# Threat Actor Username Index

**775,621 unique threat-actor usernames** cross-referenced across **27 underground forums**, packaged with a self-contained offline browser. Search a handle to see every forum it touched, then explore the result as a mindmap or an interactive 3D graph. It all runs from one HTML file with no server and nothing to install.

### ▶ [Run it live in your browser, nothing to download](https://pages.sambent.dev/sam/ThreatActorDB/src/branch/master/index.html)

![demo](demo.webp)

![red/black terminal aesthetic · search → mindmap → 3D graph](https://img.shields.io/badge/offline-single--file-a21e2c) ![MIT](https://img.shields.io/badge/license-MIT-e5a54b)

---

## Quick start

Open **[`index.html`](index.html)** in any modern browser. Everything (data, search, d3, markmap, three.js) is inlined into the one file, so it runs by double-click or from a `file://` path with no internet. You can also host it on GitHub Pages as-is.

## What the browser does

- **Search** any username and instantly see every forum it appears on (substring + prefix, 775K names, debounced).
- **Mindmap** view: the actor's forums branched into **live** (green) vs **seized / offline** (red), with each forum's user count.
- **3D Web** view: an interactive ego-network where the actor links to their forums *and* to other actors who share **≥2 forums**. Click a linked actor to pivot through the alias graph.
- **Most Popular**: every actor ranked by cross-forum presence, with infinite scroll, in-page search, per-forum filtering, a minimum-spread filter (`1+ … 10+`), and four sort orders. Switch to a 3D actor↔forum galaxy that respects your filters live.
- **Forums**: all 27 forums as a **weighted 3D force graph** (node size = users, links = shared actors) or a grid. Drill into any forum to see its top cross-forum users.
- **Copy report**: one click dumps a clean JSON dossier for any actor.

Terminal aesthetic: black background with red/gold/green accents and no gradients, fully responsive. The 3D pages need WebGL (GPU) and fall back to a grid or list when it is unavailable.

---

## Repository layout

```
index.html                       the viewer (open this)
README.md  ·  LICENSE
data/raw/                        per-forum username lists (the raw database)
  forum_users_*.txt              live forums
  dead_forum_users_*.txt         seized / offline forums
  cardingmafia_usernames.txt / raidforums_usernames.txt
```

`index.html` already contains the full dataset inlined, so the viewer needs nothing from `data/` to run. The `data/raw/` lists are the raw database for anyone who wants the usernames directly.

---

## Dataset

| Forum | Users | Status | Forum | Users | Status |
|---|---:|---|---|---:|---|
| Cracked | 226,669 | live | xReactor | 8,989 | live |
| DarkForums | 75,632 | live | CraxPro | 8,201 | live |
| Altenen | 74,502 | live | RAMP | 7,709 | seized |
| DarkNetArmy | 65,399 | live | BreachForums HN | 6,541 | seized |
| HackForums | 60,532 | live | XSS | 4,922 | live |
| BreachForums ST | 57,468 | seized | PwnForums | 3,222 | live |
| Nulled | 42,315 | seized | ReHub | 2,405 | live |
| Patched | 41,765 | live | BreachStars | 733 | seized |
| BreachForums BF | 40,160 | seized | Umbra | 257 | seized |
| BlackHatWorld | 31,431 | live | NoHide | 138 | seized |
| Dread | 19,727 | live | CardingMafia | 52 | seized |
| Breached | 15,804 | live | RaidForums | 70 | seized |
| OGUsers | 12,524 | live | LeakBase | 10,954 | seized |
| Ascarding | 11,324 | live | | | |

**Totals:** 775,621 unique usernames · 829,297 username↔forum pairs · 41,516 users on 2+ forums · most cross-referenced handle `IPoisonedYourAIbsLOLbyMajor` (14 forums).

## Use cases

- Map a threat actor's footprint across forums and find candidate aliases.
- Enrich existing intel with forum attribution, or feed a TIP.
- Cross-reference against breach data.

---

## Credits & license

MIT licensed. See [LICENSE](LICENSE).

- [spmedia/Threat-Actor-Usernames-Scrape](https://github.com/spmedia/Threat-Actor-Usernames-Scrape): Edmond Major III's original collection (25 forums; Who's-Online sections, posted threads, breach dumps).
- [threatactorusernames.com](https://threatactorusernames.com/): API frontend that provided CardingMafia, RaidForums, and BlackHatWorld 2014 Leak.

This fork adds the three API-sourced forums and builds the full cross-reference dataset. It also ships the interactive offline browser. Data was collected via Tor to respect rate limits.