ransomlookRecent
Fetch the most recent ransomware posts and victim claims from RansomLook
How to use it
ransomlookRecent is exposed by the Darknet MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the ransomlookRecent tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Darknet MCP Server
npx darknet-mcp-serverOther tools in Darknet MCP Server (39)
Get AbuseIPDB's blacklist of the most reported malicious IP addresses
Check an IP address for abuse reports — confidence score, ISP, country, report count
Get individual abuse reports for an IP with detailed comments and categories
Look up a malware sample in MalwareBazaar by MD5, SHA1, or SHA256 hash
Get the most recently submitted malware samples from MalwareBazaar
Search MalwareBazaar by tag or YARA signature name
List all data classes (types of compromised data) known to HIBP — free
Get details of a specific data breach by name — free
Get the most recently added data breach — free
List all known data breaches from HaveIBeenPwned, optionally filter by domain — free
Check if a password has appeared in known breaches (k-anonymity, only 5-char SHA-1 prefix sent) — free
Search for an email address in publicly posted pastes — requires HIBPAPIKEY
Search all breaches for a specific account (email/username) — requires HIBPAPIKEY
Look up threat intelligence for a CVE — related pulses and indicators
Look up threat intelligence for a domain — pulse info, whois, reputation
Look up threat intelligence for a file hash (MD5, SHA1, SHA256)
Look up threat intelligence for an IP address — pulse info, reputation, country, ASN
Search OTX threat pulses by keyword
List all 582+ ransomware groups tracked by RansomLook
Get ransomware victims filtered by ISO 3166-1 alpha-2 country code
Get ransomware victims filtered by sector/industry (healthcare, finance, etc.)
Get a detailed profile for a specific ransomware group by name
List all known ransomware groups tracked by ransomware.live
Get all victims claimed by a specific ransomware group
Fetch the most recent ransomware victims from ransomware.live
Search ransomware victims by keyword (company name, domain, etc.)
Get recent IOCs from ThreatFox reported in the last N days
Search ThreatFox IOCs by malware family using Malpedia naming
Search ThreatFox IOCs by IP, domain, hash, or URL
Search ThreatFox IOCs by tag (e.g., Cobalt Strike, Emotet)
Check if a specific IP address is a known Tor exit node
Get detailed Tor exit node information including fingerprints and publish timestamps
Get current Tor exit node IP addresses from the official Tor Project bulk exit list
Fetch raw HTML from a .onion URL via Tor SOCKS5 proxy (DNS leak prevention via socks5h)
Fetch and parse a .onion site — returns structured data: title, links, body text
Search for .onion sites using Ahmia.fi search engine
Check if the local Tor SOCKS5 proxy daemon is running and accessible
Look up a URL or host in URLhaus for malware distribution
Search URLhaus entries by tag