Leak-site ingestion
Victim posts collected from public ransomware leak sites via the RansomLook and Ransomfeed feeds.
Cybersecurity
Ransomware Leak-Site Monitoring Victim announcements, as the groups publish them
Victim posts from public ransomware leak sites, with group, date and linked indicators. No forum or credential monitoring.
No credit card required · Free API key
Capabilities
Key features at a glance.
Group profiles
Per-group pages with victim history and observed activity over time.
Correlated indicators
IPs and domains tied to a group, cross-referenced against the rest of the indicator set.
Breach-associated domains
Domains tied to known breaches, ingested as credential-leak indicators.
Applications
Use cases to evaluate first.
Victim awareness
See when an organisation in your supply chain is named on a leak site.
Group research
Follow a single ransomware group’s activity and the infrastructure attributed to it.
Third-party risk
Check whether a vendor appears on a leak site or among breach-associated domains.
FAQ
Frequently asked questions.
What exactly do you monitor?
Public ransomware leak sites, via the RansomLook and Ransomfeed feeds. Each victim post is stored with its group, its date and any indicators we can correlate.
Do you monitor underground forums, marketplaces, or Telegram?
No. We do not collect from forums, marketplaces, paste sites or Telegram, and we do not index credential dumps.
Can you tell me if my employees’ passwords have leaked?
No. We ingest the domains associated with known breaches as indicators, tagged as credential-leak. We do not hold, search, or alert on individual credentials.
How current is the data?
Every victim post keeps the date the group published it. New posts appear after each sync of the leak-site feeds.
Test it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key