# Ransomware.live

> Ransomware.live is a free, independent threat intelligence platform that monitors ransomware groups' dark-web data leak sites (DLS) and aggregates publicly disclosed victim data, continuously and without a paywall or login.

Ransomware.live tracks ransomware threat groups and the victims they publicly claim, plus supporting intelligence: negotiation chat leaks, ransom notes, YARA rules, MITRE ATT&CK TTPs, IOCs, KQL hunting queries, and CSIRT contacts. It does not host, mirror, or distribute leaked data itself — only metadata about what each group has publicly claimed on its own leak site. See /disclaimer for the legal position and /about for project background, sources, and credits. The project is built and maintained independently by Julien Mousqueton, a security researcher; it has no corporate backing.

## API & machine-readable data

- [Public API docs](https://api.ransomware.live/apidocs): Free REST API, no authentication required, 120 requests/minute per IP
- [Pro API](https://api-pro.ransomware.live): Authenticated API with higher limits and extra fields (API key via `X-Api-Key` header) — contact api@ransomware.live for access
- [API plans comparison](https://www.ransomware.live/api): Free vs. Pro API feature and rate-limit comparison
- [API documentation](https://www.ransomware.live/apidocs): Reference docs for the public/Pro APIs, hosted on the main site
- [Auth guide](https://www.ransomware.live/auth.md): How to authenticate against the public and Pro APIs
- [API catalog](https://www.ransomware.live/.well-known/api-catalog): RFC 9727 linkset describing available API services
- [MCP server card](https://www.ransomware.live/.well-known/mcp/server-card.json): Model Context Protocol server descriptor
- [Agent skills index](https://www.ransomware.live/.well-known/agent-skills/index.json): Machine-readable skill definitions for victim lookup and group-info queries
- [JSON database](https://data.ransomware.live): Flat-file JSON export of the victims/groups dataset
- [Victims CSV export](https://www.ransomware.live/victims.csv): Flat CSV export of the victims dataset
- [RSS feed](https://www.ransomware.live/rss.xml): Real-time feed of newly disclosed victims
- [Cyberattacks feed](https://www.ransomware.live/cyberattacks.xml): Broader cyberattack news items (RSS)
- [Sitemap](https://www.ransomware.live/sitemap.xml): Full list of indexable pages

## Core sections

- [Recent victims](https://www.ransomware.live/): Live feed of the latest ransomware claims
- [Groups directory](https://www.ransomware.live/groups): All tracked ransomware threat groups
- [Group activity ranking](https://www.ransomware.live/groupssummary): Groups ranked by recent activity
- [Advanced search](https://www.ransomware.live/search): Full-text/filtered search over the victims dataset
- [World map](https://www.ransomware.live/map): Geographic visualization of claimed attacks
- [Country statistics](https://www.ransomware.live/countrymap): Victim counts and trends by country
- [Time Machine](https://www.ransomware.live/timemachine): Historical replay map of victim claims over time
- [Ransomware ecosystem map](https://www.ransomware.live/ecosystem): Visual map of ransomware groups and how they relate
- [Negotiations](https://www.ransomware.live/nego): Leaked ransom negotiation chat transcripts
- [Negotiation analytics](https://www.ransomware.live/nego/analytics): Aggregate stats on ransom demands and payments
- [Ransom notes](https://www.ransomware.live/ransomnotes): Collected ransom note text, indexed per group
- [YARA rules](https://www.ransomware.live/yara): AI-assisted YARA detection rules per group
- [IOCs](https://www.ransomware.live/iocs): Indicators of compromise per group
- [KQL hunting queries](https://www.ransomware.live/kql): Library of KQL threat-hunting queries
- [MITRE ATT&CK TTPs](https://www.ransomware.live/ttps): Technique mapping per threat group
- [CSIRT / CERT directory](https://www.ransomware.live/csirt): National CERT/CSIRT contact registry
- [Infostealer data](https://www.ransomware.live/infostealer): HudsonRock-enriched infostealer exposure data
- [Vulnerabilities](https://www.ransomware.live/vulnerability): CVEs linked to ransomware exploitation
- [Bitcoin ransom tracer](https://www.ransomware.live/btc): Traces ransom payments across Bitcoin wallets
- [Threat-actor interviews](https://www.ransomware.live/interviews): Collected interviews with ransomware threat actors

## About

- [About](https://www.ransomware.live/about): Project purpose, author, statistics, sources, and credits
- [Press coverage](https://www.ransomware.live/press): Recent cyberattack news items cross-referenced against tracked victims
- [Press & media](https://www.ransomware.live/press_media): Citation guidance and press contact
- [Disclaimer](https://www.ransomware.live/disclaimer): Legal position — no hosting or distribution of leaked data
- [Terms & conditions](https://www.ransomware.live/t&c): Usage terms
- [Changelog](https://www.ransomware.live/changelog): Public changelog of site, API, and scraper changes

## Optional

- [Quadrant charts](https://www.ransomware.live/quadrants): Group comparison quadrants
- [Leak-site status](https://www.ransomware.live/status): Per-group leak-site up/down history
- [Uptime chart](https://www.ransomware.live/uptime): Per-group leak-site uptime percentage over time
- [VirusTotal lookup](https://www.ransomware.live/vt): Look up a file hash against VirusTotal
- [Real-time alerts](https://www.ransomware.live/notification): Guide to setting up push notifications for new victims via ntfy