search

captainGeech42 / ransomwatch

Ransomware leak site monitoring
MIT License
305 stars 64 forks source link

New site: Hive #58

Closed captainGeech42 closed 2 years ago

captainGeech42 commented 3 years ago

Site Info (no URL) Hive

Is the site currently online? Yes

captainGeech42 commented 2 years ago

So, this one is interesting. There are two onion URLs, one for the main website, and another for their backend API. We can go direct to the API and get victim data, but we can't get a victim URL for the main site (used in the notification) without that URL. The site uses Javascript to render everything, and implementing Selenium or something is more work than it's worth.

The ideal solution is specifying two onion URls in the config, one for the main site and another for the API, but the current logic for handling site URLs to scrapers doesn't really support that.

Right now, victims just show with "no victim link available", but as a low priority item it may be worth revisiting this.

captainGeech42 commented 2 years ago

If we do end up implementing it, the id in the <section> tags can be used as an anchor on the URL (e.g., asdf.onion/#id).