Dark Watch Monitor โ Live Dark Web Intel
A security camera pointed at the dark web. We watch scam forums, leak sites, and fraud marketplaces so you don't have to.
๐ก๏ธ Why This Matters to You
Stolen logins, credit cards, and personal info from UK victims are traded on the dark web every day
We flag threats targeting UK families, businesses, and schools โ not generic international data
New scam campaigns appear on the dark web weeks before they hit your inbox. We spot them first
No paywall, no subscription. The same intel that security firms charge thousands for โ free to the public
๐ก Monitor Status
๐ Dark Web Intelligence Summary
LLM-analysed summary of today's dark web monitoring activity. Generated: 2026-10-26
Our dark web monitoring pipeline is actively tracking 51 targets. 0 targets classified as high risk and 10 as critical. This includes ransomware leak sites, stolen credential markets, and active threat actor forums.
Classifications by LLM (qwen2.5:1.5b). Updated daily. View full LLM brief โ
๐ How It Works
All requests route through anonymised Tor exit nodes
BTC wallets, emails, domains, IPs, phones, onion URLs extracted from every page
Every capture stored with content hash, change detection, and raw HTML
Automatic alerts when monitored targets change or new entities appear
๐งช Methodology โ Total Transparency
No black boxes. Here is exactly what DarkWatch does, where the data comes from, how it is checked, and what every status actually means.
- Ransomware leak sites and victim listings (UK-focused)
- Phishing kits & scam infrastructure targeting UK banks
- Newly discovered .onion services via Ahmia search index
- Tor network health (relays, exit nodes, bandwidth, users)
- Stolen-data marketplaces and fraud forums where reachable
- UK organisations named on ransomware.live leak feeds
- Automated pipeline runs on a schedule (typically hourly)
- All .onion traffic routed through anonymised Tor proxy
- Public APIs & feeds: ransomware.live, Ahmia, Tor Metrics, Archive.today
- Entity extraction: BTC wallets, emails, domains, IPs, phones, onion URLs
- Every capture stored in SQLite with content hash + change detection
- Every source is health-checked each run (๐ข operational / ๐ก degraded / ๐ด down)
- Staleness detection: if a feed stops updating we say so โ we never fake fresh data
- Findings cross-checked against multiple feeds where possible
- UK victim claims are matched to the leak-site listing and the feed metadata
- Anything marked HIGH/CRITICAL is manually reviewed before it is surfaced
- LIVE / Active: fresh, machine-readable evidence found at the source during the current monitoring cycle
- Inactive / never: no new activity since we started watching โ the site may be offline or taken down (e.g. by NCA/FBI operations)
- Threat level: Critical โ High โ Medium โ Low, based on type, activity, and corroborated intel
- IOCs: indicators of compromise extracted from pages (domains, wallets, emails, hashes)
- A leak-site listing is a claim by the group โ we label it as reported, not as independently confirmed victim data
Every panel shows its own check time (๐). If a source is stale, a warning banner appears at the top of this page โ we display the last known good data rather than inventing numbers.
Full pipeline update: loadingโฆ
- ransomware.live โ leak-site victim feed
- Ahmia โ .onion search index
- Tor Metrics โ network health
- Archive.today โ snapshot capability
- Direct .onion captures via Tor proxy + Dread/forum intel where reachable
- Alert delivery via configured mail relay (msmtp)
๐ฌ๐ง UK Ransomware Victims โ ransomware.live
Live feed of UK organisations listed on ransomware leak sites. Data sourced from ransomware.live.
Top Ransomware Groups Hitting UK
Top Industries Affected
Recent UK Victims
| Victim | Group | Date | Industry |
|---|---|---|---|
| Bangor Wholesale Laminates | qilin | 2026-10-26 | Manufacturing |
| Power Funding | qilin | 2026-10-26 | Financial Services |
| Castle Howard Estate | qilin | 2026-10-24 | Hospitality |
| PWC | everest | 2026-10-22 | Professional Services |
| SGLA (Schwartz, Giannini, Lantsberger & Adamson) | spacebears | 2026-10-22 | Professional Services |
| novagroupgbc.com | BrainCipher | 2026-10-21 | Other |
| Allmand-Smith Limited | aurora | 2026-10-21 | Manufacturing |
| Aveva | Mimori | 2026-10-20 | Manufacturing |
| Johnson & Pace | qilin | 2026-10-19 | Not Found |
| camden-living | iah6477 | 2026-10-15 | Hospitality |
| Kemlows Diecasting Products Limited | qilin | 2026-10-15 | Manufacturing |
| Videk | akira | 2026-10-15 | Technology |
| JJS Justice | thegentlemen | 2026-10-14 | Government & Defense |
| Martin LLP | thegentlemen | 2026-10-13 | Professional Services |
| Saddlers Court MFG | play | 2026-10-13 | Manufacturing |
| Safe Data Storage | AuditTeam | 2026-10-13 | Technology |
| ADL Lift Services Limited | AuditTeam | 2026-10-13 | Manufacturing |
| AD***ed | AuditTeam | 2026-10-13 | Not Found |
| Sa***ge | AuditTeam | 2026-10-13 | Not Found |
| BMT IQ (marine surveying and inspection) | N0n | 2026-10-12 | Transportation |
| Cognosis Limited | nightspire | 2026-10-11 | Technology |
| lopay | Black X | 2026-10-09 | Financial Services |
| i2r Packaging Solutions Limited | Majinahanashi | 2026-10-08 | Manufacturing |
| Robert Hitchins Limited | Majinahanashi | 2026-10-08 | Agriculture and Food Production |
| Greenbrook Engineering | thegentlemen | 2026-10-06 | Manufacturing |
๐ฃ Phishing Kit Intelligence
Phishing kit mentions from live phishing URL feeds and dark web monitoring. UK bank names are specifically monitored.
๐ Data Sources
Dark Watch pulls intelligence from these live sources:
๐ฐ Cybersecurity Headlines
Curated from 2 sources via DarkWatch, OnionClaw, and IntelX enrichment.
60599 threats tracked. Sources: DarkWatch, OnionClaw, IntelX. View daily brief โ
๐ Recent Dark Web Intelligence
Real captures from our dark web monitoring pipeline โ data is being actively collected from Tor hidden services and threat actor infrastructure.
10 recent captures monitored. Pipeline updates every 60 minutes via Tor-routed fetches. View full table โ