We wanted to make yet another blogpost about how hackers get hacked on daily basis by infostealer malware, when attempting to use it themselves to infect other victims, mostly featuring statistics and graphs (and we'll publish that also, later).

But accidentally, we uncovered the identity of one of the founders of the Crax Pro forum, a rather large site focused on "Cracking, Spamming, Carding and Hacking" (their own words).

Here's how it happened.

What is the Crax Pro forum?

Crax Pro is a hacker forum focused on sharing all kinds of shady stuff, such as stolen credentials (quite an irony, as you'll see) and credit cards, leaked porn, various hacker tools, scamming tutorials and more. Having more than 640 thousands registered members, although being used mostly by script-kiddies and other less skilled wannabe cybercriminals, it's one of the bigger ones.

Crax Pro has been operating since at least 2020, originally on the crax.pro domain, moving to the current craxpro.io in 2022.

During its 5 years of existence, it went from hundreds to hundreds of thousands of users, as can be seen on the graphs below, which we created using data extracted from web.archive.org, that took snapshots of the site over the time.

Since its inception, most prominent member, active on the site to this very day, is Thanos Crax. As his nickname suggests, he's the founder and de-facto owner of the whole thing.

Sloppy criminals are sloppy

The fact that cybercriminals tend to be somewhat sloppy about their opsec, especially when they reside in countries they deem to be "safe", is long known and other stories on this topic have been already published.

What we originally wanted to do, was to create some nice graphs and maps, showing users of which forums are most prone to infostealer infections and where they are geolocated (and that's still the plan, yet postponed because we decided to publish this text first).

In order to do this, we created a list of ~10 most frequented "darknet forums" (although in this case, the darknet is just a buzzword, because most of these forums operate openly on the clearweb, hiding in plain sight). One of them was craxpro.io.

While downloading CSV exports from our internal tool that we could use later for the statistical analysis, we stumbled upon a very unusual subdomain being accessed by one of the infected users included in our database - webmail.craxpro.io.

It was clear to us, that this is no ordinary user, but rather someone having at least some degree of connection to the forum's daily operations. Turns out, it's the Thanos Crax himself.

While re-selling stealer logs himself, he managed to get infected during 2022. Two years later, package containing information stolen from his computer appeared in our database after being shared on Telegram as a part of bigger archive by another threat-actor.

In addition to webmail.craxpro.io / webmail.crax.pro domains, where he logged in using the support@crax.pro address, we discovered many more credentials proving that this indeed is the admin of the Crax Pro forum. For example, credentials for following URLs have been also included in the package:

https://craxpro.io/admin.php
https://craxpro.io/login/
https://www.crax.pro/admin.php
https://ns1.crax.pro/admin.php
https://www.crax.tube/login

And many, many other accesses to other hacker forums. Furthermore we discovered, that besides the Thanos Crax monicker, this individual used nick Bl4ckc0d3 for at least some time in the past.

By enumerating user IDs on craxpro.io, we discovered that Bl4ckc0d3 possesses user ID 1, being the first registered user on the forum, further confirming our assumption that we are dealing with the admin of the site.

Student 🎓 Traveller ✈️ Car Enthusiast

Files included in the infostealer package allowed us to uncover the real identity of Thanos Crax. While often using e-mail address thanoscrax1@gmail.com for registrations, as a part of the Passwords.txt file we discovered another address belonging to Malik F., a student (at least at that time) of computer science at The Regent School in Abuja, Nigeria.

While it is true that the same device can be used by multiple users (thus credentials belonging to more different people can appear in the same package), we are fairly sure that in this case we are talking about the same individual, because he often re-uses very specific password (containing name of a specific car brand, we'll get to that later) across the personal and Thanos Crax accounts.

In other cases, he uses the word "Crax" as part of a password in combination with the personal email address.

Using the information available to us, we quickly discovered Facebook and LinkedIn profiles belonging to the user:

Next, we found a TikTok profile of the same person, full of influencer-ish happy videos of him traveling, and, of course, going to places in fancy cars, sometimes with the red/blue warning lights on, to seem more important.

Some videos feature religious content, with Malik showing belief that it's his faith that's responsible for success he enjoys in his life. We are no theology experts, but we suspect that no higher power is at play here. Rather, just very mundane, old-fashioned cybercrime he's profiting from.

Note that Thanos Crax is the sole contributor to the Crax Pro forum Islamic section, posting content there quite similar in nature:

---

In this article, we wanted to show you three things:

• that cybercriminals are often as sloppy as regular users they wish to prey on
• that you can uncover pretty much everything about anyone, if their private information leaks to the darknet due to infostealer infection
• that while the mills of God are grinding slowly, HackedList.io monitoring goes nonstop

We are ready to cooperate with law-enforcement as well as with other security researchers on the matter. If you are interested, let us know.

If you don't want to be as surprised as Thanos Crax / Malik F., register on Our Portal and discover how we can help with protecting your organization from the threat infostealer malware poses.

---

Update 01-30-2025: Authorities have taken down two other big hacker forums, Nulled and Cracked. Thanos Crax is more than happy about that development, and wishes to provide new home to their users on his platform.

Update 01-30-2025: Administrators of craxpro.io enabled mandatory, invite-only registration, supposedly because of the Nulled/Cracked takedown.

Update 02-03-2025: To the suprise of the admins, Cloudflare marked craxpro.io as a phishing site.