BontenSec

BontenSec is a defacement-focused cluster whose public footprint is visible primarily through web-defacement archives. The strongest repeated association is with the notifier p2wnz, who submitted a multi-subdomain campaign against municipal digital services associated with Villa Carlos Paz, Argentina, on 2025-12-23 and later appeared in BontenSec-tagged activity against Algeria's ENSSEA education environment. In 2026, p2wnz/BontenSec was again recorded against Brazil's PROCON Acre domain.

The actor's activity is not geographically limited to Argentina and Brazil. Archive records show BontenSec-tagged operations against targets in Algeria, Turkey, Nigeria and other locations, suggesting opportunistic target acquisition alongside regional signaling. Defacement pages use BontenSec branding and, in the Argentina campaign, Portuguese-language taunting. Language and target choice are not sufficient to establish operator origin.

Additional archive identities including nicotine and 0x.Zh3n appear in BontenSec-tagged entries, but both archive ecology and the behavior of p2wnz show that notifier identities can operate under multiple team labels. These names should be treated as associated operational pivots rather than automatically as core members.

INFERENCE (confidence: medium-high): BontenSec functions as a loose defacement identity or crew label with repeatable website-compromise outcomes and flexible operator affiliation. Its current demonstrated impact is primarily public web integrity and reputational disruption rather than data theft, persistence or destructive access.