# Threat Actor Username Search API (`dev00/threat-actor-username-search-api`) Actor Search 2M+ threat actor handles across dark web forums, cybercrime sites, and underground markets. Instantly map adversary footprints for OSINT & SOC threat intelligence. - **URL**: https://apify.com/dev00/threat-actor-username-search-api.md - **Developed by:** [dev00](https://apify.com/dev00) (community) - **Categories:** Other - **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing $10.00 / 1,000 threat actor username searches This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Threat Actor Username Search Search through a comprehensive database of 2M+ threat actor usernames to uncover their operations across cybercriminal communities, darknet markets, and hacking forums. ### Overview This Apify Actor provides real-time access to a massive threat intelligence database, perfect for OSINT investigations, Security Operations Center (SOC) analysts, incident responders, and security researchers. Input a suspected malicious username or adversary alias to instantly retrieve instances of that handle across notorious cybercrime ecosystems. By integrating this Actor into your threat intelligence cycle, you can easily map out the digital footprint of malicious actors, ransomware group members, carders, initial access brokers, and other cybercriminals who reuse aliases. ### Features - **Extensive Dark Web Coverage:** Searches across top-tier cybercrime forums such as RaidForums, HackForums, CardingMafia, DarknetArmy, Ramp4U, and more. - **Fast Execution:** Generates low-latency, structured JSON results suitable for programmatic ingestion into SIEMs, SOAR platforms, or custom dashboards. - **Actionable Results:** Discover specific underground portals where a target username has registered or operated, aiding in adversary profiling, cyber espionage attribution, and fraud assessment. ### Use Cases 1. **Threat Intelligence Enrichment:** Automate security alerts enrichment by querying indicators of compromise (IOCs) such as threat actor handles. 2. **Red Team Reconnaissance:** Scope out client exposure and perform passive reconnaissance of developer/employee accounts in underground forums. 3. **Brand & VIP Protection:** Check if administrative aliases or C-suite executive handles are being actively used by entities inside hacker platforms. 4. **Anti-Fraud Triage:** Identify registrations utilizing handles linked to known underground sellers, buyers, and carders. 5. **Breach Investigation:** Parse metadata and run discovered usernames through the database to map historic activities. ### Input Configuration The actor requires only one parameter: - `username` (String, Required): The exact threat actor alias to search for (e.g., `test`, `admin`, `hacker`). ### Output The actor outputs the structured JSON response into the default Key-Value Store under the `OUTPUT` key, and pushes individual forum sightings into the default Dataset. #### Example Dataset Item ```json { "username": "test", "forum": "Cardingmafia" } ```` ### Pricing & Resource Allocation This actor operates on a pay-per-event pricing model: - **Price per search:** $0.05 per successful search. - Charges are only applied when matching queries return valid threat actor results. - Runs efficiently with minimum memory allocation (e.g., 256MB). ### Support For technical issues, feature requests, or custom integrations, please open an issue in the actor's support channel. # Actor input Schema ## `username` (type: `string`): The threat actor username to search for (e.g., 'test', 'admin', 'hacker') ## Actor input object example ```json {} ``` # Actor output Schema ## `results` (type: `string`): No description ## `keyValueStoreResult` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("dev00/threat-actor-username-search-api").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("dev00/threat-actor-username-search-api").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call dev00/threat-actor-username-search-api --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=dev00/threat-actor-username-search-api", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Threat Actor Username Search API", "description": "Search 2M+ threat actor handles across dark web forums, cybercrime sites, and underground markets. Instantly map adversary footprints for OSINT & SOC threat intelligence.", "version": "1.0", "x-build-id": "27sfzs12azv3eIuM4" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/dev00~threat-actor-username-search-api/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-dev00-threat-actor-username-search-api", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/dev00~threat-actor-username-search-api/runs": { "post": { "operationId": "runs-sync-dev00-threat-actor-username-search-api", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/dev00~threat-actor-username-search-api/run-sync": { "post": { "operationId": "run-sync-dev00-threat-actor-username-search-api", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "username" ], "properties": { "username": { "title": "Username", "type": "string", "description": "The threat actor username to search for (e.g., 'test', 'admin', 'hacker')" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```