On January 29, 2025, the United States Federal Bureau of Investigation (FBI) and international law enforcement agencies have seized multiple domains associated with hacking forums Cracked.io and Nulled.to, which were known to host content related to software cracks, credential stuffing attack tools and other illicit activities such as a “combo lists” marketplace with stolen credentials or databases.
In addition to the two forums, the FBI also seized:
- mysellix.io and sellix.io, which allowed users to create online stores. Threat actors used them to sell stolen data, software keys and compromised accounts.
- starkrdp.io, a Windows RDP virtual hosting provider used for credential stuffing attacks.