Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Changelog

Show changes for
2026-09-10
Website

Search IOCs directly with +ioc:

  • Added a new +ioc: keyword to /search — searches only the IOC database and returns the group(s) an indicator belongs to. The value can be a literal indicator (hash, email, wallet, IP, domain, ...) or a group's slug. Requested by Ellis.
2026-09-06
Website

Trace where a ransom payment went

  • Added the option to trace a ransom payment's on-chain flow — follow the money hop by hop.
2026-09-06
Website

Cryptomoney section redesign on group pages

  • The Cryptomoney section on group pages now shows BTC wallets in a compact two-column layout with a one-click copy button, instead of a table with a date column.
  • Fixed a bug where the section's expand/collapse toggle could silently stop working.
2026-09-06
Website

Bitcoin wallets added to the IoCs page

  • /ioc now also lists ransom-note BTC wallets as "Bitcoin Wallet" indicators alongside the existing curated IOCs, with wallet-trace and OFAC-screening links.
2026-09-06
Website

MX record check for email IOCs

  • Email IOCs on /ioc now show whether their domain has a valid MX (mail) record — a green "MX found" or red "No MX" badge next to each address.
2026-09-05
API-Pro

Bug in API-PRO for IOCs

  • We have corrected a bug in the API-PRO which did not return the IOCs for some groups. It's now corrected.
2026-08-30
Website

VirusTotal lookup for domain IOCs

  • Domain IOCs on /ioc now link out to a VirusTotal lookup — detection stats, reputation, categories, registrar and creation date — the same way hash IOCs already link to VirusTotal.
  • The domain lookup also shows the domain's last known DNS records (A, MX, NS, TXT, etc.).
2026-08-23
Scraper/Parser

New parser for KillSec

  • The KillSec DSL has been redesigned. The parser has been rewritten.
2026-08-23
Scraper/Parser

Rewrite Scraper/Parser

2026-08-22
Website

Open a support ticket by email

  • You can now open a support ticket just by emailing us at supportransomware.live — no need to log in or visit the site first.
2026-08-22
Website API-Pro

Captcha & law-enforcement seizure detection for leak-site locations

  • Added captcha and seized fields to locations, tracking whether a monitored leak-site location is currently gated behind a captcha/bot-challenge or has been seized by law enforcement.
  • Group detail pages now show a status icon in the Known Locations table (puzzle piece for captcha, handcuffs for seizure), with both explained in the page legend.
2026-08-21
Website

New /support ticket portal

  • Launched /support, a customer-facing portal to manage support questions as tickets, with victim/case search and file attachments.
  • Passwordless magic-link login by email — no password to manage, just a one-time login link sent to the requester's inbox.
  • Migrated all historical tickets from Freshdesk, our previous support solution, into the new internal ticket system.

No changes match the selected filters.