A group presenting itself as recent, associated with a community called "Normal Hunters." Its method is financial pressure: it publishes a list of victims and threatens to sell stolen data, with no server encryption or classic malware observed to date.

Why does mentioning PayPal and Stripe change the risk?

NETIM is a domain registrar and hosting provider: its clients are mostly businesses. A claim touching their billing and payment information shifts the risk from the individual to the client business itself.

NETIM: French hosting registrar targeted, source code and Stripe claimed

Q: Is the NETIM leak confirmed?

Not to our knowledge. The DYSPHOR1A group claims the intrusion, but no public confirmation from NETIM was found at the time of writing.

⚠️ Claimed, not confirmed. No public confirmation from NETIM was found at the time of writing. The pattern observed — publishing a victim list, threatening to sell the data — is that of a data-extortion group, not a classic ransomware operation with system encryption.

What's claimed

IP + code

IP addresses and source code claimed as exfiltrated.

DYSPHOR1A's claim, not confirmed.

Servers

Server configurations and infrastructure data.

DYSPHOR1A's claim.

PayPal · Stripe

Information linked to clients' electronic payment methods, and billing data.

DYSPHOR1A's claim.

Server encryption or classic malware observed — the pattern remains the threat of publication.

ZATAZ.

Timeline

CLAIMED

Week of August 17–23, 2026

The DYSPHOR1A group claims an intrusion at NETIM: IP addresses, source code, server configurations, billing data, customer personal data, PayPal and Stripe information, infrastructure details.

CONTEXT

2026

DYSPHOR1A presents itself as a recent group, associated with a community called "Normal Hunters." Its method relies on financial pressure: a storefront listing victims, monetizing certain databases, removing content upon payment.

🏢A hosting provider, so a business risk

NETIM isn't a consumer service: it's a domain registrar and hosting provider whose clients are mostly businesses and freelancers. A claim touching their billing and payment information shifts the main risk from the individual to the client business — wire fraud, impersonation of the client's own professional identity toward its own contacts.

What it changes for you

If you're a NETIM customer for a domain name or hosting, stay alert to any communication asking you to change your bank details or resend a payment, even if it cites a real invoice. See From Leak to Scam.

🔒 Always verify by an independent channel (phone, not the email received) any change of payment details, even seemingly from a regular provider.

Frequently asked questions

Is the NETIM leak confirmed?

Not to our knowledge at the time of writing.

What is DYSPHOR1A?

A data-extortion group presenting itself as recent, with no server encryption observed to date.

Why do PayPal and Stripe change the nature of the risk?

Because NETIM's clients are mostly businesses: the risk shifts toward professional fraud, not just personal identity theft.

📌 Last checked: August 24, 2026. Verifiable information to report: contact@egidio.app.

NETIM: a French registrar targeted by a new extortion group

What's claimed

Timeline

🏢A hosting provider, so a business risk

What it changes for you

Frequently asked questions

Related reading