Shinyhunters
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Indicators of Compromise (IOCs)
IP addresses
2- 91.202.4.68
- 176.120.22.24
Get the complete IOC feed
The full IOC database by API, ready for your SIEM or SOAR.
Create free accountNo credit card required · Free API key
Known infrastructure
The following Tor hidden services have been associated with this group:
// SHLoading http://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion/SHSH// SH
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Shinyhunters’s victim list.
risk score · threat categories · sources · age · confidence — in one request