Ransomware Victims Scraper - ransomware.live Monitor
Pricing
from $2.65 / 1,000 ransomware victims scraper - ransomware.live monitors
Ransomware Victims Scraper - ransomware.live Monitor
Monitor ransomware attacks and dark web leak-site claims tracked by ransomware.live. Filter 30,000+ victims by keyword, country and date; get victim, group, industry, website, country, discovery and publish dates. No Tor needed.
Pricing
from $2.65 / 1,000 ransomware victims scraper - ransomware.live monitors
Rating
0.0
(0)
Developer
Vitalii Bondarev
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Share
Monitor ransomware attacks and data-leak claims published on dark web leak sites, using the public data of ransomware.live. The actor downloads the full ransomware.live victims database (30,000+ claims by 400+ groups such as LockBit, Akira, Qilin, Play and The Gentlemen), filters it by keyword, country and discovery date, and returns clean, structured records - no Tor, no .onion browsing, no login.
What it collects
One dataset item per ransomware victim claim:
| Field | Description |
|---|---|
post_title | Victim organization name |
group_name | Ransomware group that claimed the attack |
url | Victim page on ransomware.live |
group_url | Group profile page on ransomware.live |
description | Victim description / claim context |
website | Victim website domain |
country | 2-letter ISO country code |
activity | Industry / sector |
discovered | When ransomware.live detected the claim (ISO 8601) |
published | When the claim was published on the leak site (estimated attack date) |
leak_post | Original leak-site post address (.onion or forum URL), for reference only |
Fields the source does not know for a given victim are null. Results are sorted newest first.
A run summary (totalResults, totalMatched, totalInDatabase, applied filters) is stored under the
OUTPUT key of the default key-value store.
Input
| Name | Type | Description | Default |
|---|---|---|---|
keywords | string | Keywords matched against victim name, group, description and website. Separate with new lines, commas or semicolons; a record matches if ANY keyword is found. Empty = no keyword filter. | "" |
country | string | 2-letter ISO country code, e.g. US, DE. Empty = all countries. | "" |
dateFrom | string | Discovered on or after YYYY-MM-DD. | "" |
dateTo | string | Discovered on or before YYYY-MM-DD. | "" |
maxResults | integer | Maximum number of records to return. | 50 |
proxyConfiguration | object | Optional proxy; ransomware.live is public, so no proxy is needed by default. | no proxy |
Example input:
Example output
Use cases
- Brand and third-party risk - schedule a daily run with your company, vendor or customer names.
- Threat intelligence - track the activity of specific ransomware groups.
- Sector and country research - pull every claim for a country or date window for reports and dashboards.
- SOC / SIEM enrichment - send new victims to your stack through Apify webhooks or the API.
Price
Pay per result: you are charged only for the victim records stored in the dataset (pay-per-dataset-item),
about $0.004 per result ($4 per 1,000 records), plus the standard Apify actor start fee. Use maxResults
to cap the cost of a run.
Data source
All data comes from the public ransomware.live project by Julien Mousqueton, which monitors ransomware leak sites. The actor only reads public data; please respect the ransomware.live terms when reusing it.
