Threat Actor Username Search

Search through a comprehensive database of 2M+ threat actor usernames to uncover their operations across cybercriminal communities, darknet markets, and hacking forums.

Overview

This Apify Actor provides real-time access to a massive threat intelligence database, perfect for OSINT investigations, Security Operations Center (SOC) analysts, incident responders, and security researchers. Input a suspected malicious username or adversary alias to instantly retrieve instances of that handle across notorious cybercrime ecosystems.

By integrating this Actor into your threat intelligence cycle, you can easily map out the digital footprint of malicious actors, ransomware group members, carders, initial access brokers, and other cybercriminals who reuse aliases.

Features

• Extensive Dark Web Coverage: Searches across top-tier cybercrime forums such as RaidForums, HackForums, CardingMafia, DarknetArmy, Ramp4U, and more.
• Fast Execution: Generates low-latency, structured JSON results suitable for programmatic ingestion into SIEMs, SOAR platforms, or custom dashboards.
• Actionable Results: Discover specific underground portals where a target username has registered or operated, aiding in adversary profiling, cyber espionage attribution, and fraud assessment.

Use Cases

1. Threat Intelligence Enrichment: Automate security alerts enrichment by querying indicators of compromise (IOCs) such as threat actor handles.
2. Red Team Reconnaissance: Scope out client exposure and perform passive reconnaissance of developer/employee accounts in underground forums.
3. Brand & VIP Protection: Check if administrative aliases or C-suite executive handles are being actively used by entities inside hacker platforms.
4. Anti-Fraud Triage: Identify registrations utilizing handles linked to known underground sellers, buyers, and carders.
5. Breach Investigation: Parse metadata and run discovered usernames through the database to map historic activities.

Input Configuration

The actor requires only one parameter:

• username (String, Required): The exact threat actor alias to search for (e.g., test, admin, hacker).

Output

The actor outputs the structured JSON response into the default Key-Value Store under the OUTPUT key, and pushes individual forum sightings into the default Dataset.

Example Dataset Item

{
  "username": "test",
  "forum": "Cardingmafia"
}

Pricing & Resource Allocation

This actor operates on a pay-per-event pricing model:

• Price per search: $0.05 per successful search.
• Charges are only applied when matching queries return valid threat actor results.
• Runs efficiently with minimum memory allocation (e.g., 256MB).

Support

For technical issues, feature requests, or custom integrations, please open an issue in the actor's support channel.