ElSurveillance
Attribution profile
- Type
- Activist
- Location
- United States of America
- Known incidents
- 16 incidents
- Sources
- 5 sources
- First seen
- 2015-07-18
- Last seen
- 2016-11-12
- Updated
- 2026-10-15 03:18
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
ElSurveillance, also known as @ElSurveillance and associated with the #EscortsOffline operation, is a hacktivist based in the United States of America. The actor primarily targets dating and escort‑related websites, including platforms serving Muslim users, and has exposed user data from sites such as freedateusa.com, 24luv.com, Shadi.com, MuslimMatch.com, AfrikaDating.com and AdultSingleSites.com.au. ElSurveillance states that its actions aim to warn users about alleged Russian black‑hat operators, criticize societal values and governments, promote Quranic listening, and discourage use of the services through public shaming and the threat of data exposure. Typical tactics involve web defacement that posts messages urging visitors to listen to the Qur’an and examine server logs, the extraction and publication of databases containing email addresses and plain‑text passwords, and the claim of reusing administrator credentials across multiple sites hosted on the same infrastructure. No specific malware families or tools are referenced in the open sources. Public attribution does not link ElSurveillance to any state sponsor or criminal consortium; the actor describes itself as an independent hacktivist. Notable operations include the November 2016 breach of freedateusa.com and 24luv.com, which yielded over 220 000 credential records and a defacement warning of Russian black‑hat activity, and the July 2016 series of compromises affecting Shadi.com (over two million records), MuslimMatch.com (150 000 accounts with 790 000 private messages), AfrikaDating.com and AdultSingleSites.com.au, as well as the July 2015 defacement campaign against numerous escort sites such as ohcecilia.com and seductivealchemy.com that exposed visitor IP addresses and browser information.
Incidents
Attributed incidents are available to members.
16 incidentsSources
Sources available to members: 5 sources.