# Dragons Eye Ransomware Tracker > Public ransomware intelligence for defenders, researchers, and SOC analysts. Dragons Eye is an independent ransomware tracking service hosted at **ransomware-tracker.com**. It aggregates and deduplicates victim claims published by ransomware groups on their leak sites. Data is collected from multiple independent providers, normalised, and presented with responsible-use redactions applied. All claims are attacker-asserted and should be treated as unverified intelligence, not confirmed breaches. The authoritative service and canonical domain for Dragons Eye is **https://ransomware-tracker.com/**. The open-source project foundation is maintained at https://github.com/frknaykc/DragonsEye-RansomwareTracker. ## Key pages - [Intelligence Overview](https://ransomware-tracker.com/): Live victim claim statistics, top active groups, sector trends, and a rolling timeline of observed activity. - [Group Directory](https://ransomware-tracker.com/groups): Directory of all tracked ransomware groups with activity status, claim counts, and first/last observed dates. - [Victim Directory](https://ransomware-tracker.com/victims): Searchable database of provider-observed victim claims, filterable by group, sector, country, and date range. - [Sector and Country Activity Profiles](https://ransomware-tracker.com/activity): Directory of country and sector observed-activity profiles with 12-month claim windows and top-group breakdowns. - [Weekly Signals](https://ransomware-tracker.com/signals): Automated weekly detection and ranking of meaningful changes — activity spikes, pauses, sector shifts, and emerging groups. - [Methodology](https://ransomware-tracker.com/methodology): How data is collected, deduplicated, redacted, and presented — including data-quality limitations and responsible-use guidance. - [About](https://ransomware-tracker.com/about): Platform background, responsible-use policy, and attribution requirements. - [Vendor Check](https://ransomware-tracker.com/vendor-check): Check a vendor or supplier by exact company name or domain against provider-observed ransomware leak-site claims. - [Email Alerts](https://ransomware-tracker.com/alerts): Free email alerts. Watch up to 3 companies or domains and get an email when one appears in a new provider-observed claim. - [Monthly Reports](https://ransomware-tracker.com/reports): Monthly ransomware activity reports with totals, active groups, and busiest days. - [Latest Security Threats](https://ransomware-tracker.com/security-threats): Automatically updated cybersecurity news stories clustered from public reporting by ThreatCluster (CC BY 4.0); non-cyber news in the feed is left out. AI-written summaries, kept separate from the ransomware claim data. - [Cybersecurity Hub](https://ransomware-tracker.com/hub): Search fifteen layers of public cybersecurity records (ransomware, vulnerabilities, indicators, phishing, malware, supply chain, network context, AI security, news, research, breach reports, cloud and identity, OT / ICS, detection content, official disclosures) with exact indicator and CVE lookups, related records, one-page exports and full dataset downloads. Collection times are not incident times; counts are overlapping observations; shared identifiers do not establish attribution. Layer filters can overlap and each record keeps its own layer. Topical reports (breaches, cloud and identity, OT / ICS) do not independently confirm incidents; detection content is rule and signature metadata where available, not downloadable rule bodies; official disclosures come directly from reviewed first-party issuers, not keyword matches or public source lists. - [Compare Groups](https://ransomware-tracker.com/compare): Side-by-side comparison of ransomware groups. - [Crew Dossier](https://ransomware-tracker.com/dossier): Profiles of ransomware crews and their observed activity. - [Case File](https://ransomware-tracker.com/case-file): Organisation case files built from observed claims. - [Calendar](https://ransomware-tracker.com/calendar): Day-by-day calendar of observed claim activity. - [Data Quality](https://ransomware-tracker.com/data-quality): Quarantine, rejection, and contested-claim transparency figures. - [Intelligence Lab](https://ransomware-tracker.com/intelligence-lab): Experimental analysis views. - [Map](https://ransomware-tracker.com/map): Geographic map of observed claims. ## For AI agents Agents can check whether a ransomware group has claimed a company or domain through a pay-per-call API (USDC over x402 on Base, no account or API key). - Agent guide: https://api.ransomware-tracker.com/llms.txt - MCP server (streamable HTTP): https://api.ransomware-tracker.com/mcp - OpenAPI: https://api.ransomware-tracker.com/openapi.json Every result is an unverified claim from a criminal leak site, not proof of a breach. The Cybersecurity Hub has its own free, read-only API (no account, up to 60 requests per minute per connection): - Hub agent guide: https://ransomware-tracker.com/api/cyberhub/llms.txt - Hub MCP server (streamable HTTP, POST only): https://ransomware-tracker.com/api/cyberhub/mcp - Hub OpenAPI: https://ransomware-tracker.com/api/cyberhub/openapi.json ## Data sourcing Claims are ingested from multiple ransomware leak-site monitoring providers. Provider coverage, lag, and accuracy vary. Dragons Eye deduplicates across providers using identity reconciliation and retains provenance metadata. Victim organisation names, descriptions, and country tags are attacker-asserted and may be inaccurate, fabricated, or intended to cause reputational harm. ## Responsible use This data is intended for defensive security research, threat intelligence, and SOC operations. Republication of victim names or breach details should follow responsible-disclosure norms. Do not use this data to contact, identify, or further harm alleged victims. See the Methodology and About pages for full attribution and licensing terms.