Breach.House — the engine that indexes the leaks
Breach.House is the crawling backbone behind Dark Eye. It autonomously discovers and captures ransomware leak sites, extortion blogs and breach dumps across Tor and the clear web — turning chaos into a structured, searchable intelligence feed.
Live at breach.house
Built for scale and resilience
Designed to keep watching even when leak infrastructure goes dark, moves or rotates mirrors.
Autonomous discovery
Finds new leak sites and mirrors as ransomware groups spin them up or migrate.
Tor & clear web
Crawls onion services and clearnet alike, normalising both into one feed.
Structured capture
Extracts victims, files, post dates and group metadata into structured records.
Evidence snapshots
Preserves captures so disclosures are documented even after a site is taken down.
Continuous monitoring
Re-visits known sources on a schedule to catch updates and new victims fast.
Feeds the suite
Powers HaveIBeenRansom search, Dark Monitor alerts and Connector investigations.
The crawl pipeline
Every leak goes through the same disciplined pipeline before it ever reaches an analyst.
- Discover. Identify new and rotating leak sites across Tor and the clear web.
- Capture. Snapshot pages and files, preserving forensic evidence.
- Normalise. Extract victims, groups, files and timestamps into structured data.
- Distribute. Index into search, push alerts and surface in investigations.
Tap into the crawl
Get the structured leak feed behind Dark Eye, or request a tailored crawling scope for your sector.