By using this API, you agree to the Terms of Service, the Privacy Policy, and the Acceptable Use Policy.
Endpoint
GET
Content-Type application/json / application/stix+json
Modes
Compromise Check
/api/check_compromise?domain=...- Check a domain across ransomware leaks, threat feed, stealer logs, and the HIBP breach catalogue/api/check_compromise?org=...- Check an organization name across ransomware leaks and threat feed
Actor Profile
/api/actor/profile?actor=NAME- Aggregated threat-actor profile: alert totals, first/last seen, category/country/industry breakdowns, 90-day timeline, recent alerts, and ransomware group + victim stats (actor or name/q, recent_limit, ransomware=0 to skip ransomware section)
Threat Feed - Retrieval
/api/get_latest- Get latest alert/api/get_recent- Get recent alerts/api/get_recent_alerts_by_actor- Get alerts by threat actor (supports hours, limit)/api/get_alert- Get single alert by ID, UUID, or hash/api/get_alerts_since- Get alerts since timestamp (since or timestamp)/api/get_messages- Get full raw feed Deprecated
New ransomware posts are no longer added to this endpoint, please use the dedicated ransomware endpoints instead./api/get_messages_plus- Get capped raw feed (excluding ransomware)
Ransomware - Retrieval
/api/get_ransomware- Get merged ransomware feed/api/get_ransomware_by_group- Get ransomware by group (supports group/name, q, year, days, from, to, full, limit)
IOC - Retrieval
/api/ioc/history- Get IOC history (supports days, hours, since/from/to, q, type, source, confidence_min, offset)/api/ioc/lookup?value=INDICATOR- Point lookup of a single indicator (hash, IP, domain, URL, or email) against the IOC index (defanged input like hxxp:// and [.] is accepted; value or indicator/q)/api/get_ransomware_iocs- List ransomware groups with IOC data/api/get_ransomware_iocs?group=NAME- Get IOCs for a specific ransomware group (group or name)
Threat Feed - Search
/api/search- Search feed (query or q, limit)
Ransomware - Stats & Lists
/api/get_ransomware_stats- Get ransomware stats (supports days, from/to, group/name, q, limit)/api/get_ransomware_groups- List ransomware groups (supports q, group/name, limit)
IOC - Exports
/api/ioc/export.json- Export IOC JSON/api/ioc/export.csv- Export IOC CSV/api/ioc/full- Export full IOC JSON
Threat Feed - Stats & Lists
/api/get_stats- Get feed stats/api/get_stats/threat_actors- Get threat actor counts/api/get_threat_actors/top- Get top threat actors/api/get_stats/categories- Get category counts/api/get_categories- List categories/api/get_stats/countries- Get country counts/api/get_countries- List victim countries/api/get_titles- List titles/api/get_industry- List industries/api/get_networks- List networks/api/get_threat_actors- List threat actors/api/get_victim_organization- List victim organizations
Ransomware - Exports
/api/export_ransomware.json- Export ransomware feed JSON/api/export_groups.json- Export ransomware groups JSON
News - Exports
/api/export_news_latest.jsonl- Export latest news documents (NDJSON)
Threat Feed - Exports
/api/export_feed.json- Export threat feed JSON/api/export_feed.csv- Export threat feed CSV
STIX 2.1 - Prebuilt Exports
/api/stix/status- Export metadata, object counts, sizes, hashes, and generation timestamp/api/stix/export.json- Full combined STIX 2.1 bundle (threat feed + ransomware + IOCs)/api/stix/export_feed.json- Full threat feed STIX 2.1 bundle/api/stix/export_ransomware.json- Full ransomware STIX 2.1 bundle/api/stix/export_iocs.json- Full IOC STIX 2.1 bundle
Account
/api/key/status- API key status, scopes, expiry, and live quota state (does not consume the daily quota; reachable even when the quota is exhausted)
STIX 2.1 - Small Preview
/api/stix.json?source=all- Small on-demand preview of all STIX sources/api/stix.json?source=feed- Small threat feed STIX preview/api/stix.json?source=ransomware- Small ransomware STIX preview/api/stix.json?source=iocs- Small IOC STIX preview
STIX 2.1 Exports
Use the prebuilt /api/stix/export*.json endpoints for production integrations. These files are generated server-side, written to R2, and streamed through the authenticated API.
Production exports
/api/stix/export.json- full combined STIX bundle: threat feed + ransomware + IOCs/api/stix/export_feed.json- full threat feed STIX bundle/api/stix/export_ransomware.json- full ransomware STIX bundle/api/stix/export_iocs.json- full IOC STIX bundle/api/stix/status- generation time, object counts, file sizes, SHA-256 hashes, and source record counts
Preview endpoint
/api/stix.json?source=all|feed|ransomware|iocs&limit=10 is a small on-demand preview endpoint. It returns the same STIX object graph as the production exports (the same object types, relationships, and x_dwi_* fields), so it is safe to build and test ingestion logic against. It differs only in volume: results are capped by limit (and may be truncated relative to the full dataset). Use the prebuilt /api/stix/export*.json endpoints for complete production ingestion.
Custom STIX properties
Bundles contain these STIX 2.1 object types: identity, threat-actor, intrusion-set, malware, campaign, indicator, report, note, and relationship (e.g. targets, indicates, related-to). Not every object type appears for every record; objects are emitted only when the source data supports them.
Dark Web Informer source fields are preserved using the x_dwi_* namespace. Which fields appear depends on the source and record type: forum and actor fields are present only on forum-sourced records, IOC fields only on IOC exports, and ransomware fields only on ransomware exports. Absent values are omitted rather than emitted as null or "Unknown", so a field being present means it holds real data.
Record fields (on report / threat-actor objects)
x_dwi_uuidx_dwi_titlex_dwi_categoryx_dwi_datex_dwi_contentx_dwi_networkx_dwi_sourcex_dwi_published_urlx_dwi_threat_actorsx_dwi_screenshots
Victim fields (on report objects, and the bare forms on victim identity objects)
x_dwi_victim_organizationx_dwi_victim_sitex_dwi_victim_countryx_dwi_victim_industryx_dwi_victim_websitex_dwi_websitex_dwi_domainx_dwi_organizationx_dwi_sitex_dwi_countryx_dwi_industry
Forum & actor fields (forum-sourced records only)
x_dwi_forumx_dwi_forum_codex_dwi_forum_domainx_dwi_boardx_dwi_data_typex_dwi_actorx_dwi_actor_rankx_dwi_actor_postsx_dwi_actor_joinedx_dwi_actor_pointsx_dwi_actor_reaction_score
Source-specific fields (IOC and ransomware exports only)
x_dwi_ioc_valuex_dwi_ioc_typex_dwi_post_urlx_dwi_malware
The raw upstream fields for each record are also preserved verbatim under x_dwi_source_fields.
Bundle-level metadata. The bundle root carries export metadata in the same x_dwi_* namespace. Use x_dwi_truncated together with the record counts to detect a capped preview and switch to the full /api/stix/export*.json endpoints for complete ingestion.
x_dwi_generated_atx_dwi_object_countx_dwi_sourcesx_dwi_source_record_countsx_dwi_source_record_totalsx_dwi_truncatedx_dwi_raw_includedx_dwi_diagnostics
Signed screenshot URLs are included on STIX reports in external_references with source_name values such as dwi-screenshot, dwi-screenshot-2, and dwi-screenshot-3. Screenshot URLs are signed and time-limited.
Because x_dwi_* fields are STIX custom properties, strict validators should allow custom properties. The production exports parse successfully with the Python stix2 parser using allow_custom=True.
Recommended validation command
The production STIX exports are generated with empty arrays removed and invalid external-reference URLs encoded or dropped before upload. For customer-side validation with the OASIS stix2_validator, use this command to keep schema validation on while suppressing known non-fatal warning noise for deterministic UUIDs, open-vocabulary formatting, source URL hashes, and custom x_dwi_* fields:
stix2_validator --version 2.1 --disable 103,111,215,302,401 --verbose file.jsonThis still performs JSON schema validation. If the command returns [+] STIX JSON: Valid, the bundle is ready for ingestion testing.
API Sandbox
Send authenticated requests, inspect rate-limit headers, and copy a curl command.
Large response possibleThis endpoint can return a large payload. The sandbox will preview the first 100 KB only; use Copy or a direct/download request for the full response.
Response
Headers
curl
Client code
Python
import time, secrets, string, requests, json
API_BASE = "https://api.darkwebinformer.com"
API_KEY = "YOUR_API_KEY"
ALPHABET = string.ascii_letters + string.digits + "-"
def make_nonce():
return f"{int(time.time())}:{''.join(secrets.choice(ALPHABET) for _ in range(12))}"
def get(endpoint, params=None, accept="application/json"):
url = f"{API_BASE}{endpoint}"
headers = {
"X-API-Key": API_KEY,
"X-Nonce": make_nonce(),
"Accept": accept,
}
r = requests.get(url, headers=headers, params=params, timeout=30)
r.raise_for_status()
if accept == "text/csv":
print(r.text)
else:
print(json.dumps(r.json(), indent=2))
if __name__ == "__main__":
get("/api/get_stats")JavaScript
const API_BASE = "https://api.darkwebinformer.com";
const API_KEY = "YOUR_API_KEY";
function makeNonce() {
const ts = Math.floor(Date.now() / 1000);
const hex = Array.from(crypto.getRandomValues(new Uint8Array(8)))
.map(b => b.toString(16).padStart(2, "0")).join("");
return `${ts}:${hex}`;
}
async function get(endpoint) {
const res = await fetch(`${API_BASE}${endpoint}`, {
headers: {
"X-API-Key": API_KEY,
"X-Nonce": makeNonce(),
"Accept": "application/json",
},
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
return res.json();
}
get("/api/get_stats").then(d => console.log(d));curl
NONCE="$(date +%s):$(openssl rand -hex 8)"
curl -s -D - \
'https://api.darkwebinformer.com/api/get_stats' \
-H 'Accept: application/json' \
-H "X-API-Key: YOUR_API_KEY" \
-H "X-Nonce: $NONCE"STIX download and validation examples
Large STIX exports should be downloaded directly with curl instead of copied from the sandbox preview. The sandbox displays only the first 100 KB for very large responses.
Status metadata
NONCE="$(date +%s):$(openssl rand -hex 8)"
curl -sS \
--url "https://api.darkwebinformer.com/api/stix/status" \
--header "Accept: application/json" \
--header "X-API-Key: YOUR_API_KEY" \
--header "X-Nonce: ${NONCE}"Combined bundle export
NONCE="$(date +%s):$(openssl rand -hex 8)"
curl -sS \
--url "https://api.darkwebinformer.com/api/stix/export.json" \
--header "Accept: application/stix+json" \
--header "X-API-Key: YOUR_API_KEY" \
--header "X-Nonce: ${NONCE}" \
--output "dwi-stix-bundle.json"Threat feed export
NONCE="$(date +%s):$(openssl rand -hex 8)"
curl -sS \
--url "https://api.darkwebinformer.com/api/stix/export_feed.json" \
--header "Accept: application/stix+json" \
--header "X-API-Key: YOUR_API_KEY" \
--header "X-Nonce: ${NONCE}" \
--output "dwi-stix-feed.json"Ransomware export
NONCE="$(date +%s):$(openssl rand -hex 8)"
curl -sS \
--url "https://api.darkwebinformer.com/api/stix/export_ransomware.json" \
--header "Accept: application/stix+json" \
--header "X-API-Key: YOUR_API_KEY" \
--header "X-Nonce: ${NONCE}" \
--output "dwi-stix-ransomware.json"IOC export
NONCE="$(date +%s):$(openssl rand -hex 8)"
curl -sS \
--url "https://api.darkwebinformer.com/api/stix/export_iocs.json" \
--header "Accept: application/stix+json" \
--header "X-API-Key: YOUR_API_KEY" \
--header "X-Nonce: ${NONCE}" \
--output "dwi-stix-iocs.json"Validate downloaded STIX
stix2_validator --version 2.1 --disable 103,111,215,302,401 --verbose dwi-stix-bundle.jsonErrors
| HTTP | Code | When |
|---|---|---|
| 400 | nonce_invalid / bad_request / ua_required | Missing or malformed nonce; invalid params; missing User-Agent |
| 401 | unauthorized | Missing/invalid API key, or inactive/expired |
| 403 | cors_origin / forbidden | Origin not allow-listed or scope denied |
| 404 | not_found | Unknown endpoint or missing prebuilt export object |
| 405 | method_not_allowed | HTTP method not supported for this path |
| 409 | nonce_expired / nonce_replay | Nonce outside window or already used |
| 415 | accept_not_supported | Unsupported Accept for the requested resource |
| 429 | rate_ip / rate_key / rate_daily / rate_export / rate_upstream / rate_mint | Per-minute, daily, export, upstream, or nonce-mint limit reached |
| 500 | internal | Unexpected server error (includes upstream failures in this build) |
Wait 60-70 seconds before retrying. Export and upstream-heavy endpoints use separate minute buckets, so a standard API request may work while an export or upstream-heavy request is still cooling down.