5552dbfb23
775,621 usernames across 27 underground forums. index.html is a self-contained, offline browser (search, mindmap, weighted 3D forum graph, per-actor 3D web, Most Popular leaderboard). data/raw/ holds the raw per-forum username lists. Run it live via pages.sambent.dev. |
||
|---|---|---|
| data/raw | ||
| .gitignore | ||
| demo.webp | ||
| index.html | ||
| LICENSE | ||
| README.md | ||
Threat Actor Username Index
775,621 unique threat-actor usernames cross-referenced across 27 underground forums, packaged with a self-contained offline browser. Search a handle to see every forum it touched, then explore the result as a mindmap or an interactive 3D graph. It all runs from one HTML file with no server and nothing to install.
▶ Run it live in your browser, nothing to download
Quick start
Open index.html in any modern browser. Everything (data, search, d3, markmap, three.js) is inlined into the one file, so it runs by double-click or from a file:// path with no internet. You can also host it on GitHub Pages as-is.
What the browser does
- Search any username and instantly see every forum it appears on (substring + prefix, 775K names, debounced).
- Mindmap view: the actor's forums branched into live (green) vs seized / offline (red), with each forum's user count.
- 3D Web view: an interactive ego-network where the actor links to their forums and to other actors who share ≥2 forums. Click a linked actor to pivot through the alias graph.
- Most Popular: every actor ranked by cross-forum presence, with infinite scroll, in-page search, per-forum filtering, a minimum-spread filter (
1+ … 10+), and four sort orders. Switch to a 3D actor↔forum galaxy that respects your filters live. - Forums: all 27 forums as a weighted 3D force graph (node size = users, links = shared actors) or a grid. Drill into any forum to see its top cross-forum users.
- Copy report: one click dumps a clean JSON dossier for any actor.
Terminal aesthetic: black background with red/gold/green accents and no gradients, fully responsive. The 3D pages need WebGL (GPU) and fall back to a grid or list when it is unavailable.
Repository layout
index.html the viewer (open this)
README.md · LICENSE
data/raw/ per-forum username lists (the raw database)
forum_users_*.txt live forums
dead_forum_users_*.txt seized / offline forums
cardingmafia_usernames.txt / raidforums_usernames.txt
index.html already contains the full dataset inlined, so the viewer needs nothing from data/ to run. The data/raw/ lists are the raw database for anyone who wants the usernames directly.
Dataset
| Forum | Users | Status | Forum | Users | Status |
|---|---|---|---|---|---|
| Cracked | 226,669 | live | xReactor | 8,989 | live |
| DarkForums | 75,632 | live | CraxPro | 8,201 | live |
| Altenen | 74,502 | live | RAMP | 7,709 | seized |
| DarkNetArmy | 65,399 | live | BreachForums HN | 6,541 | seized |
| HackForums | 60,532 | live | XSS | 4,922 | live |
| BreachForums ST | 57,468 | seized | PwnForums | 3,222 | live |
| Nulled | 42,315 | seized | ReHub | 2,405 | live |
| Patched | 41,765 | live | BreachStars | 733 | seized |
| BreachForums BF | 40,160 | seized | Umbra | 257 | seized |
| BlackHatWorld | 31,431 | live | NoHide | 138 | seized |
| Dread | 19,727 | live | CardingMafia | 52 | seized |
| Breached | 15,804 | live | RaidForums | 70 | seized |
| OGUsers | 12,524 | live | LeakBase | 10,954 | seized |
| Ascarding | 11,324 | live |
Totals: 775,621 unique usernames · 829,297 username↔forum pairs · 41,516 users on 2+ forums · most cross-referenced handle IPoisonedYourAIbsLOLbyMajor (14 forums).
Use cases
- Map a threat actor's footprint across forums and find candidate aliases.
- Enrich existing intel with forum attribution, or feed a TIP.
- Cross-reference against breach data.
Credits & license
MIT licensed. See LICENSE.
- spmedia/Threat-Actor-Usernames-Scrape: Edmond Major III's original collection (25 forums; Who's-Online sections, posted threads, breach dumps).
- threatactorusernames.com: API frontend that provided CardingMafia, RaidForums, and BlackHatWorld 2014 Leak.
This fork adds the three API-sourced forums and builds the full cross-reference dataset. It also ships the interactive offline browser. Data was collected via Tor to respect rate limits.