Cloudflare 0-Day, Ameli Patient Leak, and New Fraud Tools Detected on Dark Web

SOCRadar’s Dark Web Team has identified a wave of underground listings that highlight both technical exploits and large-scale data breaches, including a threat actor claiming to sell a private Cloudflare 0-Day bypass method through Host Header Injection, reportedly enabling DNS SSRF and cache poisoning with a PoC tested against a Coinbase login page.

The same wave includes an alleged Ameli database on sale, with a claim that the dataset contains approximately 8 million French patient and customer records and includes a sample, listed at 200 EUR. Also flagged are an alleged scam page targeting Binance, a new email sender tool for sale, and a 60,659-line credit card dataset claimed to originate largely from Chile, priced at 40,000 USD.

A purported verification and KYC facilitation service is described as well, with pricing starting at $10 and postpaid options for buyers with forum reputation. According to SOCRadar Dark Web Team, the postings point to a continued expansion of illicit services across fraud, exploitation, and credential harvesting domains, with a date stamp of 22 September 2025.