Leak-Forum CTI Correlation Lab
A queue of leak-forum listings lands in your threat-intel feed. One shouts “FRESH 2026” over a dump whose file hash and record count match a thread from two years ago. One is the same dump cross-posted on a second forum under a different handle. Two differently-named sellers share a PGP fragment and an escrow tag. Four small victims in one sector post inside a nine-day window with sequential batch IDs. And some cases just look linked — a round number, the same victim named twice. You read only the post metadata, never the leaked data. For each, call the correlation verdict and name the tell — a matching hash / sample header, a cross-forum artifact, a shared selector, or a temporal + sector cluster. Correlate on what you can verify, not the headline. Defensive only; 100% synthetic data.
The real job. More noise, a tighter clock.
Correlation queue
1 / 10 called
A single new listing, no prior sighting
One post appears in the feed; the analyst checks whether it correlates to anything already tracked.
Leak-forum post metadata (1 record) · synthetic
Brightpark Logistics — customer export (new)
Tip: inspect the hidden artifact before you decide — titles and handles lie, the hash / sample / selector is the evidence.
1 · Correlation verdict
2 · Primary tell (the selector / pattern)
Pick a verdict and the primary tell to continue.
Artifact age gap
These artifacts were last seen never (no prior sighting). One signal among several — weigh it with the hashes, sample columns and shared selectors.
Correlate
A queue of 10 synthetic leak-forum cases. For each, call the correlation verdict — recycled, duplicate thread, same actor, coordinated campaign, or no correlation — and name the primary tell (the selector or pattern). Several are coincidences — do not over-link.
So far: 0 / 10 cases called.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based CTI drill: work a queue of synthetic leak-forum cases and, for each, call the correlation verdict and name the selector that decides it — reading only POST METADATA, never leaked data.
- Four correlation techniques plus coincidences: recycled / old-leak-as-new (identical hash, sample columns or exact count vs an older thread), cross-forum duplicate (matching artifacts on two forums within days), alias linkage / same actor (a shared PGP fragment, escrow tag, contact or writing tic across two handles), and coordinated campaign (a temporal + sector cluster, often with sequential batch IDs or a shared broker).
- Several cases are deliberate coincidences — a round record count, the same victim named twice, the same sector in the same week — so you learn NOT to over-link, which is as much of the skill as catching the real correlations.
- Every case teaches why it matters to a defender: recycled-leak detection stops a CISO burning an IR cycle on a two-year-old dump; duplicate detection keeps breach counts honest; alias linkage attributes activity to one actor; campaign spotting raises a sector advisory before the next batch lands.
- 100% synthetic and defensive. Fabricated handles, thread titles, dates, companies, hashes and record counts; all IPs are RFC 5737 TEST-NET / RFC 3849 documentation space. No real usernames, people, breached company, leaked data, download links or forum URLs. Difficulty tiers, a speed bonus and an S–D grade.
The verdict follows the artifacts, not the sales pitch
Leak-forum sellers control the title, the handle and the headline number — so those are the least trustworthy things in a listing. Correlation works because the hard artifacts are much harder to fake. A recycled dump gives itself away when its file hash, sample-column header or exact record count is identical to a much older thread: the data cannot be new if the hash did not change, no matter what “FRESH 2026” or an inflated “5M” count claims. A cross-forum duplicate shows the same hash and sample rows appearing on two forums within days — one event, not two. Alias linkage rides on reused selectors — a PGP fingerprint, an escrow or payment tag, a contact, a verbal tic — that tie two handles to one actor even when the writing style is deliberately different. A coordinated campaign is a tight temporal + sector cluster, often with sequential batch IDs or a shared broker across otherwise unrelated-looking posts.
Just as important: do not over-link. A suspiciously round “1,000,000” is a rounded sales figure, not an artifact; the same victim named twice can be two separate incidents (even a re-breach) when the hashes and sample schemas differ; and two breaches in one sector in one week are often just coincidence without a shared broker, selector or batch IDs. Each correct call pays off for a defender: recycled-leak detection stops a CISO burning an incident-response cycle and customer notifications on a two-year-old dump; duplicate detection keeps breach counts honest; alias linkage attributes a seller’s full activity to one profile; and catching a campaign early lets you raise a sector advisory before the next batch is posted. Correlate on selectors you can verify, and the queue stops being noise.
Real-world prior art, credited: this lab’s correlation mindset is inspired by Iván Castañeda (@ivancastl) and his open-source project darkforums-ip-intel. Responsible-use note: his dataset contains leak-derived PII and is for authorized CTI research only — this lab reproduces none of it and uses only synthetic data. This is an educational simulation, not legal advice, and not an endorsement of accessing leaked data.
Frequently asked questions
What does the Leak-Forum CTI Correlation lab teach?
It trains the correlation call a blue-team / CTI analyst makes on leak-forum POST METADATA — not on any leaked data. For each case you see a small set of synthetic forum-post records (forum label, thread title, author handle, post date, claimed victim and claimed record count, plus an advertised artifact such as a file hash, a sample-column header, a PGP fragment or an escrow contact) and you decide the verdict: recycled old leak sold as new, the same dump cross-posted on two forums (a duplicate thread), two handles that are really one actor (alias linkage), a coordinated campaign against one sector, or no correlation at all. You also name the tell — the specific selector or pattern that decides it. It is detection and triage practice; it does not find, download, scrape or deanonymise anything.
Is the data in this lab real?
No. Every forum label, thread title, handle, date, victim company, IP address, hash and record count is 100% synthetic and fabricated for teaching. There are no real usernames, no real people, no real breached company, no real leaked data, no download links and no forum URLs. All IP addresses use the RFC 5737 TEST-NET ranges (192.0.2.x, 198.51.100.x, 203.0.113.x) and RFC 3849 documentation space (2001:db8::), and all hashes are placeholder hex. The lab reproduces no real dataset and cannot be used to access anything.
Who is this based on, and what is darkforums-ip-intel?
The real-world inspiration is Iván Castañeda (@ivancastl) and his open-source project darkforums-ip-intel, which demonstrates correlating leak-forum activity for cyber threat intelligence — see https://github.com/Ivancastl. Responsible-use note: his dataset contains leak-derived PII and is for authorized CTI research only. This lab credits that prior art but reproduces NONE of his data and uses only synthetic examples. It teaches the defensive correlation mindset (triage metadata to prioritise threats), not how to obtain, scrape or process real leak data.
Is this legal and defensive, or does it help access leaks?
It is strictly educational and defensive. The lab teaches a CTI analyst how to correlate the POST METADATA a threat-intel feed already surfaces, so a security team can triage which claims deserve attention — spotting a recycled dump before opening a needless incident, merging duplicate threads, attributing activity to one actor, and seeing a sector campaign early. It is not an endorsement of accessing leaked data, it contains no instructions for finding or downloading leaks or operating on real forums, and it names forums only as abstract labels. Treat it as a training simulation, not legal advice; a real investigation must follow your own authorization and legal guidance.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.