Actors and Leaksites API

The Actors and Leaksites endpoints expose intelligence records used across the tracker and intelligence views. Use them to enrich internal alerts with actor context, resolve leak-site naming, or check whether a leak site has recently been seen online.

Actor Endpoints

GET /api/v1/actors/list/
GET /api/v1/actors/search/{query}/
GET /api/v1/actors/view/{id}/

actors/view/{id}/ accepts the actor identifier used by the API. In practice, integrations may use an actor ID or matching actor name value supported by the live endpoint.

Leaksite Endpoints

GET /api/v1/leaksites/list/
GET /api/v1/leaksites/list/online/
GET /api/v1/leaksites/search/{query}/

Use leaksites/list/online/ when you only need leak sites observed online recently.

Actor Search Example

curl -X GET "https://ecrime.ch/api/v1/actors/search/lockbit/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Sample Actor Response

{
  "status": "200",
  "message": "OK",
  "date": 1781684693,
  "results": 1,
  "data": [
    {
      "id": 2,
      "name": "LockBit 5.0",
      "name_alt": "LockBit 2.0,LockBit 3.0,ABCD Ransomware,Bitwise Spider,Gold Mystic,White Janus,White Dev 66,Flighty Scorpius,LockBit 4.0,LockBit 5.0,LockBit 5,LockBit5",
      "date_updated": "2026-04-07 06:51:15"
    }
  ]
}

Leaksite Search Example

curl -X GET "https://ecrime.ch/api/v1/leaksites/search/akira/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Sample Leaksite Response

{
  "status": "200",
  "message": "OK",
  "date": 1781684697,
  "results": 2,
  "data": [
    {
      "id": 13450131,
      "leaksite_name": "Akira",
      "url": "https://3i7uisihrgv3v7kjafmhahhcmtjfepckhw5vournekuamhbt37liplid.onion/",
      "last_seen": "2026-05-05 09:31:11"
    },
    {
      "id": 5308894,
      "leaksite_name": "Akira",
      "url": "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/",
      "last_seen": "2026-06-17 08:18:42"
    }
  ]
}