Public ransomware intelligence: live monitoring of leak-site victim claims, a directory of tracked ransomware groups, sector and geography statistics, and activity trends for defenders, researchers, and SOC analysts.
One PDF per US state every month: the 12-month claim trend, top industries and cities, and the latest claims with their evidence level.
A claim is a group-published allegation that an organization was attacked, posted on the group's leak site and observed by a monitoring provider. Dragons Eye reports what providers saw groups publish — not what Dragons Eye independently verified happened.
No. Every record is an unverified attacker assertion observed by a provider. Multiple providers observing the same claim raises confidence that the claim was posted; it does not verify that an attack occurred. A "possible authority notice" badge only means a primary official breach notice names an organization with the same name and a nearby date; that automatic match is not confirmed and does not verify the group's claim.
Groups are tracked as canonical identities after reconciling provider observations and approved aliases. The headline group count is the groups with at least one provider-observed claim; the group directory also lists tracked groups with no observed claim, and the home page states how many. Active groups are those with at least one provider-observed claim in the 90 days before the data's as-of time. Mirror or republished observations do not inflate independent-provider counts, and no provider count verifies the underlying allegation.
Dragons Eye is for research, defense, and educational use only. Do not use it to interact with, support, or negotiate with threat groups. The tracker never connects to Tor, never exposes leak-site infrastructure or leaked material, and must not be used to harass or extort named organizations.
For collection rules and terminology, read the methodology and glossary.
Agents can check whether a ransomware group has claimed a company or domain on its leak site. A single lookup or the newest claims costs 1 cent, a group profile costs 2 cents, and a batch of up to 25 vendor domains costs 5 cents, paid in USDC over x402. Every result is an unverified claim from a criminal leak site, not proof of a breach. Connect at https://api.ransomware-tracker.com/mcp, read https://api.ransomware-tracker.com/llms.txt, or find us in the official MCP Registry as com.ransomware-tracker.api/dragonseye.
Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.
Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.
Data as of (the observed time of the newest claim record in this page's prerender data snapshot; snapshot built ; dataset version sig-de55f3574e32a6707407da7c10b81409e74c62ff578c2965d2575ba6de1de7a4).