Skip to content
Leak site of d1r, captured by ThreatCluster

d1r

Active

3 tracked victims

About

Summarised by ThreatCluster from the group's own leak site

A ransomware group Tor leak site homepage titled '502 Bad Gateway' with standard banner text seen as an error page (502 Bad Gateway) from nginx/1.22.1. It advertises typical leak site features but no victim names or additional content are visible on the page text provided.

Sectors: Technology, Manufacturing · Countries: DE, GB, US

Recent victims

View all →
VictimSectorCountryPostedStatus
BoschManufacturingDEJul 13, 2026
ARMTechnologyGBJul 13, 2026
SynopsysTechnologyUSJul 13, 2026

All ransomware groups · Dark web intelligence