StealthMole Traces ImLupin Credential Operation Across Telegram and Forums
Summary
StealthMole says it linked ImLupin’s UK credential-dump listings to a rebranded Telegram storefront, two account shops and a historical Telegram ID. Evidence suggests an Indonesian connection, but the seller’s real-world identity remains unresolved.
Key points
- StealthMole says its monitoring identified 208 listings tied to ImLupin, including an advertised UK email-and-password dump.
- Researchers connected Telegram channels to the seller through shared branding, contact handles and repeated posts about losing access and rebuilding channels.
- Historical records tied two changing Telegram usernames to the same numeric user ID, 5717234229; the first name Nordik remained constant.
- The investigation found two Lupin-branded account storefronts and activity across multiple underground forums. It also identified forwarded credential-checking results, but did not resolve the operators behind Chodev or DATA LOOKUP.
- Messages in a Palembang community group and casual Indonesian-language posts suggest a possible Indonesian connection, not a confirmed location.
- StealthMole says a leaked MemeChat record offered a corroborated lead, while a YouNow connection could not be established with confidence; the seller’s real-world identity remains unresolved.
Article Details
- Attack Vectors
- ImLupin advertised UK email-and-password dumps on underground forums.
- The operation used Telegram channels and branded storefront websites to sell checked mail access and verified accounts.
- Credential-checking tools were shown processing records and producing plaintext hit results; the article does not identify the tools or explain their methods.
Threat Actors
Vendors
Tools
Dark Web TrackerReturning to the storefront side of the investigation, StealthMole's Dark Web Tracker was used to pull the full history behind the Telegram channels ImLupin had built.Leaked MonitoringThe investigation began with StealthMole's Leaked Monitoring tool, which had indexed a post from a seller operating under the name ImLupin on the patched forum.Telegram TrackerThe telegram link t.me/Lu******e was further investigated in StealthMole’s Telegram Tracker, which led us to channel called Lupin | Hub.