Dark web and ransomware leak site monitoring
Our collection, not someone else's. Most dark web tools resell the same handful of upstream feeds. ThreatCluster scrapes ransomware and extortion leak sites itself, enriches every victim posting, and cross-references it into the same threat graph as the news. One thing, done properly.
Two independent collection paths
Our scraper hits the ransomware and extortion leak sites directly every few hours, covering hundreds of groups and their mirrors. An independent aggregator feed is synced hourly alongside it as a cross-check.
Running them independently means a Tor outage or a mirror going dark on one path does not blind the tracking on the other. Scope is deliberate: we track leak sites and nothing else. No credential dumps, no underground forums, no marketplaces.
We find our own sites
Leak-site groups move, rebrand and stand up new mirrors constantly. Four sources find them in parallel: curated CTI repositories, Tor search engines, GitHub-published onion lists, and Telegram channels.
New candidates go through liveness probing, a link harvest, and automated classification before they join the tracked set. Most competitors buy a list. We build ours.
- Curated CTI repositories
- Tor search engines
- GitHub-published onion lists
- Telegram channels
Every page, enriched twice
We pull out the unambiguous indicators first. Crypto wallets, emails, Tox IDs, XMPP and Telegram handles, PGP blocks, CVE references. Anything with a predictable shape gets captured with a script, not a model.
AI then handles the contextual layer. Victim names, tools, attribution, language, and a one-paragraph summary. Everything cross-references into the main entity graph, so a victim domain or a tool name surfaces on its own entity page alongside the news.
Surfaced the way an analyst reads it
Group profile pages with active campaigns and historical victims. Per-victim detail pages with the enriched data attached: screenshot, data size, negotiation state and the entities we pulled out. A victim index filterable by country, sector, group and freshness, and weekly trends of victim counts and group heat.
Alerts when a client's domain hits a leak site
Register the company names and domains you care about, your own and your suppliers'. When one is named in a victim posting it surfaces in your company monitoring view, and alert rules deliver the hit through the same webhook and email channels the rest of the platform uses.
For MSSPs, alerts route per customer. Each client's mentions stay in their own channel, so the right team gets notified without one client ever seeing another client's hits.
Over the API
Everything on this page is a call. Leak-site victims and group profiles come back as JSON; the enrichment record carries the screenshot and the extracted negotiation state.
- GET /darkweb/ransomware/victims victims by group, country, sector and window
- GET /darkweb/ransomware/victim/{id} the enriched record: screenshot, data size, negotiation state, mirrored entities
- GET /darkweb/ransomware/groups active and dormant groups with infrastructure
- GET /darkweb/keyword-hits your names and domains across victim postings and groups
- GET /darkweb/trends weekly victim counts and group heat
# free key: 100 requests/day, last 7 days, scope darkweb:read
curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/darkweb/ransomware/victims?days=7§or=Healthcare" Quickstart and plans · OpenAPI reference · Or read it in the live feed
More of the platform
- The Exploits DatabaseCVEs ranked by what defenders care about
- IOCs and ExportsSTIX, MISP, SIEM ingestion
- CLI and HeadlessREST API, tc command, agent tool
- For MSSPsPer-customer scoping across the platform
Dark web monitoring FAQ
What does dark web monitoring cover?
Ransomware and extortion leak sites. Victim postings and group activity are collected, enriched and clustered alongside the rest of the threat picture. We do not monitor credential dumps, underground forums or marketplaces.
Do you buy a feed of leak-site data or collect it yourselves?
We scrape the leak sites ourselves every few hours, with an independent aggregator feed synced hourly as a cross-check, so one Tor outage does not blind the tracking.
Will I be told if one of my domains appears?
Yes. Register your company name and domains and any victim posting that names them surfaces in your monitoring view, with alert rules that deliver by webhook and email.
Is the collection legal and ethical?
We collect only what is publicly posted on these sites for situational awareness, and personally identifying material in screenshots is redacted before anything is published. Nothing is purchased from or transacted with the actors.
How current is it?
Direct scrapes run every few hours and the aggregator sync hourly. New victim postings are picked up and clustered as they appear, often before the victim discloses publicly.
Watch the leak sites, not the news cycle.
Live coverage of the ransomware leak sites that matter, with alerts when your clients show up. No reseller, no curation lag.