# deepdarkCTI: a link index for deep and dark web threat sources > A repository of markdown files listing Telegram channels, ransomware leak sites, exploit databases and markets, organized by collection type rather than by tool. **fastfire/deepdarkCTI** — Collection of Cyber Threat Intelligence sources from the deep and dark web - Repository: https://github.com/fastfire/deepdarkCTI - Stars: 7,372 · Forks: 1,227 - Language: Unknown - License: GPL-3.0 - Published: 2026-10-06 · Updated: 2026-10-06 · Language: en - Canonical page: https://hysenlabs.com/projects/fastfire-deepdarkcti ## Twenty markdown files, no code The repository has no build, no package manifest and no release history. It is a `main` branch with a LICENSE, a README, and twenty markdown files, one per collection type: `commercial_services.md`, `counterfeit_goods.md`, `cve_most_exploited.md`, `defacement.md`, `discord.md`, `exploits.md`, `forum.md`, `maas.md`, `malware_samples.md`, `markets.md`, `methods.md`, `others.md`, `phishing.md`, `ransomware_gang.md`, `rat.md`, `search_engines.md`, `telegram_infostealer.md`, `telegram_threat_actors.md`, `twitter.md` and `twitter_threat_actors.md`. That shape tells you most of what you need to know. There is nothing to install and nothing to run. The value of the repository is the accumulated list inside those files, and the value of the repository as a project is whether somebody is still checking that those links resolve. The last push was on 2026-09-21, and the licence is GPL-3.0. The open issue count on the repository is mostly link rot reports, which is what you would expect from a list kept by people who visit the pages. The description in the repository metadata is one line: a collection of Cyber Threat Intelligence sources from the deep and dark web. The README expands the aim slightly, describing the goal as collecting sources present in the deep and dark web which can be useful in CTI contexts, and it points to a project site at deepdarkcti.com as the official website. ## What CTI means here, and the three types it separates The README spends more space defining the discipline than describing the files, and that is deliberate. Its definition is the standard one: the collection and analysis of information about threats and adversaries, drawing patterns that support decisions for preparedness, prevention and response against cyber attacks. The value it claims is that CTI is often presented as Indicators of Compromise or threat feeds, providing evidence-based knowledge about an organisation's own threat landscape. The analytical frame offered is the intent, capability and opportunity triad. Against those three, the README says experts can make forward-learning strategic, operational and tactical decisions about existing or emerging threats. The three intelligence types then get one line each. Strategic covers high-level information about security posture, threats and their business impact. Tactical covers the threat actor's tactics, techniques and procedures. Operational covers specific threats against the organisation. Every file in the repository maps onto one of those levels more than another, and knowing which level you are working at is how you decide whether a list of Telegram channels is research material or an incident. One term in that framing is worth flagging. The README says CTI is often presented in the form of IoCs or threat feeds. deepdarkCTI is the other thing: a curated pointer set to where that material lives, which is upstream of a feed and downstream of nothing. If you need machine-readable indicators, this repository is not them. ## Where the sources actually come from The README enumerates the monitored source types, and the file names line up with them almost exactly: Telegram channels, groups and chats; Discord channels; ransomware gang sites; forums related to cybercriminal activity and data leaks; markets; exploit databases; Twitter accounts; and RaaS, or ransomware as a service, sites. The naming convention tells you how the files are organised. `telegram_threat_actors.md` and `telegram_infostealer.md` split the Telegram material by what the actors do, while `twitter.md` and `twitter_threat_actors.md` do the same split for Twitter. `ransomware_gang.md` covers leak sites, `maas.md` covers ransomware as a service offerings, and `exploits.md` covers exploit databases. `malware_samples.md` and `rat.md` are separate, which suggests remote access trojan material is treated as its own category rather than as a subset of malware samples. The README also mentions a `methods` file describing various techniques for searching and analysing sources. That is the file to read first if you are new to this kind of research, because the other twenty are only lists and this is the only one that explains a process. `search_engines.md` sits next to it as the practical entry point. The README's list of typical intelligence sources is broader than what this repository covers: OSINT, human intelligence, counter intelligence and internal intelligence. The project positions itself as the OSINT slice of that list, restricted to the deep and dark web. ## Telegram group access is the real contribution path Contributions are not primarily pull requests, or at least they are not the path the README describes first. It says contributors and people active in the field have a Telegram group where new sources can be proposed and where research and analysis tactics used daily can be discussed. Access is requested by contacting the maintainer on Twitter, Telegram or Bluesky, and the three handles given are twitter.com/fastfire, t.me/fastfire83 and a Bluesky profile at fastfire.bsky.social. That is an unusual governance model for a public repository, and it has an obvious explanation. A link to a ransomware leak site is worthless if it is dead, and a channel list is only current if somebody is reading the channels. Curating that requires people who already work in the field, on a chat platform, not a quarterly commit from a stranger. Donations are also documented, with a Buy Me a Coffee link, and the README explains why they exist: the request came from followers of the project. It states that donations and their use will be managed in total transparency and used exclusively to build resources related to deepdarkCTI. Transparency of that kind is a promise rather than an audit, but the alternative of a paywalled feed is a worse trade for the people who need the index. The practical consequence for a reader is that freshness is uneven. Files tied to fast moving infrastructure, Telegram channels in particular, will rot faster than the README suggests, while the ransomware leak site lists tend to persist longer because operators keep them up for extortion value. ## What this repository cannot tell you The honest list of gaps is short and specific. There is no scanner, no crawler and no ingestion code, so nothing tells you when a domain in `phishing.md` appears in your own logs. There is no indicator format, so no IoC export. There is no rating, no tagging by actor or campaign, and no timestamps on entries, so you cannot ask what is new since last week. The README does not claim any of these, and the absence is consistent: this is a directory, not a product. It is also worth naming the risk profile of the sources themselves. A reader who opens a marketplace or forum link is doing exactly what those sites are built to observe. Nothing in the README addresses how to browse them safely, and the categories that matter most to defenders, `markets.md`, `counterfeit_goods.md` and `telegram_infostealer.md`, are the ones where that exposure is highest. Compared with commercial threat feeds, the trade is the reverse of the usual one. You get breadth and zero cost, and you give up freshness guarantees, machine readability and any accountability for what a link points at. Compared with a search engine of your own, you get curation: somebody else decided which channels were worth listing. Whether that curation is still valid depends on when it was last checked, and the repository does not tell you that per file. ## Reading the README against its own limitations Two details in the README are worth reading twice because they shape how the project presents itself. The first is that the README calls the aim collecting sources useful in CTI contexts, present tense, with no claim about timeliness, verification or provenance. Nothing in it promises the links are live. The second is the naming, deep and dark web, which is used loosely. The README does not define either term, and the file list spans both sides of the line: `exploits.md` and `cve_most_exploited.md` are public information by any reasonable reading, while `markets.md` is not. If you are writing policy about how your team uses this repository, that ambiguity is the thing to settle first. The repository also embeds a Star History chart in its README and describes itself as a collection rather than a tool. Taken together with the topic tags, cti, cyberhunter, darkweb, deepweb and threat-intelligence, the picture is consistent: a curated, human-maintained index for people who already know the field and need a starting map rather than an answer. Where it earns its keep is that narrow. Sitting down to assemble a list of ransomware leak sites, infostealer channels and RaaS operations from scratch takes a day of careful searching and produces a worse list than the one already in `ransomware_gang.md`, `telegram_infostealer.md` and `maas.md`. Open `methods.md` first, pick the two or three files that match the intelligence question you are actually asking, and treat everything in them as a lead to verify rather than a finding to report. ## Conclusion deepdarkCTI is best understood as a bookmark list with a maintenance process behind it, not as a feed you can pipe into a blocking tool. It gives you somewhere to start when you need to know which ransomware leak sites or infostealer Telegram channels exist, and it gives you the vocabulary to talk about them: strategic, tactical and operational intelligence, and the intent, capability and opportunity triad. It will not tell you when a credential of yours appeared on a market, and a list of links ages faster than most documentation. Start with `methods.md` and `search_engines.md`, add the feeds you can actually monitor from `telegram_threat_actors.md` and `ransomware_gang.md`, and remember the Telegram group is where new sources are proposed. ## FAQ ### What does deepdarkCTI collect? It collects Cyber Threat Intelligence sources from the deep and dark web, grouped into twenty markdown files covering Telegram channels and groups, Discord channels, ransomware gang sites, forums about data leaks, markets, exploit databases, Twitter accounts and RaaS sites. ### How do I contribute a new source to deepdarkCTI? The README describes a Telegram group for contributors and people working in CTI, where new sources are proposed and research techniques are discussed. Access is requested by contacting the maintainer through twitter.com/fastfire, t.me/fastfire83 or the fastfire.bsky.social Bluesky profile. ### Is deepdarkCTI a tool or a list of links? It is a list. The repository has no build, no scanner and no feed format, only markdown files of links plus a `methods.md` describing search and analysis techniques. If you need machine readable indicators, this is upstream of the tool that produces them. ### Which file should I read first in deepdarkCTI? The README points to the methods file for techniques used to search and analyse these sources, so `methods.md` is the place to start. `search_engines.md` is the practical companion, and the topic specific files such as `ransomware_gang.md` or `telegram_infostealer.md` come after that. ## Sources - [fastfire/deepdarkCTI on GitHub](https://github.com/fastfire/deepdarkCTI) - [Issues](https://github.com/fastfire/deepdarkCTI/issues) - [License: GPL-3.0](https://github.com/fastfire/deepdarkCTI/blob/main/LICENSE) - [README](https://github.com/fastfire/deepdarkCTI/blob/main/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/fastfire-deepdarkcti