Everything the claim stream says about one group, stitched into a single profile — volume, publishing rhythm, first observations, and co-claim collisions.
Select any tracked group for a 365-day profile: status and observation range, claim totals, monthly volume chart, hour-by-week publishing heatmap, novel-versus-reclaimed target breakdown, co-claim partners, and contested organizations. Browse the group directory for per-group summary pages.
The dossier assembles one group's 365-day claim stream into a single profile: status and observation range, claim totals, monthly volume, an hour-by-week publishing heatmap, novel-versus-reclaimed target breakdown, co-claim partners, and contested organizations. Every panel is computed deterministically from the same canonical records.
The publishing heatmap reads observation timestamps (UTC), so it describes when claims were observed on leak sites — a rhythm of publication, not of intrusion activity. Novel versus reclaimed distinguishes organizations the group named for the first time from names already present in earlier claims by any tracked group.
Example reading: a heatmap concentrated in a few weekday hours describes the group's leak-site publishing routine as observed by providers. It supports statements about publishing habits, and nothing about working hours, location, or timezone of the operators.
Data refreshes continuously: the tracker ingests documented public provider feeds on a recurring cycle and reconciles new observations into canonical records. The feed-status indicator in the app header shows the time of the last successful sync. A quiet interval means no new provider observations — not an absence of attacks.
Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.