A dark web extortion portal is a leak site, usually hosted on anonymity networks such as Tor, where threat actors publish victim names, sample files, countdowns, or ransom demands. Its purpose is pressure: the public posting is meant to embarrass the target, prove access, and force payment or negotiation.
In real attacks, these portals are used after alleged data theft or encryption. The crew may claim to have stolen documents, user records, or source code and then use the site to amplify fear, even when the evidence is incomplete or exaggerated. For defenders, the portal is an early warning sign of a possible breach and a source of intelligence about attacker claims. Security teams use it to verify exposure, preserve evidence, notify affected users, and respond to impersonation or phishing risks tied to stolen data.