ANONYMOUS HOTZ Claims Responsibility on Dark Web for “Instagram Down Today” Outage

TraceX Labs, an Indian cybersecurity and threat intelligence company, has identified a dark web portal where a threat actor group calling itself ANONYMOUS HOTZ /// APT,,is claiming responsibility for the massive outage that affected Instagram and Facebook globally on June 12, 2026.

The dark web page, hosted on a Tor hidden service, appeared shortly after millions of users worldwide reported issues accessing Meta-owned platforms. During the outage, users experienced login failures, app crashes, feed loading problems, and web service errors across Instagram and Facebook.

The hidden service loads primarily in Chinese language by default and includes an option to switch the portal into English.

Dark web onion link identified by TraceX Labs:

http://snicftgczh2ykx63skfevccrjrnmzbsqtje3zfdmgoruggm6psqnkpid.onion/

What the Dark Web Portal Says

According to the translated content reviewed by TraceX Labs, the actor claims to have launched a Distributed Denial-of-Service (DDoS) attack against Meta Platforms infrastructure.

The portal states:

On 12 June 2026, we executed a Distributed Denial of Service (DDoS) attack against Meta Platforms global infrastructure.

The page further claims that Instagram and Facebook services were taken offline globally,causing mobile applications to crash and web services to return errors for more than six hours.

$100,000 Ransom Demand

The dark web portal includes a ransom demand of $100,000 USD payable in USDT (TRC20) cryptocurrency.

Wallet address displayed on the site:

TKjqghf5aYdnpE4ZXFexZd1HYRrYC1EVXa

The threat actor warns that if payment is not made within 30 days, another larger attack will allegedly be launched against Meta infrastructure.

One section of the page states:

Failure to pay equals permanent Meta takedown.

Another warning displayed on the portal claims:

Next attack: Full infrastructure collapse | 14+ days offline | Complete service destruction.

The site also threatens retaliation if legal action, wallet blacklisting, or countermeasures are attempted.

Key Findings from TraceX Labs Investigation

ItemDetail

Investigating organization TraceX Labs

CountryIndia

Threat actor aliasANONYMOUS HOTZ /// APT

Portal languageChinese by default with English translation

Claimed attackDDoS on Meta infrastructure

Claimed affected servicesInstagram and Facebook

Claimed outage duration6+ hours

Ransom amount$100,000 USDT (TRC20)

Wallet addressTKjqghf5aYdnpE4ZXFexZd1HYRrYC1EVXa

Onion linkhttp://snicftgczh2ykx63skfevccrjrnmzbsqtje3zfdmgoruggm6psqnkpid.onion/

Technical evidence providedNone identified

No Verified Evidence Yet

Although the Meta outage itself was real and widely reported globally, TraceX Labs states that there is currently no verified technical evidence proving that the outage was caused by the threat actor behind the dark web portal.

At the time of publication:

  • Meta has not confirmed any cyberattack.
  • No forensic evidence linking the outage to a DDoS attack has been publicly released.
  • No technical indicators or attack infrastructure details have been shared by the actor.

Cybersecurity researchers believe the disruption may also have resulted from internal infrastructure issues, routing failures, or configuration-related problems rather than malicious external activity.

Meta Yet to Release Root Cause

Meta acknowledged the outage publicly and confirmed that restoration efforts were underway. However, the company has not commented on the dark web claims identified by TraceX Labs.

No official root cause analysis has yet been released.

Advisory from TraceX Labs

TraceX Labs advises the public and media organizations to avoid spreading unverified cyberattack claims without technical evidence.

The company also recommends:

  • Do not engage with extortion demands or cryptocurrency wallets.
  • Wait for official technical analysis before attributing the outage to a cyberattack.
  • Exercise caution while accessing dark web infrastructure and onion services.
  • Monitor verified cybersecurity and threat intelligence updates.

Conclusion

At present, the claims made by ANONYMOUS HOTZ /// APT�remain unverified. While the timing of the dark web post coincides with the global Instagram and Facebook outage, there is currently no confirmed evidence proving the actor was responsible for the disruption.

TraceX Labs continues to monitor the dark web portal, associated cryptocurrency activity, and any emerging threat intelligence connected to the incident.

About TraceX Labs:

TraceX Labs is an Indian cybersecurity and threat intelligence company specializing in malware analysis, dark web intelligence, cyber investigations, AI-powered security research, and digital threat monitoring.