The dark web,
monitored in public.
Darkfield is an open observatory of the cybercrime ecosystem. We track ransomware operators, leaked credentials, blacklisted wallets, and posts from the public Telegram channels and Tor sites we monitor — and expose every collected data point on a public, shareable URL.
What we monitor
six catalogs, all browsableRansomware operators
tracked groups, mirrors crawled daily
Public disclosures
victims indexed across leak sites
Industries
distinct sectors with observed activity
Countries hit
geographies with disclosed victims
Blocklists
wallets · phishing · breaches
Active exploitation
CVE signals + triangulated clusters
Where the victims are
0 new in the last 7 daysCountry fill is the all-time count of indexed ransomware victims (log scale). Highlighted borders + pulses mark countries with activity in the last 7 days.
Featured this week
Most active group
—
Loading…
Biggest recent leak
—
Loading…
CVE trending in chatter
—
Loading…
Live activity
refresh every 15sWaiting for the next event…