What this tracks

The criminal-internet side of the dark web — markets, hacking forums, initial-access broker boards, paste sites and defacement mirrors. The cousin tracker for ransomware leak sites lives at Ransomware groups.

How we find them

Curated CTI repositories, Tor search indices, link-harvested onions from existing sites, and Telegram channel monitoring. Every candidate is probed for liveness, LLM-classified, and only promoted to this list once it's confirmed alive and categorised.

What you see

Each row shows the category, network (Tor / clearnet), discovery source, a Playwright-via-Tor screenshot (faces auto-redacted) and a short AI summary of the page. Raw .onion URLs and indicators are gated to Business-tier accounts.

Category guide — what each label means

Market: — commerce-shaped venues: stolen data, malware, drugs, fraud-as-a-service.
Forum: — discussion boards; threat actor coordination, tooling chatter, recruitment.
Data leak: — sites publishing breached datasets outside the ransomware-leak ecosystem.
Ransomware leak: — named-victim leak sites; cross-referenced with our ransomware groups index.
Paste: — anonymous paste services where dumps and config files surface.
IAB: — initial-access broker boards selling network footholds.
Combolist: — credential/stealer-log dumps, often bundled.
Defacement: — attacker-claimed website defacement mirrors and archives.

Anything we can't confidently classify, or that contains illegal/abusive material out of scope for this tracker (e.g. CSAM), is kept out of the public listing.

Show mirror duplicates

Show

Loading…

–

Underground Tracker