# Ransomware Victims Scraper - ransomware.live Monitor (`bovi/ransomware-scraper`) Actor

Monitor ransomware attacks and dark web leak-site claims tracked by ransomware.live. Filter 30,000+ victims by keyword, country and date; get victim, group, industry, website, country, discovery and publish dates. No Tor needed.

- **URL**: https://apify.com/bovi/ransomware-scraper.md
- **Developed by:** [Vitalii Bondarev](https://apify.com/bovi) (community)
- **Categories:** Developer tools, Business, News
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.65 / 1,000 ransomware victims scraper - ransomware.live monitors

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Ransomware Victims Scraper - ransomware.live Monitor

Monitor ransomware attacks and data-leak claims published on dark web leak sites, using the public data of
[ransomware.live](https://www.ransomware.live). The actor downloads the full ransomware.live victims database
(30,000+ claims by 400+ groups such as LockBit, Akira, Qilin, Play and The Gentlemen), filters it by keyword,
country and discovery date, and returns clean, structured records - no Tor, no .onion browsing, no login.

### What it collects

One dataset item per ransomware victim claim:

| Field | Description |
| --- | --- |
| `post_title` | Victim organization name |
| `group_name` | Ransomware group that claimed the attack |
| `url` | Victim page on ransomware.live |
| `group_url` | Group profile page on ransomware.live |
| `description` | Victim description / claim context |
| `website` | Victim website domain |
| `country` | 2-letter ISO country code |
| `activity` | Industry / sector |
| `discovered` | When ransomware.live detected the claim (ISO 8601) |
| `published` | When the claim was published on the leak site (estimated attack date) |
| `leak_post` | Original leak-site post address (.onion or forum URL), for reference only |

Fields the source does not know for a given victim are `null`. Results are sorted newest first.
A run summary (`totalResults`, `totalMatched`, `totalInDatabase`, applied filters) is stored under the
`OUTPUT` key of the default key-value store.

### Input

| Name | Type | Description | Default |
| --- | --- | --- | --- |
| `keywords` | string | Keywords matched against victim name, group, description and website. Separate with new lines, commas or semicolons; a record matches if ANY keyword is found. Empty = no keyword filter. | `""` |
| `country` | string | 2-letter ISO country code, e.g. `US`, `DE`. Empty = all countries. | `""` |
| `dateFrom` | string | Discovered on or after `YYYY-MM-DD`. | `""` |
| `dateTo` | string | Discovered on or before `YYYY-MM-DD`. | `""` |
| `maxResults` | integer | Maximum number of records to return. | `50` |
| `proxyConfiguration` | object | Optional proxy; ransomware.live is public, so no proxy is needed by default. | no proxy |

Example input:

```json
{
  "keywords": "hospital\nclinic\nhealthcare",
  "country": "US",
  "dateFrom": "2026-01-01",
  "maxResults": 200
}
```

### Example output

```json
{
  "post_title": "Markisol",
  "group_name": "thegentlemen",
  "url": "https://www.ransomware.live/id/TWFya2lzb2xAdGhlZ2VudGxlbWVu",
  "group_url": "https://www.ransomware.live/group/thegentlemen",
  "description": "markisol.se ... Markisol Group is a Swedish family-owned manufacturer of window blinds ...",
  "website": "markisol.se",
  "country": "SE",
  "activity": "Manufacturing",
  "discovered": "2026-09-26T08:46:13.633119+00:00",
  "published": "2026-09-21T17:43:19+00:00",
  "leak_post": null
}
```

### Use cases

- **Brand and third-party risk** - schedule a daily run with your company, vendor or customer names.
- **Threat intelligence** - track the activity of specific ransomware groups.
- **Sector and country research** - pull every claim for a country or date window for reports and dashboards.
- **SOC / SIEM enrichment** - send new victims to your stack through Apify webhooks or the API.

### Price

Pay per result: you are charged only for the victim records stored in the dataset (pay-per-dataset-item),
about **$0.004 per result** ($4 per 1,000 records), plus the standard Apify actor start fee. Use `maxResults`
to cap the cost of a run.

### Data source

All data comes from the public ransomware.live project by Julien Mousqueton, which monitors ransomware leak
sites. The actor only reads public data; please respect the ransomware.live terms when reusing it.

# Actor input Schema

## `keywords` (type: `string`):

One or more keywords matched against the victim name, ransomware group, description and website. Separate keywords with new lines, commas or semicolons. Case-insensitive; a record matches if ANY keyword is found. Leave empty to return all records allowed by the other filters.

## `country` (type: `string`):

2-letter ISO country code of the victim (e.g. US, GB, DE, FR, IT). Leave empty for all countries.

## `dateFrom` (type: `string`):

Only victims discovered on or after this date (YYYY-MM-DD).

## `dateTo` (type: `string`):

Only victims discovered on or before this date (YYYY-MM-DD).

## `maxResults` (type: `integer`):

Maximum number of victim records to return (newest first).

## `proxyConfiguration` (type: `object`):

Optional proxy. ransomware.live is publicly reachable, so no proxy is needed in most cases.

## Actor input object example

```json
{
  "keywords": "IKEA",
  "maxResults": 50,
  "proxyConfiguration": {
    "useApifyProxy": true,
    "apifyProxyGroups": [
      "RESIDENTIAL"
    ]
  }
}
```

# Actor output Schema

## `results` (type: `string`):

Dataset with one record per ransomware victim.

## `summary` (type: `string`):

OUTPUT record in the default key-value store: totals and applied filters.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "keywords": "IKEA",
    "proxyConfiguration": {
        "useApifyProxy": true,
        "apifyProxyGroups": [
            "RESIDENTIAL"
        ]
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("bovi/ransomware-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "keywords": "IKEA",
    "proxyConfiguration": {
        "useApifyProxy": True,
        "apifyProxyGroups": ["RESIDENTIAL"],
    },
}

# Run the Actor and wait for it to finish
run = client.actor("bovi/ransomware-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "keywords": "IKEA",
  "proxyConfiguration": {
    "useApifyProxy": true,
    "apifyProxyGroups": [
      "RESIDENTIAL"
    ]
  }
}' |
apify call bovi/ransomware-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bovi/ransomware-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1suj8fV3lKDofZCf5/builds/eqvV8dCe8SSiL6BLZ/openapi.json