Threat intelligence API / Reference / Dark web

Dark web endpoints

Ransomware leak-site listings, groups and victim records from ThreatCluster's own collection.

GET /darkweb/stats · GET /darkweb/ransomware/victims · GET /darkweb/ransomware/groups · GET /darkweb/ransomware/group/{group_name} · GET /darkweb/ransomware/victim/{victim_id} · GET /darkweb/keyword-hits · GET /darkweb/ransomware/victims/facets · GET /darkweb/trends

GET /darkweb/stats

Dark-web counts + last-sync timestamp · 1 credit per call

Get dark web monitoring statistics.

Returns ransomware group counts and victim counts.

Response 200 · DarkwebStatsResponse

Field	Type	Meaning
ransomware_groups *	integer
total_victims *	integer
victims_last_7d *	integer
victims_last_30d *	integer
last_updated	string or null
data_source	string or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/stats"

GET /darkweb/ransomware/victims

List ransomware victims · 1 credit per call

Get ransomware victims.

Query parameters

days: Filter to victims from last N days (default: 30, max: 90)
group: Filter by ransomware group name (optional)
country: Filter by country code (optional)
sector: Filter by victim sector/industry (optional). Use the values from

the /darkweb/ransomware/victims/facets endpoint. Turns this into a per-client sector view for platform reports.

limit: Maximum results (default: 100, max: 500)

Returns list of ransomware victims with group, date, and country info.

Parameters

Name	In	Type
days	query	integer
group	query	string
country	query	string
sector	query	string
limit	query	integer

Response 200 · RansomwareVictimsListResponse

Field	Type	Meaning
victims *	array of VictimListItem
count *	integer	Items returned in this response (not total)

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/ransomware/victims"

GET /darkweb/ransomware/groups

List ransomware groups · 1 credit per call

Get ransomware groups.

Query parameters

active_only: Only return currently active groups (default: false)

Returns list of ransomware groups with victim counts and activity status.

Parameters

Name	In	Type	Required	Meaning
active_only	query	boolean

Response 200 · RansomwareGroupsListResponse

Field	Type	Meaning
groups *	array of RansomwareGroupListItem
count *	integer

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/ransomware/groups"

GET /darkweb/ransomware/group/{group_name}

Ransomware group detail · 1 credit per call

Get detailed information about a specific ransomware group.

Path parameters

group_name: Name of the ransomware group

Returns group details, recent victims, and activity timeline.

Parameters

Name	In	Type	Required	Meaning
group_name	path	string	yes

Response 200 · GroupDetailResponse

Field	Type	Meaning
name *	string
description	string or null
active	boolean or null	Computed from recent victim activity, not upstream flag
has_captcha	boolean or null
first_seen	string or null
last_seen	string or null
victim_count	integer or null
recent_victim_count_30d	integer or null
tools	array or null
urls	array or null	Tor leak-site URLs
profile_links	array or null	Analyst write-ups / research blogs
recent_victims	array or null
screenshot_url	string or null
page_title	string or null
ai_description	string or null
ai_risk_tags	array or null
ai_language	string or null
captcha_or_login_gate	boolean or null
scraped_at	string or null
entities	object or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/ransomware/group/{group_name}"

GET /darkweb/ransomware/victim/{victim_id}

Victim detail · 10 credits per call

Full enriched victim payload: base record + LLM-extracted fields (headquarters, revenue, data_size, publication_status, negotiation state), mirrored entities, blurred+captioned leak images, and the full-page site screenshot captured via our own Tor pipeline.

Path parameters

victim_id: Victim ID (16-char hex, returned by /ransomware/victims)

Returns 404 if not found.

Parameters

Name	In	Type	Required	Meaning
victim_id	path	string	yes

Response 200 · VictimEnrichmentResponse

Field	Type	Meaning
id *	string
victim_name	string or null
group_name	string or null
discovered	string or null
country	string or null
sector	string or null
description	string or null
website	string or null
post_url	string or null
screenshot_url	string or null	ransomware.live screenshot (external)
scraped_at	string or null
extracted_at	string or null
scrape_ok	boolean or null
scrape_error	string or null
legal_name	string or null
legal_form	string or null
headquarters	object or null
revenue	object or null
employee_count	integer or null
founded_year	integer or null
victim_description	string or null	AI-generated victim description
domains	array or null
people	array or null
platforms	array or null
data_size	object or null
data_size_bytes	integer or null
file_count	integer or null
view_count	integer or null
data_categories	array or null
group_tags	array or null
publication_status	string or null	listed \| countdown \| partial_leak \| fully_leaked \| removed
victim_status_raw	string or null
countdown	object or null
countdown_ends_at	string or null
posted_at	string or null
publication_at	string or null
ransom_amount	object or null
sample_files	array or null
file_types	object or null
negotiation_contacts	object or null
negotiation_state	string or null
negotiation_chat_excerpts	array or null
page_language	string or null
victim_tld	string or null
is_sea_hit	boolean or null
image_count	integer or null
image_bytes	integer or null
images	array or null
site_screenshot_url	string or null
site_screenshot_at	string or null
site_screenshot_error	string or null
entities	object or null	Entities extracted from the leak post, keyed by entity_type (company, country, industry, ...) → [{value, confidence}]

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/ransomware/victim/{victim_id}"

GET /darkweb/keyword-hits

Keyword match across ransomware victims and groups · 3 credits per call

Match one or more keywords against ransomware victim names and group names. Case-insensitive substring match — ideal for supply-chain / brand monitoring.

Query parameters

keywords: Comma-separated list (required). Caller-provided; this

endpoint does NOT use the org's stored keywords list.

per_bucket_limit: Max hits per bucket (default 25, max 100).

Returns: { keywords, hits: {victims, groups}, total }

Parameters

Name	In	Type	Required	Meaning
keywords	query	string
per_bucket_limit	query	integer

Response 200 · KeywordHitsResponse

Field	Type	Meaning
keywords *	array of string	Echo of the keywords matched against
hits *	KeywordHitsBucket
total *	integer	Sum across all buckets

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/keyword-hits"

GET /darkweb/ransomware/victims/facets

Victim filter facets (countries, sectors, groups) · 1 credit per call

Distinct values for victim filter fields (countries, sectors, groups) with counts. For building filter dropdowns in customer integrations.

Query parameters

days: Lookback window (default 365, max 3650 = 10 years)

Returns: { countries, sectors, groups } — each is [{value, count}, ...]

Parameters

Name	In	Type	Required	Meaning
days	query	integer

Response 200 · VictimFacetsResponse

Field	Type	Meaning
countries	array of FacetValue
sectors	array of FacetValue
groups	array of FacetValue

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/ransomware/victims/facets"

GET /darkweb/trends

Dark-web trends: weekly victims, top industries, group heatmap · 3 credits per call

Time-series dark-web trends for dashboards: weekly victim counts, top industries, and a group×week activity heatmap.

Query parameters

weeks: Weekly-timeline window (default 52, max 156)
industry_days: Top-industries window in days (default 90, max 365)
heatmap_top_n: Number of groups in the heatmap (default 12, max 30)
heatmap_weeks: Heatmap weeks (default 12, max 52)
sector: Restrict the weekly timeline + group heatmap to one industry

(per-client sector view). top_industries is the sector breakdown itself and is always returned in full. Values from /darkweb/ransomware/victims/facets.

Returns: { victims_weekly, top_industries, group_heatmap }

Parameters

Name	In	Type
weeks	query	integer
industry_days	query	integer
heatmap_top_n	query	integer
heatmap_weeks	query	integer
sector	query	string
mssp_customer_id	query	integer or null

Response 200 · TrendsResponse

Field	Type	Meaning
victims_weekly *	array of WeeklyVictimPoint
top_industries *	array of TopIndustry
group_heatmap *	GroupHeatmap

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/trends"