[COINBASECARTEL] – Ransomware Victim: Property Finder / PropSpace
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the COINBASECARTEL Onion Dark Web Tor Blog page.
AI Generated Summary of the Ransomware Leak Page
On November 4, 2025, a leak post associated with the victim Property Finder / PropSpace appeared on the CoinbaseCartel leak page. The victim is described as Property Finder / PropSpace, a Business Services company based in the United Arab Emirates (AE). The page presents a sparse entry; the body excerpt reads “Property Finder / PropSpace • CoinbaseCartel propertyfinder[.]ae,” with the domain defanged to propertyfinder[.]ae. The metadata indicates there is a claim URL linked to the post, but no additional content is shown in the excerpt. There are no downloads, no images, and no other links documented on the page (downloads_present is false; images_count and link_count are both zero). The key date provided is the post date (2025-11-04 19:13:12.419673); there is no separate compromise date given in the data. In the description field, the fragment “Samples on Friday/” appears, suggesting a teaser or partial content rather than a full data disclosure.
The post offers limited insight into the incident’s impact. The impact field is empty, and there are no stated encryption events, data exfiltration details, or ransom figures in the available text. The page contains no screenshots or media to corroborate the claim (images_count is 0), and there are no visible downloads or links beyond the implied claim URL. The presence of a defanged domain in the body excerpt indicates a link to additional content, but the current record remains a minimal disclosure. Focusing on the named victim, Property Finder / PropSpace, the leak appears to be a sparse note from CoinbaseCartel with little corroborating material in this record.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
