Ransomware & Dark Web Data Breach Monitor

Pricing

Rating

Developer

Actor stats

Categories

Share

Monitor ransomware attacks and data breaches from the dark web in near real time, using the public ransomware.live dataset in a safe and structured way.

Features • Use Cases • Input • Output • Dataset Views • Cost of Usage • Data Source

This actor fetches and filters data from the Dark Web, giving you a structured view of ransomware group activity, victim organizations, and leak announcements published on dark web data leak sites.

It is built for threat intelligence, cybersecurity, brand protection, and research teams that want to quickly integrate this information into dashboards, analytics pipelines, or SIEM systems.

✨ Key Features

• 🔍 Bulk Keyword Search: search multiple terms at once (victim names, ransomware groups, descriptions) with case-insensitive matching.
• 🌍 Country Filtering: filter by country using 2-letter ISO codes (e.g., US, GB, DE, IT).
• 📅 Date Range Filters: limit results to attacks discovered within a specific time window.
• ⚡ Fast & Lightweight: get data in the fastest way.
• 📊 Structured Output: dataset output with a defined schema, ready for BI tools, dashboards, integrations, and automation.
• 🛡️ Safe Dark Web Intelligence: no direct access to .onion sites; no Tor system needed.

🎯 Use Cases

📥 Input Configuration

The actor accepts a JSON input with filters for keywords, country, date range, and maximum number of results.

Example Input

{
"keywords":"healthcare\nhospital\nmedical",
"country":"US",
"dateFrom":"2024-01-01",
"maxResults":500
}

Input Parameters

📤 Output

The actor produces:

• A dataset with one item per filtered attack/record.
• A metadata object saved in the default key‑value store under key OUTPUT (total results, total in database, applied filters).

Output Fields (Dataset)

Example Output Item

{
"post_title":"Example Healthcare Inc",
"group_name":"lockbit3",
"description":"Healthcare provider with 500+ employees",
"website":"https://examplehealthcare.com",
"country":"US",
"activity":"Healthcare",
"discovered":"2024-06-15T14:32:10.123456",
"published":"2024-06-14T00:00:00.000000",
"post_url":"http://lockbit...onion/post/...",
"modifications":[]
}

OUTPUT key (metadata)

In the default key‑value store, the OUTPUT key contains:

{
"totalResults":123,
"totalInDatabase":45678,
"filters":{
"keywords":["healthcare","hospital","medical"],
"country":"US",
"dateFrom":"2024-01-01",
"dateTo":null,
"maxResults":500
}
}

📊 Dataset Views

This actor defines preconfigured dataset views (see .actor/dataset_schema.json):

• Overview: compact view for quick analysis, with key fields:
  • post_title (Victim), group_name (Ransomware Group), country, activity, discovered, published, website, post_url.
• Raw Records: also shows description and modifications for deeper investigation of individual cases.

You can access the dataset from the actor’s Output tab in Apify Console or via API (see the automatically generated link).