@lorenzofb There's https://www.dfsec.com though I don't think they sell spyware but "only" exploits.