Threat intelligence API / Ransomware leak site API
Ransomware leak site API
A dark web API built on ThreatCluster's own collection of ransomware and extortion leak sites: who was listed, by which group, when, in what sector and country. Not forums, not credential dumps, not markets. Leak sites, scraped first-hand and cross-referenced with the news corpus.
What it covers
2,896 victim listings in the last 90 days across 161 active groups, collected from the groups' own leak sites rather than bought from an aggregator. Each listing is a claim by the group; ThreatCluster records the posting and when it appeared, and does not assert that a breach happened.
The scope is deliberately narrow. ThreatCluster does not collect underground forums, stealer logs, credential dumps or marketplaces. If your question is "which ransomware groups are active, who did they list, and is my sector or supply chain on the list", this is the collection for it.
Endpoints
| Call | Returns | Cost |
|---|---|---|
| GET /darkweb/stats | Dark-web counts + last-sync timestamp | 1 |
| GET /darkweb/ransomware/victims | List ransomware victims | 1 |
| GET /darkweb/ransomware/groups | List ransomware groups | 1 |
| GET /darkweb/ransomware/group/{group_name} | Ransomware group detail | 1 |
| GET /darkweb/ransomware/victim/{victim_id} | Victim detail | 10 |
| GET /darkweb/keyword-hits | Keyword match across ransomware victims and groups | 3 |
| GET /darkweb/ransomware/victims/facets | Victim filter facets (countries, sectors, groups) | 1 |
| GET /darkweb/trends | Dark-web trends: weekly victims, top industries, group heatmap | 3 |
A free key reads listings from the last seven days; Researcher reads the full history and the enriched record.
One request
Healthcare listings from the last week:
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/darkweb/ransomware/victims?days=7§or=Healthcare"
The listing fields every key gets: group_name, name, discovered, sector, country, website, post_url, delisted, delisted_at. The enriched victim record (screenshots, the group's own description, negotiation state where a portal is visible) costs 10 credits and needs Researcher.
| Field | Type | Meaning |
|---|---|---|
| victims | array | |
| count | integer | Items returned in this response (not total) |
Without a key
The ransomware feed is RSS and needs no account. The Ransomware-Intel repository publishes the listing fields for the last 90 days as JSON and CSV, refreshed daily. The ransomware tracker shows the same data on the site. The API adds filters, paging, the enriched record and the cross-references into incidents and entities.
The rest of the API
Free threat intelligence API · IOC API · CVE API · Threat actor API · Full reference
Dark web API FAQ
Is this a dark web monitoring API?
For ransomware and extortion leak sites, yes: poll the victims endpoint on a schedule and filter by sector, country, group or a substring of an organisation name. It does not monitor forums, markets or credential dumps.
How fresh is it?
Leak sites are re-collected continuously and a new listing appears in the API as soon as the collector sees it; the response carries the time each listing was first observed.
Are the victims verified?
No. A listing is the group's claim. ThreatCluster records that the claim was posted and when. Use the incident endpoints to see whether the press has confirmed a breach.
Which groups are covered?
Every group with a reachable leak site, tracked in the groups endpoint with per-group daily counts. Groups whose sites are down are kept with their history and marked inactive.
What does the free key get?
The listing fields for the last seven days, 25 rows a page. Researcher reads the full history and the enriched record.
Get a key and make a request
Free account, read-only key, 100 credits a day. Upgrade when you need the history.