Go to Console
NewInvestigate threat actors quickly

Find threat actors and company exposure fast

Catch ransomware victim claims and actor mentions as they appear, then route the right cases to your API, webhooks, and analyst console.

Product

Company exposure monitoring for security teams

Coverage

9/9 customer paths live

Updated

3s ago

Customer routes

Customer delivery live

Live path

Monitoring, triage, and customer delivery are live.

Open console
Live alerts

Company exposure monitor

Watches companies and suppliers

Watch company names, domains, suppliers, brands, and portfolio companies across recent victim-claim activity.

Recent attacksOpen
Actor context

Ransomware actor overview

Shows actors and victims

Map attackers to victims, what they say they stole, infrastructure changes, sectors, timelines, and next steps.

Who is involvedOpen
Searchable records

Dark web exposure index

Searches dark web records

Search actor names, company names, URLs, notes, claims, and timing from leak and extortion sites.

Find a company or actorOpen

Live customer paths

What your security team can use today

Inspect console

Multi-organization monitoring

org

live

Monitor multiple customer organizations with shared watchlists and scoped access.

Open

Threat actor search

source, public-ti

live

Search recent actor claims, company mentions, sources, timing, and what changed.

Open

Shared alert workflow

dashboard

live

Move fresh exposure claims into analyst triage with cases, owners, and review actions.

Open

Delivery destinations

webhook

live

Send customer notifications through configured webhooks and API delivery routes.

Open

Enterprise support

helpdesk, integration

live

Keep support, audit visibility, and live service status available for customer operations.

Open

How monitoring works

Find the company mention before it becomes a forwarded screenshot.

Each alert is built for the first triage decision: who posted it, which company was named, what data was claimed, when it appeared, and what to review next.

Alert targetCompany, vendor, domain, and brand mentions
What gets sentActor, company, what was claimed, source, time, review status
Freshness basisNew and changed actor-page claims
Where it goesWebhook, API, and analyst console

Latest activity

Latest mention Jul 3, 2:20 PM UTC

20/20Updating
Refreshes every 5 minutes
ActorCompanyWhat was claimedSeenReview
Blackfieldredeplastrs.com.brnew victim claimReady
Apt73aydeniz.comnew victim claimReady
PearAC Beverage, Incnew victim claimReady
PearCNW Electronics Pte Ltdnew victim claimReady
Krybitmajuhome.com.mynew victim claimReady
Krybitduflosa.comnew victim claimReady
AnubisFerrum AGnew victim claimReady
Ransomware.live Victim Feedezortea.com.brnew victim claimReady
Incransomoakparkmi.govnew victim claimReady
AnubisFerrum AGnew victim claimReady
Ransomware.live Victim Feedezortea.com.brnew victim claimReady
Incransomoakparkmi.govnew victim claimReady
Incransomoakparkmi.govnew victim claimReady
AnubisFerrum AGnew victim claimReady
MedusalockerEstrelaOrganization with 11 emails extractedReady
MedusalockerKarneslegalOrganization with 23 emails extractedReady
MedusalockerSgs GmbhOrganization with 933 emails extractedReady
Ransomware.live Victim Feedtambasa.comnew victim claimReady
Ransomware.live Victim FeedFlowers Early Learning (formerly known as Tri-County Head Start)new victim claimReady
Ransomware.live Victim FeedAcworth-GA.govnew victim claimReady
Scroll for more

Solutions

Monitoring and secure response tools in one place.

Go to Console

Threat Monitoring

Ransomware and exposure notifications for watched companies and vendors.

Onion Sessions

Short-lived isolated onion workspaces with remote controls, notes, and source tracking.

Bloom Filter

Private breach and password-exposure checks without turning sensitive material into a dashboard.

Shared Reports

Package exposure findings into customer-ready review links and follow-up steps.