FAQ

This tool is intended to help researchers quickly identify where a username has appeared across various sources where cybercrime occurs

New username data is added daily/weekly

I'm just a nerd who works in threat intel and likes to scrape data

Yes. The search API can be queried directly using:

GET /api/search?q={username}

example:

https://threatactorusernames.com/api/search?q=apple

API rate limit: 4 requests per 1 minute. pls dont get wild.
msg me if you need no rate limit.

full API documentation is available here: API Documentation

Just write to hello [at] scrapedintel[.]com

The data is scraped from publicly accessible threat actor forums, cybercrime communities, and other open sources used for cyber threat intelligence research.

The tool is intended to help researchers quickly identify where a username has appeared across various cybercrime sources.

tl;dr - I be scraping stuffs

It means your username was observed on a platform commonly associated with cybercriminal activity, though this does not mean you are automatically a threat actor.

These forums and platforms attract a wide range of participants beyond malicious threat actors, including cybersecurity researchers, law enforcement, journalists, and automated scraper accounts. A match simply indicates presence, not intent.