Ransomware Live Scraper

Pull ransomware victim and data-breach disclosures from ransomware.live at scale — dark-web leak URLs, ransom demands, exfiltrated-data sizes, leak-post screenshots, infostealer flags, and the group behind every claim, across 357+ tracked ransomware crews. Built for threat-intelligence analysts, SOC teams, cyber-insurance underwriters, and security researchers who need structured ransomware victim data without manually trawling dark-web leak sites.

Why This Scraper?

• 357+ ransomware groups tracked by name — pull the complete victim history of LockBit, Qilin, Play, Akira, BlackCat, and 350+ other crews, including defunct groups that most feeds have dropped. The competing tracker cannot filter by group at all.
• Dark-web (.onion) leak URLs on every record — the exact data-leak-site address where each victim was posted, so you can verify a claim at its source instead of trusting a secondhand summary.
• Leak-post screenshots when available — an image of the actual dark-web listing, preserving evidence that vanishes when a group rotates or takes down its site.
• Ransom demands and exfiltrated-data size as structured fields — the dollar figure and data volume the attackers disclosed, surfaced as clean fields instead of buried in free text.
• Infostealer intelligence flag when available — ties a victim to related credential-theft activity, a signal the competing tracker doesn't expose.
• 14 industry sectors × 54 countries, combinable — filter to Healthcare victims in the United States, Manufacturing in Germany, or any sector-and-country pairing in a single run.
• Full ~29,600-record historical archive — set max results to 0 and pull every victim disclosure back to 2020, with no 10,000-row ceiling.
• Filters that actually narrow together — group, sector, country, keyword, and date range compose into one tight query (for example, LockBit healthcare victims in the US during Q1 2026).
• A ransomware.live permalink on every row — a stable, shareable link back to the canonical victim page to cite directly in reports and tickets.

Use Cases

Threat Intelligence & Monitoring

• Track which ransomware groups are most active by victim volume over time
• Build a watchlist for a specific group and pull every new victim it claims
• Monitor your own industry sector for fresh breach disclosures
• Compare ransom demands and data-size claims across a group's campaigns

Cyber Insurance & Risk Underwriting

• Screen prospective policyholders against the full archive by company name or domain
• Quantify sector-level ransomware exposure to price coverage
• Flag applicants whose domain already appears on a dark-web leak site
• Track loss trends by country and industry for actuarial models

Security Research & Reporting

• Assemble a dataset of every victim in a country or sector for a threat report
• Study a group's targeting patterns from its complete victim history
• Measure the rise of specific sectors as ransomware targets year over year
• Pull leak-post screenshots as evidence for incident write-ups

Vendor & Supply-Chain Monitoring

• Check whether a vendor or partner appears on a leak site by keyword
• Run recurring collections to catch a supplier breach the day it's disclosed
• Screen an acquisition target's domain against historical disclosures

Brand & Executive Protection

• Watch for your company name across all 357+ tracked groups
• Detect a subsidiary or brand appearing on a dark-web claim page early

Getting Started

Most Recent Disclosures

The simplest run — the newest breach disclosures, newest first:

{
    "maxResults": 50
}

Track a Single Group

Filtering by one group returns the richest records, including leak-post screenshots and infostealer flags when present:

{
    "groupNames": ["lockbit3"],
    "maxResults": 200
}

Sector + Country Risk View

Every Healthcare victim located in the United States:

{
    "sector": "Healthcare",
    "country": "US",
    "maxResults": 100
}

Full Historical Archive

Set max results to 0 to collect every matching victim disclosure back to 2020:

{
    "country": "DE",
    "maxResults": 0
}

Advanced — Every Filter Combined

{
    "groupNames": ["akira", "qilin"],
    "keywords": ["hospital"],
    "country": "GB",
    "sector": "Healthcare",
    "dateFrom": "2025-01-01",
    "dateTo": "2026-06-30",
    "maxResults": 500
}

Input Reference

What to Collect

Parameter	Type	Default	Description
groupNames	string[]	[]	Ransomware group names to collect victims for, such as lockbit3, qilin, play, or akira (case-insensitive). Leave empty to include every group.
keywords	string[]	[]	Keep only breaches whose victim name, group, domain, or description contains one of these words (case-insensitive). Leave empty to skip keyword filtering.

Filters

Parameter	Type	Default	Description
country	select	All countries	Keep only victims in this country (2-letter code). 54 countries available; selecting United Kingdom also captures UK-tagged records.
sector	select	All sectors	Keep only victims in this industry sector. 14 sectors available, from Healthcare and Manufacturing to Financial Services and Energy.
dateFrom	string	""	Keep breaches disclosed on or after this date (YYYY-MM-DD). Leave empty for no lower bound.
dateTo	string	""	Keep breaches disclosed on or before this date (YYYY-MM-DD). Leave empty for no upper bound.

Limits

Parameter	Type	Default	Description
maxResults	integer	100	How many records to collect in total. Set to 0 to collect every matching record — large runs can return tens of thousands.

Output

Each row is one victim/breach record. Here's a representative result from a single-group run with the richer fields populated:

{
    "victimName": "Example Regional Health Network",
    "group": "lockbit3",
    "sector": "Healthcare",
    "country": "US",
    "domain": "examplehealth.org",
    "description": "The group claims to have exfiltrated 480 GB of patient records, HR files, and internal financial documents.",
    "discovered": "2026-02-14T08:31:00Z",
    "attackDate": "2026-02-11T00:00:00Z",
    "ransom": "$2,000,000",
    "dataSize": "480 GB",
    "infostealer": "3 corporate credentials found in stealer logs",
    "claimUrl": "http://example-leaksite-xxxxx.onion/leaks/example-health-network",
    "screenshot": "https://images.ransomware.live/screenshots/examplehealth.png",
    "url": "https://www.ransomware.live/id/RXhhbXBsZS1IZWFsdGhAbG9ja2JpdDM="
}

Victim & Group

Field	Type	Description
victimName	string	Victim organization name
group	string	Ransomware group that claimed the victim (e.g. lockbit3)
sector	string	Industry sector of the victim
country	string	Two-letter country code of the victim
domain	string	Victim website or domain
description	string | null	Attack or victim description as posted by the group

Timeline & Impact

Field	Type	Description
discovered	string	Timestamp the disclosure was first indexed (≈ disclosure date)
attackDate	string	Timestamp of the leak-site post / claimed attack
ransom	string | null	Ransom demand when the group disclosed one
dataSize	string | null	Size of exfiltrated data when disclosed (e.g. 480 GB)

Dark-Web & Evidence

Field	Type	Description
claimUrl	string	Dark-web (.onion) leak-site address where the victim was posted
screenshot	string | null	Image URL of the leak post — populated on single-filter runs
infostealer	string | null	Related infostealer / credential-theft note — populated on single-filter runs
press	string[] | null	Media coverage links when the group or trackers publish them (rarely populated)
url	string	Stable ransomware.live permalink for the victim record

Tips for Best Results

• Single-filter runs return the richest records. Filtering by exactly one group, one sector, or one keyword unlocks the extra fields — leak-post screenshots and infostealer flags — that broad, multi-filter and country-only runs don't include. If those fields matter to you, run one filter at a time.
• Preview before you pull everything. Set maxResults to 50–100 on the first run to confirm the data fits your needs, then raise it or set it to 0.
• Pull the whole history in one run. maxResults: 0 collects every matching record back to 2020 (~29,600 records with no filter) — ideal for building a baseline dataset.
• Group names are case-insensitive and friendly. Type lockbit3, qilin, or blackcat; leave the field empty for all 357+ groups.
• United Kingdom captures both UK tags. The tracker labels UK breaches under two country codes — selecting United Kingdom includes both automatically, so you don't miss records.
• Combine sector and country for targeted risk views — for example, Healthcare + United States, or Manufacturing + Germany — to isolate the exposure that matters to you.
• Date filters bound the disclosure window. Use dateFrom and dateTo to scope a reporting period, such as a single quarter, for a threat report or board update.

Pricing

From $2.80 per 1,000 results — a richer 15-field record and per-group filtering, priced below the market rate for ransomware breach data. Bronze, Silver, and Gold subscribers pay progressively less; the table below shows total cost at each discount tier.

Results	No discount	Bronze	Silver	Gold
100	$0.34	$0.32	$0.30	$0.28
1,000	$3.35	$3.15	$3.00	$2.80
10,000	$33.50	$31.50	$30.00	$28.00
100,000	$335.00	$315.00	$300.00	$280.00

A "result" is any victim/breach row in the output dataset. No compute or time-based charges — you pay per result, plus a small fixed per-run start fee.

Integrations

Export data in JSON, CSV, Excel, XML, or RSS. Connect to 1,500+ apps via:

• Zapier / Make / n8n — Workflow automation
• Google Sheets — Direct spreadsheet export
• Slack / Email — Notifications on new disclosures
• Webhooks — Trigger custom APIs on run completion
• Apify API — Full programmatic access

Legal & Ethical Use

This actor aggregates publicly posted ransomware victim disclosures from ransomware.live for defensive threat-intelligence, security research, risk assessment, and open-source intelligence (OSINT). It does not access, host, or facilitate access to stolen data — it collects the disclosure metadata that ransomware groups publish about their claimed victims. Use it responsibly: for defending organizations, informing risk decisions, and research, never to target victims, extort, or cause further harm. Users are responsible for complying with applicable laws, regulations, and ransomware.live's terms of service, and for handling any personal data in the results in line with privacy obligations.