Never an onion address
isidaten never calls a leak site. Group and post addresses are kept as text and never rendered as links. Only the trackers are fetched over HTTPS, and only hosts from the module’s allowlist.
Security operations
Leak site monitoring
Who from your supply chain is currently listed on an extortion site
Extortion groups publish their victims on leak sites in the Tor network; trackers such as ransomware.live and ransomlook.io collect these reports. The module keeps a mirror with one row per group and victim and runs the watch list against it: own organisations, suppliers, processors, ICT providers and freely entered companies. A hit in the supply chain is a supply chain event under NIS2, DORA Art. 28 and ISO 27001 A.5.19 to A.5.22 and becomes a task; a confirmed hit on your own organisation becomes a ransomware incident with the reporting deadlines under Section 32 BSIG and Art. 33 GDPR. The risk level follows from what the inventory knows about the company.
NIS2DORAISO 27001DSGVO
Features
Your benefits
The hit knows the connections
A supplier on a leak site is only critical once the inventory says what depends on them: contracts, processing activities, processes, assets, risks, DORA register, BCM. That is exactly what the hit shows, and from it follows the level critical, medium or low.
Attribution as a licence condition
ransomlook.io delivers under CC BY 4.0; attribution in the cockpit, the situation picture and the group pages is therefore not courtesy but a condition. The trackers receive nothing from isidaten except the request itself.
Capabilities
All capabilities at a glance
- Sources ransomware.live (free or PRO key) and ransomlook.io, also as a self-hosted instance
- Hourly retrieval, manual retrieval as a queue job, three-month look-back on the first run
- Watch list from own organisations, suppliers, processors, ICT providers and free entries, derived and maintained
- Hits with group, date, country, sector and the extortionists’ description text as evidence
- Risk level from connections in the inventory: CRR, BCM, DORA, processing activities, contracts, processes, assets
- Reactions: incident with NIS2 deadlines for own organisation, task for supply chain, rule chain and notification
- Situation picture with domestic and worldwide reports, group pages, read-only AI tools
Result
You learn of your provider’s extortion before they inform you, and know in the same moment what depends on it on your side.
Background
Articles on Leak site monitoring
Experience Leak site monitoring live
Schedule a no-obligation demo – we will show you the module with your own use cases.