mirror of
https://sambent.dev/sam/ThreatActorDB.git
synced 2026-08-07 08:03:00 +00:00
Sam Bent
5552dbfb23
775,621 usernames across 27 underground forums. index.html is a self-contained, offline browser (search, mindmap, weighted 3D forum graph, per-actor 3D web, Most Popular leaderboard). data/raw/ holds the raw per-forum username lists. Run it live via pages.sambent.dev.
82 lines
4.4 KiB
Markdown
82 lines
4.4 KiB
Markdown
# Threat Actor Username Index
|
|
|
|
**775,621 unique threat-actor usernames** cross-referenced across **27 underground forums**, packaged with a self-contained offline browser. Search a handle to see every forum it touched, then explore the result as a mindmap or an interactive 3D graph. It all runs from one HTML file with no server and nothing to install.
|
|
|
|
### ▶ [Run it live in your browser, nothing to download](https://pages.sambent.dev/sam/ThreatActorDB/src/branch/master/index.html)
|
|
|
|
|
|
|
|
 
|
|
|
|
---
|
|
|
|
## Quick start
|
|
|
|
Open **[`index.html`](index.html)** in any modern browser. Everything (data, search, d3, markmap, three.js) is inlined into the one file, so it runs by double-click or from a `file://` path with no internet. You can also host it on GitHub Pages as-is.
|
|
|
|
## What the browser does
|
|
|
|
- **Search** any username and instantly see every forum it appears on (substring + prefix, 775K names, debounced).
|
|
- **Mindmap** view: the actor's forums branched into **live** (green) vs **seized / offline** (red), with each forum's user count.
|
|
- **3D Web** view: an interactive ego-network where the actor links to their forums *and* to other actors who share **≥2 forums**. Click a linked actor to pivot through the alias graph.
|
|
- **Most Popular**: every actor ranked by cross-forum presence, with infinite scroll, in-page search, per-forum filtering, a minimum-spread filter (`1+ … 10+`), and four sort orders. Switch to a 3D actor↔forum galaxy that respects your filters live.
|
|
- **Forums**: all 27 forums as a **weighted 3D force graph** (node size = users, links = shared actors) or a grid. Drill into any forum to see its top cross-forum users.
|
|
- **Copy report**: one click dumps a clean JSON dossier for any actor.
|
|
|
|
Terminal aesthetic: black background with red/gold/green accents and no gradients, fully responsive. The 3D pages need WebGL (GPU) and fall back to a grid or list when it is unavailable.
|
|
|
|
---
|
|
|
|
## Repository layout
|
|
|
|
```
|
|
index.html the viewer (open this)
|
|
README.md · LICENSE
|
|
data/raw/ per-forum username lists (the raw database)
|
|
forum_users_*.txt live forums
|
|
dead_forum_users_*.txt seized / offline forums
|
|
cardingmafia_usernames.txt / raidforums_usernames.txt
|
|
```
|
|
|
|
`index.html` already contains the full dataset inlined, so the viewer needs nothing from `data/` to run. The `data/raw/` lists are the raw database for anyone who wants the usernames directly.
|
|
|
|
---
|
|
|
|
## Dataset
|
|
|
|
| Forum | Users | Status | Forum | Users | Status |
|
|
|---|---:|---|---|---:|---|
|
|
| Cracked | 226,669 | live | xReactor | 8,989 | live |
|
|
| DarkForums | 75,632 | live | CraxPro | 8,201 | live |
|
|
| Altenen | 74,502 | live | RAMP | 7,709 | seized |
|
|
| DarkNetArmy | 65,399 | live | BreachForums HN | 6,541 | seized |
|
|
| HackForums | 60,532 | live | XSS | 4,922 | live |
|
|
| BreachForums ST | 57,468 | seized | PwnForums | 3,222 | live |
|
|
| Nulled | 42,315 | seized | ReHub | 2,405 | live |
|
|
| Patched | 41,765 | live | BreachStars | 733 | seized |
|
|
| BreachForums BF | 40,160 | seized | Umbra | 257 | seized |
|
|
| BlackHatWorld | 31,431 | live | NoHide | 138 | seized |
|
|
| Dread | 19,727 | live | CardingMafia | 52 | seized |
|
|
| Breached | 15,804 | live | RaidForums | 70 | seized |
|
|
| OGUsers | 12,524 | live | LeakBase | 10,954 | seized |
|
|
| Ascarding | 11,324 | live | | | |
|
|
|
|
**Totals:** 775,621 unique usernames · 829,297 username↔forum pairs · 41,516 users on 2+ forums · most cross-referenced handle `IPoisonedYourAIbsLOLbyMajor` (14 forums).
|
|
|
|
## Use cases
|
|
|
|
- Map a threat actor's footprint across forums and find candidate aliases.
|
|
- Enrich existing intel with forum attribution, or feed a TIP.
|
|
- Cross-reference against breach data.
|
|
|
|
---
|
|
|
|
## Credits & license
|
|
|
|
MIT licensed. See [LICENSE](LICENSE).
|
|
|
|
- [spmedia/Threat-Actor-Usernames-Scrape](https://github.com/spmedia/Threat-Actor-Usernames-Scrape): Edmond Major III's original collection (25 forums; Who's-Online sections, posted threads, breach dumps).
|
|
- [threatactorusernames.com](https://threatactorusernames.com/): API frontend that provided CardingMafia, RaidForums, and BlackHatWorld 2014 Leak.
|
|
|
|
This fork adds the three API-sourced forums and builds the full cross-reference dataset. It also ships the interactive offline browser. Data was collected via Tor to respect rate limits.
|