Threat Actors

Everything on the Threat Actors page — campaign clustering, the scam-type leaderboard, and shared-infrastructure attribution. All free tier; standard range params apply.

Scam-type leaderboard

Ranked scam-type buckets with volume, grounded dollars, and conversion — the top panel and the source of truth for available taxonomy buckets.

Query: n (1–20, default 9); plus range params.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/scam-leaderboard?range=30d&n=9"

{ "range": {...}, "distinct_types": 8, "items": [
  { "bucket": "HEALTHCARE_BENEFITS", "label": "Healthcare / benefits",
    "color": "#3ee9c4", "calls": 410, "dollars_asked": 22100.0,
    "median_ask": 300.0, "pct_to_payment": 0.14, "campaigns": 12 }, ... ] }

Taxonomy coverage

Per-bucket volume mapped to published FTC / FBI IC3 categories — "what we see vs the official taxonomies".

{ "range": {...}, "total": 1780, "items": [
  { "our_bucket": "TAX_DEBT", "our_calls": 220, "pct_of_classified": 0.12,
    "ftc_category": "Imposter Scams → Government Imposters",
    "ic3_crime_type": "Government Impersonation", "contact_method": "Phone call" }, ... ] }

Campaign clusters

Campaign clusters — sets of calls sharing a campaign fingerprint. Filterable.

Query: n (result count), scam_type, org, agent, callback, min_size; plus range params.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/campaigns?range=30d&scam_type=HEALTHCARE_BENEFITS&min_size=5"

{ "range": {...}, "total": 12, "items": [
  { "cluster_id": "…", "size": 137, "top_org": "…", "top_agent": "…",
    "scam_type": "HEALTHCARE_BENEFITS", "first_seen": "...", "last_seen": "...",
    "sample_call_sids": ["CA…", "CA…"] }, ... ] }

Campaign drill-down

Full detail for one cluster: top orgs/agents, callbacks, funnel, ask histogram, timeline, and the member calls.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/campaigns/CLUSTER_ID?range=30d"

{ "cluster_id": "…", "size": 137, "scam_type": "HEALTHCARE_BENEFITS",
  "distinct_orgs": 4, "distinct_agents": 9, "distinct_callbacks": 3,
  "dollars_asked": 6100.0, "median_ask": 300.0,
  "top_orgs": [{ "label": "…", "count": 60 }],
  "callbacks": [{ "number": "877…", "calls": 40 }],
  "funnel": { "stages": [{ "stage": "OPENING", "count": 137, "pct": 1.0 }], "handoff": 12 },
  "calls": [{ "call_sid": "CA…", "monetary_ask_usd": 300.0, "auditor_confidence": 0.8 }] }

Campaign summary tiles

The stat-tile row above the campaign list.

{ "range": {...}, "campaigns": 42, "calls": 1310, "dollars_asked": 84250.0,
  "callback_numbers": 61, "orgs": 33, "agents": 128 }

Callback infrastructure graph

Callback numbers and how much shared infrastructure each fans out to.

Query: n (1–100); plus range params.

{ "range": {...}, "items": [
  { "number": "877-413-1587", "calls": 1137, "distinct_orgs": 33, "distinct_agents": 35 }, ... ] }

The bipartite reuse graph — hubs (callback numbers) and edges (to orgs).

Query: n (1–40); plus range params.

{ "range": {...},
  "hubs":  [ { "number": "877…", "calls": 1137, "distinct_orgs": 33, "scam_type": "HEALTHCARE_BENEFITS" } ],
  "edges": [ { "number": "877…", "org": "…", "weight": 60 } ] }

Script funnel

How calls progress through the scripted scam stages (OPENING → … → PAYMENT), plus handoffs to a "specialist".

{ "range": {...}, "handoff_to_specialist": 88, "stages": [
  { "stage": "OPENING", "count": 1310, "pct_of_opening": 1.0 },
  { "stage": "PAYMENT", "count": 180, "pct_of_opening": 0.14 } ] }

Operating hours heatmap

Day-of-week × hour activity heatmap (UTC). dow: 1=Sunday … 7=Saturday.

{ "range": {...}, "cells": [ { "dow": 2, "hour": 14, "count": 61 }, ... ] }