d24f7b30e353cafd0704dcdf0bb8f12822d4227c2Payouts King ransomware sample SHA256  AppendixFully encrypted extensions.4dd.abcddb.abs.abx.accdb.accdc.accde.accdr.accdt.accdw.accft.adb.ade.adf.adn.adp.alf.arc.ask.bdf.btr.cat.cdb.ckp.cma.cpd.dacpac.dad.dadiagr.daschem.db.db-shm.db-wal.db2.db3.dbc.dbf.dbs.dbt.dbv.dbx.dcb.dct.dcx.ddl.dlis.dp1.dqy.dsk.dsn.dtsx.dxl.eco.ecx.edb.epim.exb.fcd.fdb.fic.fm5.fmp.fmp12.fmpsl.fol.fp3.fp4.fp5.fp7.fpt.frm.gdb.grdb.gwi.hdb.his.hjt.ib.icg.icr.idb.ihx.itdb.itw.jet.jtx.kdb.kexi.kexic.kexis.lgc.lut.lwx.maf.maq.mar.mas.mav.maw.mdb.mdf.mdn.mdt.mpd.mrg.mud.mwb.myd.ndf.nnt.nrmlib.ns2.ns3.ns4.nsf.nv.nv2.nwdb.nyf.odb.oqy.ora.orx.owc.p96.p97.pan.pdb.pdm.pnz.qry.qvd.rbf.rctd.rod.rodx.rpd.rsd.sas7bda.sbf.scx.sdb.sdc.sdf.sis.spq.sql.sqlite.sqlite3.sqlited.te.temx.tmd.tps.trc.trm.udb.udl.usr.v12.vis.vpd.vvv.wdb.wmdb.wrk.xdb.xld.xmlff      Table 3: List of file extensions that are fully encrypted by Payouts King.Antivirus / EDR products blocklista2service.exeaciseagent.exeacnamagent.exeacnamlogonagent.exeacumbrellaagent.exeairwatchservice.exeappcontrolagent.exearcsight.exeashdisp.exeaswidsagent.exeavastsvc.exeavastui.exeavguard.exeavgnt.exeavgnsx.exeavgsvc.exeavgui.exeavkservice.exeavp.exeavpui.exebdagent.exebdservicehost.exeblackberryprotect.exebrowserexploitdetection.exebullguardsvc.execb.execbdefense.execcsvchst.execmdagent.execpda.execsfalconservice.execsrss.execybereasonransomfreeservice.execylancesvc.execyserver.execytomicendpoint.execyveraconsole.execyveraservice.exedarktracetsa.exedataprotectionservice.exedeepinstinctservice.exedsmonitor.exedwengine.exedwservice.exeegui.exeekrn.exeelastic-endpoint.exeendgame.exeendpointbasecamp.exeepconsole.exef-secure.exefdedr.exefireeye.exefsecure.exegdataavk.exeheatsoftware.exeheimdalclienthost.exehexis.exelsass.exembam.exembamservice.exembamtray.exemcafee.exemcods.exemcshield.exemfeepehost.exemfeepmpk.exemfefire.exemfevtps.exemsmpeng.exemssense.exen360.exenortonsecurity.exentrtscan.exenwservice.exepanda_url_filtering.exepavfnsvr.exepavsrv.exepccntmon.exepsanhost.exepsuaservice.exeqhepsvc.exerapid7.exeraytheon.exerealtime safe.exesamplingservice.exesavadminservice.exesavservice.exesbamsvc.exesecureaplus.exesecureworks.exesecurityagentmonitor.exesecurityhealthservice.exesensecncproxy.exesentinelagent.exesentinelctl.exesentinelmemoryscanner.exesentinelservicehost.exesentinelstaticengine.exesentinelstaticenginescanner.exesentinelui.exesfc.exeshellexperiencehost.exeshstat.exesmc.exesophosui.exestartmenuexperiencehost.exetanclient.exetracsrvwrapper.exetraps.exetrapsagent.exetrapsd.exetrustwaveservice.exev3svc.exevsserv.exewrsa.exexagt.exezaprivacyservice.exe  Table 4: List of process names terminated by Payouts King (if opening a file for encryption fails).

The post Payouts King Takes Aim at the Ransomware Throne appeared first on Security Boulevard.

Brett Stone-Gross (Sr. Director, Threat Intelligence)

[un]prompted 2026 – Hooking Coding Agents With The Cedar Policy Language

Security Boulevard
1 month ago

Author, Creator & Presenter: Matt Maisel, CTO and Cofounder, Sondera

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations' YouTube Channel.

Permalink

The post [un]prompted 2026 – Hooking Coding Agents With The Cedar Policy Language appeared first on Security Boulevard.

Marc Handelman

Real-World Threat Detection and Intelligence with Seceon: A Unified Approach to Modern Cyber Defense

Security Boulevard
1 month ago

As organizations expand across cloud, on-premise, and hybrid environments, the cybersecurity landscape is becoming more complex and unpredictable. Threat actors are no longer relying on isolated techniques. They are executing multi-stage, automated, and coordinated campaigns that exploit vulnerabilities across identities, endpoints, and network layers. In this environment, traditional security tools often struggle due to fragmented

The post Real-World Threat Detection and Intelligence with Seceon: A Unified Approach to Modern Cyber Defense appeared first on Seceon Inc.

The post Real-World Threat Detection and Intelligence with Seceon: A Unified Approach to Modern Cyber Defense appeared first on Security Boulevard.

Aniket Gurao

BitCoin Wallet Addresses From the Breached Forums Cybercrime-Friendly Forum Community – A Compilation

Security Boulevard
1 month ago

Dear blog readers,

The following is a compilation from BitCoin wallet addresses from the Breached Forums cybercrime-friendly forum community.

Here's the compilation:

"BTC (SegWit)","bc1qt92z6vsrnf87ndutvrw8fdm7t5dwrlnucz7j4m","Post #3164","190","Infinite"
"BTC (SegWit)","bc1qt92z6vsrnf87ndutvrw8fdm7t5dwrlnucz7j4m","Post #3177","527","TELEPORTER"
"BTC (SegWit)","bc1qssngrnrq26a4d5nt7na3rwde4rxeanegzzk4hy","Post #22896","594","ice"
"BTC (SegWit)","bc1qssngrnrq26a4d5nt7na3rwde4rxeanegzzk4hy","Post #22897","0","Unknown"
"BTC (SegWit)","bc1qcdq4ddydkl94yecajfqtl4k82gx42nlpqzq0kk","Post #29422","568","Taiga"
"BTC (SegWit)","bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h","Post #43173","8377","paulbarron"
"BTC (SegWit)","bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h","Post #43176","405","CBT"
"BTC (SegWit)","bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h","Post #43275","2953","Blood"
"BTC (SegWit)","bc1qh9rly8e8eqlcrm8mx3n6tvhtxyaarv3pwrs70m","Post #47199","51","Gon"
"BTC (SegWit)","bc1qh9rly8e8eqlcrm8mx3n6tvhtxyaarv3pwrs70m","Post #47438","55","systeM"
"BTC (SegWit)","bc1qh9rly8e8eqlcrm8mx3n6tvhtxyaarv3pwrs70m","Post #48036","2221","FunkPits"
"BTC (SegWit)","bc1qg93thsg883n4e64dpnmq5f78hsf7g2ufnjvf9w","Post #49014","8727","ffff"
"BTC (SegWit)","bc1qg93thsg883n4e64dpnmq5f78hsf7g2ufnjvf9w","Post #49076","7666","EnjoyCocaine"
"BTC (SegWit)","bc1qyr4r069ngqsp37xqvpsjrr6jerszxuns2y3ygg","Post #56920","4179","Hornypimp"
"BTC (SegWit)","bc1q07xfvcpurnke4glkg0vy5q9klfxletcmee2q3j","Post #61892","405","CBT"
"BTC (SegWit)","bc1q5qv7hdh6ce3r7g5pmyctghhaxpuq25a550jfqw","Post #62262","11564","tyrone69"
"BTC (SegWit)","bc1q5qv7hdh6ce3r7g5pmyctghhaxpuq25a550jfqw","Post #62494","4681","mud"
"BTC (SegWit)","bc1qyr4r069ngqsp37xqvpsjrr6jerszxuns2y3ygg","Post #63083","5935","v0lant"
"BTC (SegWit)","bc1qt2vmslfqcqv88pkzrauz7qym6k2gruwf2mvkte","Post #63258","1320","Sapphie"
"BTC (SegWit)","bc1qmwxh52kc4z430h3zz6hwr44fgelsevh6c68vqw","Post #68993","1","pompompurin"
"BTC (SegWit)","bc1qmwxh52kc4z430h3zz6hwr44fgelsevh6c68vqw","Post #68995","1283","vince"
"BTC (SegWit)","bc1q0x4x45qqp44gevzhytekvv524hwd4aqdu2cqvk","Post #77251","14094","mostalerlsas1"
"BTC (SegWit)","bc1qkuftzndpefyyl4aaxw5dwjqmuklaaeyry9cumm","Post #86315","405","CBT"
"BTC (SegWit)","bc1qs9phe99h0rtwgykvk6jqwp8hkjfu7frryhzxca","Post #97013","15205","fuckiraq"
"BTC (SegWit)","bc1qs9phe99h0rtwgykvk6jqwp8hkjfu7frryhzxca","Post #97514","4605","Amesia"
"BTC (SegWit)","bc1q33k4ahrz35eydugpcdt8nv56p5ssd8592zfqhu","Post #149690","46144","B_RU_talLeak"
"BTC (SegWit)","bc1q5s6crncht6df9yz0cj56m0z24ps3uxuda5quk2","Post #202367","0","Unknown"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #716909","179398","vegildont"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #233735","47468","kr00kkk"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #233890","47471","Thevolch27"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #233911","51541","gntl9161"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #234386","34099","ramonmendez1919"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #259370","75233","fahrurrozi0303"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #273263","83785","Shirosama"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #274431","81587","Kenshiro"
"BTC (SegWit)","bc1quc3uawcpzmmac8u2lfxefpw53xynh3kuskd59s","Post #306902","91897","Moonlights"
"BTC (SegWit)","bc1quc3uawcpzmmac8u2lfxefpw53xynh3kuskd59s","Post #316038","93764","shishipoponana"
"BTC (SegWit)","bc1q5j87pahm7kulln2qp58rckektdmxjgm8856h7x","Post #318679","20386","salam100"
"BTC (SegWit)","bc1q5j87pahm7kulln2qp58rckektdmxjgm8856h7x","Post #318935","56165","KmetaNaEvropa"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #688980","190299","Evolved"
"BTC (SegWit)","bc1qs68k8cmspysr2aajrc2z2lgqjm97wlthuggs75","Post #421906","124471","nordox"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #718160","180814","Mioru"
"BTC (SegWit)","bc1q90jqwpc4rahxjnp8lxllqqa3edf4dhztx6cdcc","Post #483290","140679","Sshiro"
"BTC (Legacy)","3c21d12eb9afeb2b192a4b5e2bbc1b82","Post #492063","139770","ayawkolbatapakol"
"BTC (SegWit)","bc1q2ravpe2n2sufhfaly0ly3csuzanwtj9gxc8zqv","Post #528031","68308","banneduser"
"ETH","0x83443bc737af694cd26fd961bc13d5982292edac","Post #543560","40031","Wraith"
"BTC (SegWit)","bc1qch5p8rg9t88ky5kwect57u0ejws39a4hpz5rkm","Post #578698","94694","Brom"
"BTC (SegWit)","bc1db24379151a0808ee65fac03850162fcf3a591f7393c0d2d026c9be0bff3d","Post #612347","185484","anonjack"
"BTC (SegWit)","bc1q4cw9547e5cre4lvtwfrlfh0wsup4w9s9s8xnu2","Post #613680","187669","m00n1sh"
"BTC (SegWit)","bc1q60vm60x9lf60qlc2q657jvaf7r5cstffcp722f","Post #656029","120762","SoluTech"
"BTC (SegWit)","bc1qnemsmplqzdel2q9x8tghds0yd8dj6rgm000g0x","Post #656051","120762","SoluTech"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #666571","56915","rubberduck1"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #666572","98286","cytrunrs"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #666812","84148","deadlypayload"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #683844","43861","thenuker"
"BTC (SegWit)","bc1qs68k8cmspysr2aajrc2z2lgqjm97wlthuggs75","Post #702098","17","mary"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #724621","55532","dotsh404"
"BTC (SegWit)","bc1qln7cmwcuzpxmhwf523ytzckqstcghpy69q584f","Post #739922","1","pompompurin"
"BTC (SegWit)","bc1qln7cmwcuzpxmhwf523ytzckqstcghpy69q584f","Post #739934","166697","Middlemen"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #763397","213687","kyran123"
"BTC (Legacy)","1124626bc1fc9eca998b3478faf3dd7a","Post #771400","162646","DNI"
"BTC (SegWit)","bc1qc3v7gpyv6cmuz4rjslrwf6cda6t3qdnavcw9se","Post #787114","162646","DNI"
"BTC (SegWit)","bc1qg0jvzc0hxdyqhxqddlg7ud54yyln6y56jqln07","Post #798332","221207","Gwenie"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #803239","198906","NullRust"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #829081","227554","amaterasu7991"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #830341","3850","Cipher"
"BTC (SegWit)","bc1q3ayug4ftl07q99m5uqj68z788fpl9n4a8ym6cl","Post #839269","172268","ValentineIV"
"BTC (SegWit)","bc1qkc0985fex2ysuty7q26fss9zrfthrhm4h8z8al","Post #858083","74947","Pain"
"BTC (SegWit)","bc1qv59u7045pzwln7kahgsafk9yrg73e376uv8580","DM #139398","9272","papito"
"BTC (SegWit)","bc1qjqmknp27dmrhpqvpza946us9j6fsct4vafkp09","DM #3398","1431","algera"
"BTC (SegWit)","bc1qksxk3shhv67rcdl059k80r880apk9gvm845wtx","DM #139391","165782","timeGood"
"BTC (SegWit)","bc1qjqmknp27dmrhpqvpza946us9j6fsct4vafkp09","DM #3388","1612","Cash"
"BTC (SegWit)","bc1q4gs0ceuu4g6j92lzu07tufnx4jx62tpqm6qp3e","DM #647","320","deadvolvo"
"BTC (SegWit)","bc1q4gs0ceuu4g6j92lzu07tufnx4jx62tpqm6qp3e","DM #652","351","skywalker"
"BTC (SegWit)","bc1qsmc489lx9pgn5y0eufsqw4gs02d8chxr92rk6w","DM #813","43","drug"
"BTC (SegWit)","bc1qsmc489lx9pgn5y0eufsqw4gs02d8chxr92rk6w","DM #816","125","nest0r"
"BTC (SegWit)","bc1q00ztc2mrzdh0erfsjryz4w8hlkvyxmy6gnpfwj","DM #1023","17","mary"
"BTC (SegWit)","bc1q43fnvl9ulh5jfz9l38q7y4sr0cdz543gldt6ef","DM #18985","1513","soyjosecuervo"
"BTC (SegWit)","bc1q4dmnz0dmeknjnny4ajjshnwq9fpxrutdsha6lm","DM #2977","320","deadvolvo"
"BTC (SegWit)","bc1qupl5mwh4lqy3q3afa5zgww6hkzh4lwlzepmvju","DM #3099","496","FromOverThere"
"BTC (SegWit)","bc1qupl5mwh4lqy3q3afa5zgww6hkzh4lwlzepmvju","DM #3126","1431","algera"
"BTC (SegWit)","bc1q4dmnz0dmeknjnny4ajjshnwq9fpxrutdsha6lm","DM #3198","1431","algera"
"BTC (SegWit)","bc1qelzmnktw6ztn00eptl5yt9hhhc2lxjeknd3l2f","DM #15691","8119","royalcyka"
"BTC (SegWit)","bc1qzv76x32kqesxc0a0p86kmp84hrptaty5nsav9l","DM #3732","320","deadvolvo"
"BTC (SegWit)","bc1q5vedg5lhfpmmf33dkc4msff69awcysh38ccqqd","DM #4408","320","deadvolvo"
"BTC (SegWit)","bc1q5vedg5lhfpmmf33dkc4msff69awcysh38ccqqd","DM #4411","1643","snailbreach"
"BTC (SegWit)","bc1qrwdk83p92hqj4xcm62l84ka96t7evqa20aa696","DM #58059","33291","CNWang"
"BTC (SegWit)","bc1qp955vd7hastcpantg0aafm9ga4uerkmznaux9e","DM #4998","125","nest0r"
"BTC (SegWit)","bc1qng7n73py2h03l8lug3fcj88c3vd78am58qxj76","DM #5573","27","RoyalNavy"
"BTC (SegWit)","bc1qng7n73py2h03l8lug3fcj88c3vd78am58qxj76","DM #5576","2076","tenten"
"BTC (SegWit)","bc1qnv372qntssgtydyt6q49tnhk57q902rhrx4gzr","DM #143383","1980","Toster"
"BTC (SegWit)","bc1qdq0ke2m2rxqa8rxf89y9v8k5urc790f4vwm2a5","DM #6091","1283","vince"
"BTC (SegWit)","bc1q6mfkf3w4n7v238g5ds5nxe9tlnkfqxutluwz8g","DM #6206","245","kelvinsecurity"
"BTC (SegWit)","bc1qdq0ke2m2rxqa8rxf89y9v8k5urc790f4vwm2a5","DM #6299","125","nest0r"
"BTC (SegWit)","bc1qeqad9mlavayx450ed8rjzl5wswh72e7pym278u","DM #7183","3124","luffy"
"BTC (SegWit)","bc1qjt3hg5a3n49efhvr53udflff0xy4p2eg07p3j5","DM #137250","52072","CrazyTeam"
"BTC (SegWit)","bc1q7gyvylwu5rqdh98s7mu6gjlvempldcurpn20p9","DM #7487","1","pompompurin"
"BTC (SegWit)","bc1qjt3hg5a3n49efhvr53udflff0xy4p2eg07p3j5","DM #137243","2953","Blood"
"BTC (SegWit)","bc1qv29klggq8gkr487lmg2fqx6qx4p3qukgxccw6e","DM #137227","52072","CrazyTeam"
"BTC (SegWit)","bc1qv29klggq8gkr487lmg2fqx6qx4p3qukgxccw6e","DM #137181","27","RoyalNavy"
"BTC (SegWit)","bc1qu7w4whetx90qewvssuq8s56snam7jc8eq8jqcy","DM #7839","1","pompompurin"
"BTC (SegWit)","bc1qu7w4whetx90qewvssuq8s56snam7jc8eq8jqcy","DM #7848","1207","2BEE"
"BTC (SegWit)","bc1qkuw3l6j9zknqt4dqz0602r2zlwgmmz8gk87dag","DM #166853","10596","0BITS"
"BTC (SegWit)","bc1qrav9cmaglsnmc3yuwmd558zxhwvw8s8yymgpvk","DM #9103","4322","DaBoomBap"
"BTC (SegWit)","bc1qsjkkh7luy4k4qv8z9er50crzqgturgg529l8qt","DM #8433","723","emo"
"BTC (SegWit)","bc1q9aud6ejavunlv8qew76puqr6uru9hwvhfrvavk","DM #136888","496","FromOverThere"
"BTC (SegWit)","bc1qrav9cmaglsnmc3yuwmd558zxhwvw8s8yymgpvk","DM #9035","1","pompompurin"
"BTC (SegWit)","bc1qqyphmgz8l4cayv0y8gy8y5vujpwkfpkd59yujs","DM #9892","405","CBT"
"BTC (SegWit)","bc1qqyphmgz8l4cayv0y8gy8y5vujpwkfpkd59yujs","DM #9899","3999","BoredApe"
"BTC (SegWit)","bc1qvmvmres6x430x3m6lj5cryj66v6hllnghkmw3a","DM #185090","1513","soyjosecuervo"
"BTC (SegWit)","bc1qrhpph9wv0m0x90z9pp83yaxyurd8grfmtejfvk","DM #19471","3285","ernestogabaro"
"BTC (SegWit)","bc1q43fnvl9ulh5jfz9l38q7y4sr0cdz543gldt6ef","DM #19557","9272","papito"
"BTC (SegWit)","bc1qlaf6ehvmp2ufchsa5u93vne0heyx4fwnmdwlwf","DM #178935","2664","PieWithNothing"
"BTC (SegWit)","bc1qgxrfx27ns5z3eek92xj793kcv5vfz0plqkzx5w","DM #39253","9272","papito"
"BTC (SegWit)","bc1q63w02dqwfx4c37ttpe2jgpevlmfyvgqg2a9f8e","DM #19277","9272","papito"
"BTC (SegWit)","bc1q8nxtfxp4xge8s7n8g8mq74jrlzdl6lrpwj603u","DM #128735","147368","shadowkurenai"
"BTC (SegWit)","bc1q8nxtfxp4xge8s7n8g8mq74jrlzdl6lrpwj603u","DM #128704","3724","professional"
"BTC (SegWit)","bc1qrup2uawztya6gxjqnhypze6w9vqefh29ys4t4h","DM #135581","95583","Terribleness"
"BTC (SegWit)","bc1qrhpph9wv0m0x90z9pp83yaxyurd8grfmtejfvk","DM #19467","233","mont4na"
"BTC (SegWit)","bc1qr928xy9dvg2tramjnjqwm7csyd0u867gyhk36s","DM #14464","4934","cry"
"BTC (SegWit)","bc1qr928xy9dvg2tramjnjqwm7csyd0u867gyhk36s","DM #14711","829","fullm00n"
"BTC (SegWit)","bc1qelzmnktw6ztn00eptl5yt9hhhc2lxjeknd3l2f","DM #15308","374","actifedot"
"BTC (SegWit)","bc1quvdav0aj5jkvd2egy9e43wz252ndf67dz8c5za","DM #132647","2144","prankerua"
"BTC (SegWit)","bc1qrwdk83p92hqj4xcm62l84ka97evqa20aa696","DM #46165","15065","xiaohuw520"
"BTC (SegWit)","bc1qmq3plepw5qrarppt3y7vfzhaqcz6ltfdy2duqk","DM #16010","7666","EnjoyCocaine"
"BTC (SegWit)","bc1qmq3plepw5qrarppt3y7vfzhaqcz6ltfdy2duqk","DM #16016","4150","DemonPDV"
"BTC (SegWit)","bc1qe00g25ehyp20t9x24a740h9e5cah4ycjlg93cj","DM #132337","496","FromOverThere"
"BTC (SegWit)","bc1quvdav0aj5jkvd2egy9e43wz252ndf67dz8c5za","DM #132325","551","1984"
"BTC (SegWit)","bc1qqz25j7rydp88c2st3sa89vuwlg04whyt3z5djj","DM #17536","4981","udontknowme"
"BTC (SegWit)","bc1qutp8m5c9cyeap96rqve3ulkxsdqzmnyqfyy84g","DM #18754","9272","papito"
"BTC (SegWit)","bc1q6tq24vq6dx54kk9v8a6jdj5t9tltdaezys0ru5","DM #17984","4748","300rur"
"BTC (SegWit)","bc1qk7nth5eh3tvgydt2fpselfvh0y3tnr90pqnnqg","DM #19065","1980","Toster"
"BTC (SegWit)","bc1qk7nth5eh3tvgydt2fpselfvh0y3tnr90pqnnqg","DM #19072","9299","toteruss"
"BTC (SegWit)","bc1qe00g25ehyp20t9x24a740h9e5cah4ycjlg93cj","DM #132018","34687","luciifer2022"
"BTC (SegWit)","bc1qhn7x70jt7tjmau73j74ryx2gd389uucrm593w8","DM #30346","374","actifedot"
"BTC (SegWit)","bc1q5qv7hdh6ce3r7g5pmyctghhaxpuq25a550jfqw","DM #23451","8177","AMIGO"
"BTC (SegWit)","bc1q63w02dqwfx4c37ttpe2jgpevlmfyvgqg2a9f8e","DM #19842","2144","prankerua"
"BTC (SegWit)","bc1qfdp8ql6dr8ahpnptr53svpuzhm5rygrhzv2d7y","DM #33967","9872","Felix_Jr"
"BTC (SegWit)","bc1q354szqtefqrpfdhcarchdeqkxa59dw7hhl8wef","DM #49620","11300","pupkin24"
"BTC (SegWit)","bc1qgxrfx27ns5z3eek92xj793kcv5vfz0plqkzx5w","DM #20458","2144","prankerua"
"BTC (SegWit)","bc1q7w8yl6lltazragy2vanqm4e3c78aa9wmvy7gdv","DM #47732","9872","Felix_Jr"
"BTC (SegWit)","bc1qs60dqhp374d9dm9xcufyz7g0fh9gh4neueupvc","DM #24932","8","FederalAgentBrad"
"BTC (SegWit)","bc1qzlqfe6rj7emsx70mvl0t9e5daygp835g0pjkt3","DM #68715","26400","nan9e"
"BTC (SegWit)","bc1qzrwc32xq9rt0tvcavj0vyw2pwfuj0cp5wafv4a","DM #131371","245","kelvinsecurity"
"BTC (SegWit)","bc1q0dt4l2d0hh325ygcyuhenm4wp29qf0lw596vnq","DM #179654","9272","papito"
"BTC (SegWit)","bc1qtetxfgsh2t4yx3w2jgnmhlndgh22asrsgquue3","DM #155033","374","actifedot"
"BTC (SegWit)","bc1qzlqfe6rj7emsx70mvl0t9e5daygp835g0pjkt3","DM #68708","47316","DragonShell"
"BTC (SegWit)","bc1qqsdvdq3ysevl2dkh5dkrqhwneun6psyg8ln07e","DM #134240","189","Hidden"
"BTC (SegWit)","bc1qn24wrj3unajgawywmusa4js0a2vgm5whnkzhku","DM #23830","125","nest0r"
"BTC (SegWit)","bc1q0kt408lq9zsn66qjxuv5kgj69tkyemz82ee00x","DM #47462","231","Zane"
"BTC (SegWit)","bc1qkccw4302gy4fn9ua2z3ksyafuzw5np58f8a7a0","DM #24155","202","Null0Nulled"
"BTC (SegWit)","bc1qve69xzyqr6lduxm0qjwwhg7wsk2dkve2wvk4hp","DM #24215","7368","EdSheeran"
"BTC (SegWit)","bc1qve69xzyqr6lduxm0qjwwhg7wsk2dkve2wvk4hp","DM #24217","10090","iWorshipYukari"
"BTC (SegWit)","bc1q85372xdt68hghhyqa0uq9qlf0fk3a50svn6ht9","DM #24231","7368","EdSheeran"
"BTC (SegWit)","bc1q85372xdt68hghhyqa0uq9qlf0fk3a50svn6ht9","DM #24233","10090","iWorshipYukari"
"BTC (SegWit)","bc1qzg3pde65xef8t4y0kr6lekjyg2r79v806aaup4","DM #24256","7368","EdSheeran"
"BTC (SegWit)","bc1qzg3pde65xef8t4y0kr6lekjyg2r79v806aaup4","DM #24264","10090","iWorshipYukari"
"BTC (SegWit)","bc1q2f82eh6x4u7rgtu6lddcytq7erpwa02gdzkl88","DM #48084","9872","Felix_Jr"
"BTC (SegWit)","bc1q6mfkf3w4n7v238g5ds5nxe9tlnkfqxutluwz8g","DM #25016","3379","Nats2virola"
"BTC (SegWit)","bc1q7jphd09g7dghep8jtawztuxftpw0hsmesxhu76","DM #25134","245","kelvinsecurity"
"BTC (SegWit)","bc1qs60dqhp374d9dm9xcufyz7g0fh9gh4neueupvc","DM #25187","1","pompompurin"
"BTC (SegWit)","bc1q7jphd09g7dghep8jtawztuxftpw0hsmesxhu76","DM #25963","3379","Nats2virola"
"BTC (SegWit)","bc1qns9kh5y6nlvcyc3evyqqhc4dk3fspekej8a3xn","DM #26054","374","actifedot"
"BTC (SegWit)","bc1q2f82eh6x4u7rgtu6lddcytq7erpwa02gdzkl88","DM #48087","1881","illuminati"
"BTC (SegWit)","bc1qk297gmwzwx0splchma22wya68gcp62a87f2hve","DM #130934","155833","niplehead"
"BTC (SegWit)","bc1q258m8y79vjwmhe3fjczd82qdsd6fec4l6zp0gy","DM #41013","1367","baggio11"
"BTC (SegWit)","bc1qywm4s0d07pcyrk8e5kw5pyjq7p5p49y8jknr7l","DM #28324","9272","papito"
"BTC (SegWit)","bc1q258m8y79vjwmhe3fjczd82qdsd6fec4l6zp0gy","DM #40985","10231","Tokyo"
"BTC (SegWit)","bc1qu5c0x3z80ae5nfhxrgm45xq7dwr53pkqwrchm3","DM #28449","374","actifedot"
"BTC (SegWit)","bc1qu5c0x3z80ae5nfhxrgm45xq7dwr53pkqwrchm3","DM #28453","13230","DarenO"
"BTC (SegWit)","bc1qp06qrhklwrew4ge2c08q9c60mm457rcwjyc0f3","DM #33904","15223","iranhacker"
"BTC (SegWit)","bc1qns9kh5y6nlvcyc3evyqqhc4dk3fspekej8a3xn","DM #28975","13230","DarenO"
"BTC (SegWit)","bc1qhn7x70jt7tjmau73j74ryx2gd389uucrm593w8","DM #30376","14144","aduduketu"
"BTC (SegWit)","bc1q4u2jm54yca7vs9saehkd52tealdak0sen643dg","DM #56194","29558","popex"
"BTC (SegWit)","bc1q354szqtefqrpfdhcarchdeqkxa59dw7hhl8wef","DM #49510","2664","PieWithNothing"
"BTC (SegWit)","bc1q03dkgf306ut39x89rsv47a9v7a45a875v8c385","DM #32748","14094","mostalerlsas1"
"BTC (SegWit)","bc1q03dkgf306ut39x89rsv47a9v7a45a875v8c385","DM #32775","1","pompompurin"
"BTC (SegWit)","bc1q354szqtefqrpfdhcarchdeqkxa59dw7hhl8wef","DM #48943","1","pompompurin"
"BTC (SegWit)","bc1qqgpuzakl384jlmp8pu845p0pqjc7tn87xq424n","DM #41253","405","CBT"
"BTC (SegWit)","bc1qsnt8kp58ve68fq55zmtn9372x57hux3kujgq77","DM #34506","1","pompompurin"
"BTC (SegWit)","bc1qrwdk83p92hqj4xcm62l84ka96t7evqa20aa696","DM #55864","36140","CharlieSaoirse"
"BTC (SegWit)","bc1qw2m5ucvt6cr5qygy6897efffy446wc86tgcd30","DM #34991","405","CBT"
"BTC (SegWit)","bc1qw2m5ucvt6cr5qygy6897efffy446wc86tgcd30","DM #35001","13993","Max"
"BTC (SegWit)","bc1qr9k96evz2634gtcknthd4437780lhryjdx8d68","DM #57357","33291","CNWang"
"BTC (SegWit)","bc1qkt6fu04u3ltcvcc4q3mqjn4twyw8fepm7qzzug","DM #35347","3482","agent"
"BTC (SegWit)","bc1qkt6fu04u3ltcvcc4q3mqjn4twyw8fepm7qzzug","DM #35406","9170","that1guy123"
"BTC (SegWit)","bc1qxexzkzaj6hfav22xs4dr3z68szt84c3668j02l","DM #36108","16643","1breach"
"BTC (SegWit)","bc1q3n92fcvkmp29rgj6fuhlze8vcr37056kl3nq9w","DM #37787","16481","connwaer"
"BTC (SegWit)","bc1qgxrfx27ns5z3eek92xj793kcv5vfz0plqkzx5w","DM #39286","16049","mari_luca"
"BTC (SegWit)","bc1qqgpuzakl384jlmp8pu845p0pqjc7tn87xq424n","DM #41367","0","Unknown"
"BTC (SegWit)","bc1q7w8yl6lltazragy2vanqm4e3c78aa9wmvy7gdv","DM #49967","10308","Fernando112233"
"BTC (SegWit)","bc1q3wrau4epgrvgaym3h0kcdzs6q0y2vjsvcrenzq","DM #65563","8678","TarTarX"
"BTC (SegWit)","bc1q025qd73td39402x8vgxm3w4tj99a8s6cz5294g","DM #41806","20460","superus3r"
"BTC (SegWit)","bc1q025qd73td39402x8vgxm3w4tj99a8s6cz5294g","DM #41819","2144","prankerua"
"BTC (SegWit)","bc1qqeq7c9lgz936wq778tmy9nd3gzgr89ly5cnn8n","DM #41882","20460","superus3r"
"BTC (SegWit)","bc1qqeq7c9lgz936wq778tmy9nd3gzgr89ly5cnn8n","DM #41903","2144","prankerua"
"BTC (SegWit)","bc1qp06qrhklwrew4ge2c08q9c60mm457rcwjyc0f3","DM #42597","17911","AR4M"
"BTC (SegWit)","bc1qp06qrhklwrew4ge2c08q9c60mm457rcwjyc0f3","DM #43076","1709","Milktfunk"
"BTC (SegWit)","bc1qg5km4lsa28wljd92fkjvdnzxlhj4wvhlnardns","DM #199248","69","Baphomet"
"BTC (SegWit)","bc1q0taeykw4n6ztp7zp2q0ey3pngn3f86a0x62tzn","DM #48410","1","pompompurin"
"BTC (SegWit)","bc1qzydrthm8lkycrf6skm35ds0auwf6zuvxdeznlc","DM #44553","20460","superus3r"
"BTC (SegWit)","bc1qzydrthm8lkycrf6skm35ds0auwf6zuvxdeznlc","DM #44576","2144","prankerua"
"BTC (SegWit)","bc1qrwdk83p92hqj4xcm62l84ka96t7evqa20aa696","DM #45668","9872","Felix_Jr"
"BTC (SegWit)","bc1qrwdk83p92hqj4xcm62l84ka96t7evqa20aa696","DM #46097","15065","xiaohuw520"
"BTC (SegWit)","bc1qrwdk83p92hqj4xcm62l84ka97evqa20aa696","DM #46359","9872","Felix_Jr"
"BTC (SegWit)","bc1q0taeykw4n6ztp7zp2q0ey3pngn3f86a0x62tzn","DM #48405","3413","sm4rt"
"BTC (SegWit)","bc1q4u2jm54yca7vs9saehkd52tealdak0sen643dg","DM #56201","41787","IDGOD"
"BTC (SegWit)","bc1q0kt408lq9zsn66qjxuv5kgj69tkyemz82ee00x","DM #58429","13166","donaldwall"
"BTC (SegWit)","bc1qd0v0d24lutplr5z2620tdvfley708k09h8rlpvzcshw83ztlaxqqln9v96","DM #72027","2144","prankerua"
"BTC (SegWit)","bc1qtetxfgsh2t4yx3w2jgnmhlndgh22asrsgquue3","DM #52812","14363","Kumon"
"BTC (SegWit)","bc1qd0v0d24lutplr5z2620tdvfley708k09h8rlpvzcshw83ztlaxqqln9v96","DM #72026","14856","KillNet"
"BTC (SegWit)","bc1qr9k96evz2634gtcknthd4437780lhryjdx8d68","DM #54524","37326","RoyBJTX"
"BTC (SegWit)","bc1qr9k96evz2634gtcknthd4437780lhryjdx8d68","DM #54528","36346","golang"
"BTC (SegWit)","bc1q7w8yl6lltazragy2vanqm4e3c78aa9wmvy7gdv","DM #54965","33291","CNWang"
"BTC (SegWit)","bc1qlcspk3m7syv6suxa2rmzv0ldcxq3ft44tzxxzx","DM #96742","10365","Mr_Kant"
"BTC (SegWit)","bc1qx8ce6ae3k55tene9rznjk7afk7eewqercw2n6s","DM #56977","125","nest0r"
"BTC (SegWit)","bc1qx8ce6ae3k55tene9rznjk7afk7eewqercw2n6s","DM #56989","1283","vince"
"BTC (SegWit)","bc1qsn5zguf8ejylzrgm208hmgzqw3vs99vvvl5pgn","DM #65515","50506","LeviathanGiga"
"BTC (SegWit)","bc1qrdkjdtg844fs8q3e9p4hlnaad67yytpzcqh3r0","DM #92313","41787","IDGOD"
"BTC (SegWit)","bc1q96c09xrxu7yl0xr5ta2shrgykswda2czl24h3l","DM #62704","245","kelvinsecurity"
"BTC (SegWit)","bc1q74y5lrlqytuszldfwjn9hyc95ze7y3ga7j700k","DM #72181","23673","SSL3"
"BTC (SegWit)","bc1qsn5zguf8ejylzrgm208hmgzqw3vs99vvvl5pgn","DM #65480","8678","TarTarX"
"BTC (SegWit)","bc1q6h0ka0dw6cuasyhrxw3xetk9hvwwfsgv50g0lf","DM #78174","55100","skenersf"
"BTC (SegWit)","bc1qt8mhs6nm9udwgmfnustfh4tu9tvex3qjrqdxrt","DM #199290","1","pompompurin"
"BTC (SegWit)","bc1q74y5lrlqytuszldfwjn9hyc95ze7y3ga7j700k","DM #71351","245","kelvinsecurity"
"BTC (SegWit)","bc1qhygjg8tfunkq069zlfry5r3n6zznd97yaw9sv3","DM #74029","8678","TarTarX"
"BTC (SegWit)","bc1qhygjg8tfunkq069zlfry5r3n6zznd97yaw9sv3","DM #74035","50506","LeviathanGiga"
"BTC (SegWit)","bc1q8syrlq9sx7trkte4mfknwrsyste8d8789fl990","DM #74913","245","kelvinsecurity"
"BTC (SegWit)","bc1q8syrlq9sx7trkte4mfknwrsyste8d8789fl990","DM #76690","23673","SSL3"
"BTC (SegWit)","bc1q9lvtpe6uum8j3crnxj4a9zt0a08kpglcgnx8h9","DM #76690","23673","SSL3"
"BTC (SegWit)","bc1q9lvtpe6uum8j3crnxj4a9zt0a08kpglcgnx8h9","DM #75693","245","kelvinsecurity"
"BTC (SegWit)","bc1q6h0ka0dw6cuasyhrxw3xetk9hvwwfsgv50g0lf","DM #77933","1980","Toster"
"BTC (SegWit)","bc1qrn5gu2pmjjztfv7suux5mg5xuwkwcra9qcrnfm","DM #78881","480","Wild"
"BTC (SegWit)","bc1qlcspk3m7syv6suxa2rmzv0ldcxq3ft44tzxxzx","DM #100917","41787","IDGOD"
"BTC (SegWit)","bc1q40e3xtqadq0dtztge4m99yelxfeju843ef4lvs","DM #82017","189","Hidden"
"BTC (SegWit)","bc1qhf29r70trk83fkmepruxk60qwk8caxft7u9ste","DM #82443","245","kelvinsecurity"
"BTC (SegWit)","bc1qsaeuuz2l8mjg9hlxyapff8j675gkfvcd59ureu","DM #82630","20386","salam100"
"BTC (SegWit)","bc1qsaeuuz2l8mjg9hlxyapff8j675gkfvcd59ureu","DM #82632","169","SpotnikSignal"
"BTC (SegWit)","bc1q57rle7aqct08600m78t2k59agz5thnzxax9fw7","DM #84277","125","nest0r"
"BTC (SegWit)","bc1q57rle7aqct08600m78t2k59agz5thnzxax9fw7","DM #84302","15","Riptide"
"BTC (SegWit)","bc1qmh7h7phn3xh93hsrwj9ry2dpxmvkha25yr4aks","DM #88403","1","pompompurin"
"BTC (SegWit)","bc1qrdkjdtg844fs8q3e9p4hlnaad67yytpzcqh3r0","DM #93320","5751","copy"
"BTC (SegWit)","bc1qmh7h7phn3xh93hsrwj9ry2dpxmvkha25yr4aks","DM #88408","67912","BAWA"
"BTC (SegWit)","bc1qytf5xxaattmv4e7z7yj0lx2wn4wrkswy3dzmke","DM #89129","245","kelvinsecurity"
"BTC (SegWit)","bc1q6kc7z6rjnmqn8v2uughkdw04e4uuns600cxaxs","DM #111484","61844","Bjorka"
"BTC (SegWit)","bc1qytf5xxaattmv4e7z7yj0lx2wn4wrkswy3dzmke","DM #89159","70365","LionMan4657"
"BTC (SegWit)","bc1q24gp83glmeh3kgfn23zs7l8l2nhnu6m8xllcvd","DM #89621","1","pompompurin"
"BTC (SegWit)","bc1q24gp83glmeh3kgfn23zs7l8l2nhnu6m8xllcvd","DM #89637","24467","cr4ck4"
"BTC (SegWit)","bc1qfxmlkz0urreuqhwlezcw7np9z6t3erqjgpps7e","DM #91048","1942","LeakBase"
"BTC (SegWit)","bc1qr5qs3a9vxg6u9xr66x4cfre4jnhyy9jsynavjk","DM #91799","55","systeM"
"BTC (SegWit)","bc1q0m3t27w3sdggttuyhj29cngzets5dfemrljem9","DM #92792","76745","Pawns2kings"
"BTC (SegWit)","bc1qamsmv7qqlsn49p99ke5vyc8ytdgzmn7e9a46y5","DM #148408","177533","Lukelvan"
"BTC (SegWit)","bc1q06qnphqumtjm2ffack6yuds6m6z74tu92wsk0k","DM #125283","1400","404"
"BTC (SegWit)","bc1qq258dzf0tx0xg6snqt26nrc85qenysuh684920","DM #97148","245","kelvinsecurity"
"BTC (SegWit)","bc1qt6gzdtqkt5j248m3w2eps8t6nnxus5tf9svt34","DM #99504","8259","puppy"
"BTC (SegWit)","bc1qspcrvuxc0n9na7ek5s9erszjng3rzy3qrp2nqs","DM #101674","22040","alkhalifa888"
"BTC (SegWit)","bc1qp5qgvmu3zn4yys5ah69aytqz65ykhgataqf79g","DM #104525","8","FederalAgentBrad"
"BTC (SegWit)","bc1qzvzc2c87v4mvh52d759pzce53an9k7rtazh3lr","DM #104707","3996","Samuel"
"BTC (SegWit)","bc1qzvzc2c87v4mvh52d759pzce53an9k7rtazh3lr","DM #104699","2953","Blood"
"BTC (SegWit)","bc1qp5qgvmu3zn4yys5ah69aytqz65ykhgataqf79g","DM #104769","56165","KmetaNaEvropa"
"BTC (SegWit)","bc1qntpmp8ashh5093k8jue6ggeydaydf0303nwhw0","DM #107332","2953","Blood"
"BTC (SegWit)","bc1qntpmp8ashh5093k8jue6ggeydaydf0303nwhw0","DM #107399","56350","gulag"
"BTC (SegWit)","bc1q0pcal464hrykdllf9h9s086m7nl7nlzq3ygqvs","DM #107681","86587","post"
"BTC (SegWit)","bc1q6kc7z6rjnmqn8v2uughkdw04e4uuns600cxaxs","DM #111521","614","onesandzeros"
"BTC (SegWit)","bc1qcqy93mqk0a0ngfhkphfajq7crn7jjpemt8pl9d","DM #109789","44952","eva0x00"
"BTC (SegWit)","bc1q3cxmp3hf2m6ag6qv5gnclpczx46sj7y23yhj6h","DM #111669","50840","manonlavig"
"BTC (SegWit)","bc1q3cxmp3hf2m6ag6qv5gnclpczx46sj7y23yhj6h","DM #111758","66423","juliaezeji11121"
"BTC (SegWit)","bc1qspcrvuxc0n9na7ek5s9erszjng3rzy3qrp2nqs","DM #111794","1367","baggio11"
"BTC (SegWit)","bc1q9xr2cj7mq2heayytcanuf7lzcsv5gjw4l4tmmf","DM #113384","83544","aka_heker"
"BTC (SegWit)","bc1qhh5evtlerd76ffhzweg4y8e7909hhscs5wlndf","DM #113396","56263","rodneyrith"
"BTC (SegWit)","bc1quv722z462f8rd3mv9dhwsmpulpyhn4vjlwlgme","DM #204916","127859","daddyPotent"
"BTC (SegWit)","bc1qjjea22e9fsdswqp80cy69ffmx9985f60tjrqga","DM #204916","127859","daddyPotent"
"BTC (SegWit)","bc1qffalc5x8esfrghpqj2tpu27zrdh2x5p2w5nerx","DM #117445","2929","JVordicGG75M"
"BTC (SegWit)","bc1q8r3wazzk3hhsl0udj3ej654wqc7ppak3583l6s","DM #117819","3999","BoredApe"
"BTC (SegWit)","bc1qwvlu27hvarevydytpngffrafkul8xmsm77d4wv","DM #195605","374","actifedot"
"BTC (SegWit)","bc1q8r3wazzk3hhsl0udj3ej654wqc7ppak3583l6s","DM #118142","67377","remydanton"
"BTC (SegWit)","bc1q6kc7z6rjnmqn8v2uughkdw04e4uuns600cxaxs","DM #118326","111220","Requi3m"
"BTC (SegWit)","bc1qg0jvzc0hxdyqhxqddlg7ud54yyln6y56jqln07","DM #118545","130011","Gwengwenaja"
"BTC (SegWit)","bc1qzjuutg7y5dde9amq8whr499gpch34udguf568j","DM #119744","61844","Bjorka"
"BTC (SegWit)","bc1q24gp83glmeh3kgfn23zs7l8l2nhnu6m8xllcvd","DM #120159","67377","remydanton"
"BTC (SegWit)","bc1qgy97sytlgkn0uuetmkf02tzg0v5ka2f2sh28u9","DM #120265","60418","2023"
"BTC (SegWit)","bc1qgy97sytlgkn0uuetmkf02tzg0v5ka2f2sh28u9","DM #120302","91385","HostSlick"
"BTC (SegWit)","bc1q7rx7wsa4u83qvcl4dye7pp2t8n4crtm5753677","DM #121279","10411","LateNight"
"BTC (SegWit)","bc1qksxk3shhv67rcdl059k80r880apk9gvm845wtx","DM #139416","164630","5000695"
"BTC (SegWit)","bc1qnv372qntssgtydyt6q49tnhk57q902rhrx4gzr","DM #143519","55100","skenersf"
"BTC (SegWit)","bc1qk9yhxa9dq0qym60rj64t48zt08gtwxuxa0r0rf","DM #154120","245","kelvinsecurity"
"BTC (SegWit)","bc1qtstxnanenpld37qh5phzha35ptpgj5lpn0lyt3","DM #150562","61844","Bjorka"
"BTC (SegWit)","bc1qjwxl6zsj8zvhrylhjwcwhg4fkdxnrftu3zgw59","DM #154622","31","thrax"
"BTC (SegWit)","bc1qlaf6ehvmp2ufchsa5u93vne0heyx4fwnmdwlwf","DM #178923","69","Baphomet"
"BTC (SegWit)","bc1qkuw3l6j9zknqt4dqz0602r2zlwgmmz8gk87dag","DM #166849","88702","Antrax"
"BTC (SegWit)","bc1qfxmlkz0urreuqhwlezcw7np9z6t3erqjgpps7e","DM #165568","2144","prankerua"
"BTC (SegWit)","bc1q0z54a72u36qeywj0wxtecmprqqjmnx3hyhl8dy","DM #166987","27","RoyalNavy"
"BTC (SegWit)","bc1qpgtex54dre0vy8e6qrxm9nlxgq6sac72tmjlju","DM #167298","197446","DumpForums"
"BTC (SegWit)","bc1qpgtex54dre0vy8e6qrxm9nlxgq6sac72tmjlju","DM #167373","2144","prankerua"
"BTC (SegWit)","bc1qp9w8xr3p7cayhlepmfanfatj0ru4e9qv9ag4ss","DM #170362","69","Baphomet"
"BTC (SegWit)","bc1qp9w8xr3p7cayhlepmfanfatj0ru4e9qv9ag4ss","DM #170377","2664","PieWithNothing"
"BTC (SegWit)","bc1qln7cmwcuzpxmhwf523ytzckqstcghpy69q584f","DM #179194","206427","swaggervvo"
"BTC (SegWit)","bc1qerw635u2rz7ecgkqwxw74lk69muugg5u86supa","DM #175023","1513","soyjosecuervo"
"BTC (SegWit)","bc1qerw635u2rz7ecgkqwxw74lk69muugg5u86supa","DM #174385","195312","CorelDrawReal"
"BTC (SegWit)","bc1qsdackhdnlf9npsddhn0nuzca6d0w07h6d4p37w","DM #177555","2144","prankerua"
"BTC (SegWit)","bc1qsdackhdnlf9npsddhn0nuzca6d0w07h6d4p37w","DM #178105","1371","frezentis"
"BTC (SegWit)","bc1qz55y0kcv6ln9t4jf9sgm6y4pu0yygepqwq9ff8","DM #180549","11166","usrvoidy"
"BTC (SegWit)","bc1qz55y0kcv6ln9t4jf9sgm6y4pu0yygepqwq9ff8","DM #180635","180555","crim"
"BTC (SegWit)","bc1qvmvmres6x430x3m6lj5cryj66v6hllnghkmw3a","DM #184372","9272","papito"
"BTC (SegWit)","bc1qrkumjaddnmj4zct7p7p2z7dphsj9kewrxpdez0","DM #192015","61844","Bjorka"
"BTC (SegWit)","bc1qrkumjaddnmj4zct7p7p2z7dphsj9kewrxpdez0","DM #192017","91001","holytiger"
"BTC (SegWit)","bc1qvug2zh8mdjrjjeyfslhn8t0wtp8aggacgfzl72","DM #193339","1","pompompurin"
"BTC (SegWit)","bc1qvug2zh8mdjrjjeyfslhn8t0wtp8aggacgfzl72","DM #193989","189202","polatensy"
"BTC (SegWit)","bc1qwvlu27hvarevydytpngffrafkul8xmsm77d4wv","DM #196189","223235","neXGen1412"
"BTC (SegWit)","bc1qxd7qgmujtl3rsgjs62ajrcuw4tjw64008pr4n2","DM #197897","105399","SafeSig"
"BTC (SegWit)","bc1qfsf9xgddhl926m6uyra2y3peq7pemcjvmsxpvm","DM #199007","1","pompompurin"
"BTC (SegWit)","bc1qlrwl8yhjl0ewqkwst7ya8yz8k0dm0nnm2ke7xp","DM #199051","1980","Toster"
"BTC (SegWit)","bc1qlrwl8yhjl0ewqkwst7ya8yz8k0dm0nnm2ke7xp","DM #199080","56352","edward1111"
"BTC (SegWit)","bc1qfsf9xgddhl926m6uyra2y3peq7pemcjvmsxpvm","DM #199922","2664","PieWithNothing"
"BTC (SegWit)","bc1qv8kn27qk66q8a83veuxxl9zccv73fctcyvptqr","DM #201066","1980","Toster"
"BTC (SegWit)","bc1qt8mhs6nm9udwgmfnustfh4tu9tvex3qjrqdxrt","DM #201448","127859","daddyPotent"
"BTC (SegWit)","bc1qsnmun8j9gfxxdrt0c4ehlvcx9yvd9q34ku526w","DM #202335","224479","cphook"
"BTC (SegWit)","bc1q7zhdn4tvkw53h8lr74j5unglujcd28430nxqnc","DM #203064","1980","Toster"
"BTC (SegWit)","bc1q7zhdn4tvkw53h8lr74j5unglujcd28430nxqnc","DM #203093","55100","skenersf"
"BTC (SegWit)","bc1quv722z462f8rd3mv9dhwsmpulpyhn4vjlwlgme","DM #203477","1","pompompurin"
"BTC (SegWit)","bc1qapdue8d7g80qstpujtm0ycsp7yyffx3plus5dp","DM #205377","1","pompompurin"
"BTC (SegWit)","bc1qapdue8d7g80qstpujtm0ycsp7yyffx3plus5dp","DM #205393","288","nobody2390"
"BTC (SegWit)","bc1q52d0j2nuzv8uc9svuqytjg3zfrmum9z2ktvg93","DM #206024","3674","P1xor"
"BTC (SegWit)","bc1q52d0j2nuzv8uc9svuqytjg3zfrmum9z2ktvg93","DM #206088","105399","SafeSig"
"BTC (SegWit)","bc1qym58wt7dpch9zxhkt2479gndwkn50jfwqndyu6","DM #206329","18","jacka113"
"BTC (SegWit)","bc1qym58wt7dpch9zxhkt2479gndwkn50jfwqndyu6","DM #206366","156548","Ibrox"

The post BitCoin Wallet Addresses From the Breached Forums Cybercrime-Friendly Forum Community – A Compilation appeared first on Security Boulevard.

Dancho Danchev
Checked
12 minutes 29 seconds ago
Security Boulevard
The Home of the Security Bloggers Network
URL
https://securityboulevard.com/
Security Boulevard feed

Managed ad