Ransomware.live

https://www.ransomware.live/

Public extortion-leak observatory, scrapes ransomware groups' shaming sites and exposes new claims (added 2026-05-08). 2026-05-08 audit: WebFetch returned 5 fresh victim entries (5h-old). For automated monitoring, use the JSON API at https://api.ransomware.live/v2/groups (one entry per group with recent victims). Discovery, always corroborate against victim statement / regulator filing before citing as confirmed breach. Candidate; promote to active after 3 runs. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api: python3 tools/fetch_source.py url https://api.ransomware.live/v2/recentvictims (new victim claims, one record each with victim/group/activity/country/claim_url); /v2/groups for per-group view. AVOID: Do NOT rely on the homepage HTML for automation, use the JSON API. Treat as discovery: every claim is an unverified extortion-site post; corroborate before citing as confirmed breach.. | 2026-07-05 admiralty audit: C, community leak-site tracker (Mousqueton); accurate mirror of extortion posts but claims unverified, corroborate before citing as confirmed breach. Live, active retained. | 2026-09-30 intel run: besides /v2/recentvictims, https://api.ransomware.live/v2/recentcyberattacks (press title/summary/link per incident) and /v2/groupvictims/<group> work via `fetch_source.py url`; recentcyberattacks surfaces press-confirmed incidents that recentvictims does not, so it is the better nexus filter. | 2026-10-03 S4: `url https://api.ransomware.live/v2/countryvictims/CH`, `/v2/countrycyberattacks/<CC>` and `/v2/sectorvictims/<sector>` return data and give a direct Swiss-nexus filter. (2026-10-03T0404Z-intel) | 2026-10-07 (S4): the API endpoints (api.ransomware.live/v2/countryvictims/CH, countrycyberattacks/<CC>, recentvictims, searchvictims) read with `url --direct`; plain `url` fell to the jina reader once and returned a 404 page. | 2026-10-09 (2026-10-09T0255Z-intel): S4: `url --direct https://api.ransomware.live/v2/countrycyberattacks/<CC>` lists press-confirmed victims per country and `/v2/searchvictims/<term>` searches by name; the country list carried PK Softech AG on 2026-10-08. | 2026-10-10: v2 API endpoints read with `url --direct`: countrycyberattacks/<CC> (press-confirmed), countryvictims/<CC> (leak-site listings, no press flag), searchvictims/<term> (HTTP 404 means no match, not an outage), recentvictims; LI returns non-JSON. | 2026-10-12: S4 recipes: `url --direct https://api.ransomware.live/v2/countryvictims/CH` returns 253 records (group_name, post_title, discovered, website); `/v2/searchvictims/<term>` returns group, victim, attackdate, press, claim_url (404 = no match); `/v2/recentvictims` returns only the newest 100 records worldwide; `/v2/countrycyberattacks/CH` returns the press-confirmed records (79 on 2026-10-12). A null `press` field means no press confirmation was recorded. | 2026-10-14 intel run: `python3 tools/fetch_source.py url --direct https://api.ransomware.live/v2/countrycyberattacks/<CC>` returns the press-confirmed records for any country (DE, FR, IT, AT, US all work, not only CH) with added date, victim, title and the press URL; sorting on `added` surfaced five DACH and US public-body incidents the CH-only recipe did not show. /v2/recentvictims uses the key `group`, countryvictims uses `group_name`. | 2026-10-15 (S4): `url --direct https://api.ransomware.live/v2/searchvictims/<single keyword>` returns the matching victims (404 means no listing); `recentvictims` covers only about 12 h, so use `countryvictims/<CC>` for a 26 h window. | 2026-10-17 (2026-10-17T0256Z-intel): S4: countryvictims returns group_name/post_title/website/discovered, recentvictims returns group/victim/domain/discovered and covers about 2 days; countryvictims/LI returns 404. | 2026-10-19 intel run S4: use `url --direct https://api.ransomware.live/v2/countryvictims/CH` (also DE, AT) and `/v2/recentvictims`; the www.ransomware.live/api/... path returns 404 and the bridge then burns metered jina credit. | 2026-10-23 (S4): recipe for the 26 h sweep: `url --direct https://api.ransomware.live/v2/recentvictims` (JSON, 100 newest) and `url --direct https://api.ransomware.live/v2/countryvictims/CH` (Swiss list); the site path /recent is a 404. | 2026-10-25 (S4): the press-sourced Swiss list is `url --direct https://api.ransomware.live/v2/countrycyberattacks/CH` (79 items); `groupvictims/<group>` and `countryvictims/CH` also work; the site path /cyberattacks/CH is a 404 and /8k lists 8-K filings with the Item. | 2026-10-26 (S4): api.ransomware.live/v2 endpoints work through `url --direct`: `recentvictims` (100 newest claims with timestamps, group, country), `groupvictims/<group>`, `countryvictims/CH`; the press-sourced `recentcyberattacks` lags about 2 to 3 days. | 2026-10-28 (S4): the API v2 (api.ransomware.live/v2/groupvictims/<group>) works; the per-victim id pages time out (>100 s) through extract and url. | 2026-10-29 (S4): `python3 tools/fetch_source.py url https://api.ransomware.live/v2/recentvictims` (last 100), `.../v2/countryvictims/CH` (258 Swiss victims, fields group_name, post_title, description, discovered) and `.../v2/searchvictims/<term>` (404 means no match) all work through the bridge and carry the victim page `url` to cite; ransomware.live victim pages read with `extract` | 2026-10-30 (2026-10-30T0255Z-intel, S4): api.ransomware.live/v2 recentvictims, countryvictims/CH, searchvictims/<term> and the press-confirmed recentcyberattacks and countrycyberattacks/<CC> all work through `url --direct`; the human-facing /cyberattacks/CH page returns 404 and the press feed lags (newest row 2026-10-26). | 2026-11-03 (S4): the press-confirmed list `recentcyberattacks` lags to 2026-10-30; `recentvictims` and `countryvictims/CH` are current, and `url --direct` still works. | 2026-11-05 (S4): API field names are group_name, post_title, discovered