About Dragons Eye

Dragons Eye is a public cyber threat intelligence workspace for tracking ransomware operations. It aggregates unverified ransomware victim claims from documented, public machine-readable intelligence feeds and presents them for security researchers, SOC analysts, incident responders, and academic study.

Responsible use

This tool is for research and educational use only. It must not be used to interact with, support, or negotiate with threat groups. Direct links and raw references to threat-group infrastructure, leaked material, credentials, malware, archives, torrents, and screenshots are excluded. The tracker never connects to Tor and never interacts with threat groups.

Data integrity

Named organizations can challenge a claim from its detail page; accepted corrections are annotated in record history and withdrawals persist. The server maintains a last-good dataset when an upstream provider is temporarily unavailable, and missing metadata (such as country or sector) stays explicitly marked as unknown rather than silently inferred.

Independent providers are distinguished from mirrors and alternate transports: mirrors and republished observations never increase the independent-provider count, and no provider count verifies the underlying allegation. Collection is strictly read-only against documented public machine interfaces — HTML scraping, Tor collection, victim datasets, and executable content are excluded by policy.

Supplementary defensive context

Some group and claim pages add labeled defensive context — group profiles, observed tactics, exploited vulnerabilities, and exact-match regulatory disclosures — under strict allowlisted projections. Each section names its source where it appears. Supplementary context never creates a claim, changes its dates or source counts, or counts as corroboration.

The live application shows how many connected feeds are currently healthy. Per-feed status is operator diagnostics and is not published; credits required by our sources’ licences are listed under Attribution in the site footer. See the methodology for the full evidence model.

Explore the tracker

• Live ransomware tracker overview
• Ransomware group directory
• Victim-claim directory
• Ransomware activity by country and sector
• Weekly ransomware signals
• Monthly State of Ransomware reports
• Latest security-threat news stories
• Cybersecurity Hub: search fifteen layers of public threat intelligence
• Data quality and screening dashboard
• Free vendor check for ransomware claims
• Free email alerts for watched companies
• Methodology and evidence model
• Glossary of tracker terms

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.