Skip to content

Use it

Threat intelligence API Free key, 70+ endpoints, OpenAPI. The product. Get started Pick your stack, make your first call. Live feed The console: incidents, filters, entities, search. Recipes Runnable examples for the free key. Free feeds RSS, ransomware feed, IOC blocklist, MISP — no key. CLI & agents tc from a terminal; agent keys with scoped budgets.

The data

Incident records 900 articles a day become ~70 scored incidents. Dark web First-party leak-site collection: victims, groups, markets. Validated IOCs Indicators with a false-positive gate; STIX, MISP, CSV. Vulnerabilities CVEs with EPSS, KEV and exploit status. Entity graph Actors, malware, CVEs, companies — pivotable.

For teams

For service providers Per-client feeds, alerts and branded digests. Use cases How teams and builders use the corpus. About ThreatCluster What it is and how it is built.

Reference

OpenAPI (Swagger) Every endpoint, parameter and response model. ReDoc The same reference, long-form. Examples on GitHub curl, Python and Node quickstarts; daily spec snapshot.

Guides

Quickstart & plans Key, scopes, budgets, tiers. Integrations Splunk, Sentinel, Elastic, agents and terminals, step by step Export formats STIX 2.1, MISP, CSV, text. CLI setup Install, log in, wire an agent.

No results found

Sign in Get a free key

No results found

Threat intelligence API Get started Live feed Recipes Free feeds CLI & agents

Incident records Dark web Validated IOCs Vulnerabilities Entity graph

For service providers Use cases About ThreatCluster

OpenAPI (Swagger)ReDoc Examples on GitHub Quickstart & plans Integrations Export formats CLI setup

Pricing Contact

Get a free key Sign in

Back to victims

A* T**

Ransomware leak-site victim intelligence

Posted

Oct 30, 2026

Industry

Not Found

What was taken

Status: upcoming | Deadline: 2026-11-05T00:00:00Z

Is A* T** in your supply chain?

Track A***** T****** and doommageddon in your own feed — you're alerted when either shows up in new reporting or on leak sites.

Free account · no card needed

Source

Group: doommageddon
Posted: Oct 30, 2026
Last scraped: Oct 30, 2026

Leak page (onion)

http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion/victim/a-t

Recent doommageddon victims

Referans Lab Ref-Lab

Oct 26, 2026 · TR
R*********b R**-L**

Oct 23, 2026
ENKA Schools

Oct 5, 2026 · TR
Cam Group LLC

Oct 5, 2026
Goodrich Logistics

Sep 28, 2026

See all victims claimed by doommageddon ·All ransomware groups · Dark web intelligence

71-75 Shelton Street, Covent Garden
London, WC2H 9JQ

[email protected]

Also from ThreatCluster ExploitMatch · Epsilon Research

Get started
Threat feed
Dark web monitoring
Custom feeds
ThreatCluster AI
Exploits
IOCs
Plans

Threat intelligence API
API reference
Free API key
Integrations
MCP server
Open datasets
Free feeds
IOC formats
Recipes
Docs

Vulnerabilities
Exploits hub
Early warning
APT groups
Ransomware groups
Malware
Campaigns
Companies
Story archive

Q2 2026 report
Weekly threat reports
Daily digest
Public IOC feed
RSS feeds
Blog
Epsilon Research
Glossary
LLM recency benchmark
Q3 2026 threat report

About
Our story
Use cases
Industries
For service providers
Partnerships
Contact
Terms
Privacy

© 2026 ThreatCluster Ltd (17124226). All rights reserved.