The recent explosion of breaches by the CL0P Ransomware gang has renewed an interest in the darkweb showcase sites used by these threat actors to prove that they successfully broken into a company and to encourage victims to pay, Many have asked me to share some of these site and I was always hesitant. I recently learned that some “consultants” are charging customers to provide these publicly available links, which is wrong.

Most of these are on the TOR darkweb so you will have to use a TOR browser or VPN that bridges to TOR.

Mobikwik Indian data leak

mobikwikoonux37wauz6oqymshuvebj5u763rutlogc2fb2o3ugcazid.onion

Cl0p ransomware gang

http://ekbgzchl6x2ias37.onion/

DopplePaymer

http://hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion/

AKO group

http://37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion/

Ragnar Locker

p6o7m73ujalhgkiv.onion

Nefilim Group

hxt254aygrsziejn.onion

Avaddon Ransomware

http://avaddongun7rngel.onion/

Darkside Group

darksidedxcftmqa.onion or darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion

Suncrypt

nbzzb6sa6xuura2z.onion

REvil Ransomware

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

Mount Locker

http://mountnewsokhwilx.onion/

Pay2Key Leaks

pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion

Lockbit Ransomware

http://lockbitkodidilol.onion/

Ragnarok Leaks

wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion