# Ransomware Live Scraper (`solidcode/ransomware-live-scraper`) Actor \[💰 $2.80 / 1K] Extract ransomware victims and data-breach disclosures from ransomware.live. Filter by group, country, sector, keyword, or date. Records include victim, group, sector, country, dates, ransom, data size, leak URL, and screenshot. Clean JSON/CSV/Excel for threat intel. - **URL**: https://apify.com/solidcode/ransomware-live-scraper.md - **Developed by:** [SolidCode](https://apify.com/solidcode) (community) - **Categories:** Developer tools, Other - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $2.80 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Ransomware Live Scraper Pull ransomware victim and data-breach disclosures from ransomware.live at scale — dark-web leak URLs, ransom demands, exfiltrated-data sizes, leak-post screenshots, infostealer flags, and the group behind every claim, across 357+ tracked ransomware crews. Built for threat-intelligence analysts, SOC teams, cyber-insurance underwriters, and security researchers who need structured ransomware victim data without manually trawling dark-web leak sites. ### Why This Scraper? - **357+ ransomware groups tracked by name** — pull the complete victim history of LockBit, Qilin, Play, Akira, BlackCat, and 350+ other crews, including defunct groups that most feeds have dropped. The competing tracker cannot filter by group at all. - **Dark-web (.onion) leak URLs on every record** — the exact data-leak-site address where each victim was posted, so you can verify a claim at its source instead of trusting a secondhand summary. - **Leak-post screenshots when available** — an image of the actual dark-web listing, preserving evidence that vanishes when a group rotates or takes down its site. - **Ransom demands and exfiltrated-data size as structured fields** — the dollar figure and data volume the attackers disclosed, surfaced as clean fields instead of buried in free text. - **Infostealer intelligence flag when available** — ties a victim to related credential-theft activity, a signal the competing tracker doesn't expose. - **14 industry sectors × 54 countries, combinable** — filter to Healthcare victims in the United States, Manufacturing in Germany, or any sector-and-country pairing in a single run. - **Full ~29,600-record historical archive** — set max results to 0 and pull every victim disclosure back to 2020, with no 10,000-row ceiling. - **Filters that actually narrow together** — group, sector, country, keyword, and date range compose into one tight query (for example, LockBit healthcare victims in the US during Q1 2026). - **A ransomware.live permalink on every row** — a stable, shareable link back to the canonical victim page to cite directly in reports and tickets. ### Use Cases **Threat Intelligence & Monitoring** - Track which ransomware groups are most active by victim volume over time - Build a watchlist for a specific group and pull every new victim it claims - Monitor your own industry sector for fresh breach disclosures - Compare ransom demands and data-size claims across a group's campaigns **Cyber Insurance & Risk Underwriting** - Screen prospective policyholders against the full archive by company name or domain - Quantify sector-level ransomware exposure to price coverage - Flag applicants whose domain already appears on a dark-web leak site - Track loss trends by country and industry for actuarial models **Security Research & Reporting** - Assemble a dataset of every victim in a country or sector for a threat report - Study a group's targeting patterns from its complete victim history - Measure the rise of specific sectors as ransomware targets year over year - Pull leak-post screenshots as evidence for incident write-ups **Vendor & Supply-Chain Monitoring** - Check whether a vendor or partner appears on a leak site by keyword - Run recurring collections to catch a supplier breach the day it's disclosed - Screen an acquisition target's domain against historical disclosures **Brand & Executive Protection** - Watch for your company name across all 357+ tracked groups - Detect a subsidiary or brand appearing on a dark-web claim page early ### Getting Started #### Most Recent Disclosures The simplest run — the newest breach disclosures, newest first: ```json { "maxResults": 50 } ```` #### Track a Single Group Filtering by one group returns the richest records, including leak-post screenshots and infostealer flags when present: ```json { "groupNames": ["lockbit3"], "maxResults": 200 } ``` #### Sector + Country Risk View Every Healthcare victim located in the United States: ```json { "sector": "Healthcare", "country": "US", "maxResults": 100 } ``` #### Full Historical Archive Set max results to 0 to collect every matching victim disclosure back to 2020: ```json { "country": "DE", "maxResults": 0 } ``` #### Advanced — Every Filter Combined ```json { "groupNames": ["akira", "qilin"], "keywords": ["hospital"], "country": "GB", "sector": "Healthcare", "dateFrom": "2025-01-01", "dateTo": "2026-06-30", "maxResults": 500 } ``` ### Input Reference #### What to Collect | Parameter | Type | Default | Description | |-----------|------|---------|-------------| | `groupNames` | string\[] | `[]` | Ransomware group names to collect victims for, such as `lockbit3`, `qilin`, `play`, or `akira` (case-insensitive). Leave empty to include every group. | | `keywords` | string\[] | `[]` | Keep only breaches whose victim name, group, domain, or description contains one of these words (case-insensitive). Leave empty to skip keyword filtering. | #### Filters | Parameter | Type | Default | Description | |-----------|------|---------|-------------| | `country` | select | `All countries` | Keep only victims in this country (2-letter code). 54 countries available; selecting United Kingdom also captures UK-tagged records. | | `sector` | select | `All sectors` | Keep only victims in this industry sector. 14 sectors available, from Healthcare and Manufacturing to Financial Services and Energy. | | `dateFrom` | string | `""` | Keep breaches disclosed on or after this date (`YYYY-MM-DD`). Leave empty for no lower bound. | | `dateTo` | string | `""` | Keep breaches disclosed on or before this date (`YYYY-MM-DD`). Leave empty for no upper bound. | #### Limits | Parameter | Type | Default | Description | |-----------|------|---------|-------------| | `maxResults` | integer | `100` | How many records to collect in total. Set to `0` to collect every matching record — large runs can return tens of thousands. | ### Output Each row is one victim/breach record. Here's a representative result from a single-group run with the richer fields populated: ```json { "victimName": "Example Regional Health Network", "group": "lockbit3", "sector": "Healthcare", "country": "US", "domain": "examplehealth.org", "description": "The group claims to have exfiltrated 480 GB of patient records, HR files, and internal financial documents.", "discovered": "2026-02-14T08:31:00Z", "attackDate": "2026-02-11T00:00:00Z", "ransom": "$2,000,000", "dataSize": "480 GB", "infostealer": "3 corporate credentials found in stealer logs", "claimUrl": "http://example-leaksite-xxxxx.onion/leaks/example-health-network", "screenshot": "https://images.ransomware.live/screenshots/examplehealth.png", "url": "https://www.ransomware.live/id/RXhhbXBsZS1IZWFsdGhAbG9ja2JpdDM=" } ``` #### Victim & Group | Field | Type | Description | |-------|------|-------------| | `victimName` | string | Victim organization name | | `group` | string | Ransomware group that claimed the victim (e.g. `lockbit3`) | | `sector` | string | Industry sector of the victim | | `country` | string | Two-letter country code of the victim | | `domain` | string | Victim website or domain | | `description` | string | null | Attack or victim description as posted by the group | #### Timeline & Impact | Field | Type | Description | |-------|------|-------------| | `discovered` | string | Timestamp the disclosure was first indexed (≈ disclosure date) | | `attackDate` | string | Timestamp of the leak-site post / claimed attack | | `ransom` | string | null | Ransom demand when the group disclosed one | | `dataSize` | string | null | Size of exfiltrated data when disclosed (e.g. `480 GB`) | #### Dark-Web & Evidence | Field | Type | Description | |-------|------|-------------| | `claimUrl` | string | Dark-web (.onion) leak-site address where the victim was posted | | `screenshot` | string | null | Image URL of the leak post — populated on single-filter runs | | `infostealer` | string | null | Related infostealer / credential-theft note — populated on single-filter runs | | `press` | string\[] | null | Media coverage links when the group or trackers publish them (rarely populated) | | `url` | string | Stable ransomware.live permalink for the victim record | ### Tips for Best Results - **Single-filter runs return the richest records.** Filtering by exactly one group, one sector, or one keyword unlocks the extra fields — leak-post screenshots and infostealer flags — that broad, multi-filter and country-only runs don't include. If those fields matter to you, run one filter at a time. - **Preview before you pull everything.** Set `maxResults` to 50–100 on the first run to confirm the data fits your needs, then raise it or set it to `0`. - **Pull the whole history in one run.** `maxResults: 0` collects every matching record back to 2020 (~29,600 records with no filter) — ideal for building a baseline dataset. - **Group names are case-insensitive and friendly.** Type `lockbit3`, `qilin`, or `blackcat`; leave the field empty for all 357+ groups. - **United Kingdom captures both UK tags.** The tracker labels UK breaches under two country codes — selecting United Kingdom includes both automatically, so you don't miss records. - **Combine sector and country for targeted risk views** — for example, Healthcare + United States, or Manufacturing + Germany — to isolate the exposure that matters to you. - **Date filters bound the disclosure window.** Use `dateFrom` and `dateTo` to scope a reporting period, such as a single quarter, for a threat report or board update. ### Pricing **From $2.80 per 1,000 results** — a richer 15-field record and per-group filtering, priced below the market rate for ransomware breach data. Bronze, Silver, and Gold subscribers pay progressively less; the table below shows total cost at each discount tier. | Results | No discount | Bronze | Silver | Gold | |---------|-------------|--------|--------|------| | 100 | $0.34 | $0.32 | $0.30 | $0.28 | | 1,000 | $3.35 | $3.15 | $3.00 | $2.80 | | 10,000 | $33.50 | $31.50 | $30.00 | $28.00 | | 100,000 | $335.00 | $315.00 | $300.00 | $280.00 | A "result" is any victim/breach row in the output dataset. **No compute or time-based charges — you pay per result, plus a small fixed per-run start fee.** ### Integrations Export data in JSON, CSV, Excel, XML, or RSS. Connect to 1,500+ apps via: - **Zapier** / **Make** / **n8n** — Workflow automation - **Google Sheets** — Direct spreadsheet export - **Slack** / **Email** — Notifications on new disclosures - **Webhooks** — Trigger custom APIs on run completion - **Apify API** — Full programmatic access ### Legal & Ethical Use This actor aggregates publicly posted ransomware victim disclosures from ransomware.live for defensive threat-intelligence, security research, risk assessment, and open-source intelligence (OSINT). It does not access, host, or facilitate access to stolen data — it collects the disclosure metadata that ransomware groups publish about their claimed victims. Use it responsibly: for defending organizations, informing risk decisions, and research, never to target victims, extort, or cause further harm. Users are responsible for complying with applicable laws, regulations, and ransomware.live's terms of service, and for handling any personal data in the results in line with privacy obligations. # Actor input Schema ## `groupNames` (type: `array`): Collect victims claimed by specific ransomware groups. Enter one or more group names such as lockbit3, qilin, play, akira, or blackcat (case-insensitive). Leave empty to include every group. ## `keywords` (type: `array`): Only keep breaches whose victim name, group, domain, or description contains one of these words (case-insensitive). For example, enter "hospital" or a company name. Leave empty to skip keyword filtering. ## `country` (type: `string`): Only keep victims located in this country (2-letter ISO code). Choose "All countries" to include every country. ## `sector` (type: `string`): Only keep victims in this industry sector. Choose "All sectors" to include every sector. ## `dateFrom` (type: `string`): Only keep breaches disclosed on or after this date (YYYY-MM-DD). Leave empty for no lower bound. ## `dateTo` (type: `string`): Only keep breaches disclosed on or before this date (YYYY-MM-DD). Leave empty for no upper bound. ## `maxResults` (type: `integer`): How many breach records to collect in total. Default 100. Set to 0 to collect every matching record (large runs can return tens of thousands). ## Actor input object example ```json { "groupNames": [], "keywords": [], "country": "", "sector": "", "maxResults": 100 } ``` # Actor output Schema ## `overview` (type: `string`): Table of collected breaches with the most useful columns at a glance. ## `details` (type: `string`): Table with the full field set for each breach, including ransom demand, data size, and leak-site links. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "groupNames": [], "keywords": [], "country": "", "sector": "", "dateFrom": "", "dateTo": "", "maxResults": 100 }; // Run the Actor and wait for it to finish const run = await client.actor("solidcode/ransomware-live-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "groupNames": [], "keywords": [], "country": "", "sector": "", "dateFrom": "", "dateTo": "", "maxResults": 100, } # Run the Actor and wait for it to finish run = client.actor("solidcode/ransomware-live-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "groupNames": [], "keywords": [], "country": "", "sector": "", "dateFrom": "", "dateTo": "", "maxResults": 100 }' | apify call solidcode/ransomware-live-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=solidcode/ransomware-live-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Ransomware Live Scraper", "description": "[💰 $2.80 / 1K] Extract ransomware victims and data-breach disclosures from ransomware.live. Filter by group, country, sector, keyword, or date. Records include victim, group, sector, country, dates, ransom, data size, leak URL, and screenshot. Clean JSON/CSV/Excel for threat intel.", "version": "1.0", "x-build-id": "KlCikMM3hfhWJBCn6" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/solidcode~ransomware-live-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-solidcode-ransomware-live-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/solidcode~ransomware-live-scraper/runs": { "post": { "operationId": "runs-sync-solidcode-ransomware-live-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/solidcode~ransomware-live-scraper/run-sync": { "post": { "operationId": "run-sync-solidcode-ransomware-live-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "groupNames": { "title": "Ransomware groups", "type": "array", "description": "Collect victims claimed by specific ransomware groups. Enter one or more group names such as lockbit3, qilin, play, akira, or blackcat (case-insensitive). Leave empty to include every group.", "items": { "type": "string" } }, "keywords": { "title": "Keywords", "type": "array", "description": "Only keep breaches whose victim name, group, domain, or description contains one of these words (case-insensitive). For example, enter \"hospital\" or a company name. Leave empty to skip keyword filtering.", "items": { "type": "string" } }, "country": { "title": "Country", "enum": [ "", "US", "GB", "CA", "AU", "DE", "FR", "IT", "ES", "NL", "BE", "CH", "AT", "SE", "NO", "DK", "FI", "IE", "PT", "PL", "CZ", "RO", "GR", "HU", "SK", "BG", "HR", "RS", "UA", "RU", "TR", "IL", "AE", "SA", "IN", "JP", "KR", "CN", "TW", "HK", "SG", "MY", "TH", "ID", "PH", "VN", "BR", "MX", "AR", "CL", "CO", "PE", "ZA", "NZ", "EG" ], "type": "string", "description": "Only keep victims located in this country (2-letter ISO code). Choose \"All countries\" to include every country.", "default": "" }, "sector": { "title": "Industry sector", "enum": [ "", "Business Services", "Manufacturing", "Technology", "Healthcare", "Consumer Services", "Financial Services", "Construction", "Transportation/Logistics", "Education", "Public Sector", "Agriculture and Food Production", "Energy", "Hospitality and Tourism", "Telecommunication" ], "type": "string", "description": "Only keep victims in this industry sector. Choose \"All sectors\" to include every sector.", "default": "" }, "dateFrom": { "title": "From date", "type": "string", "description": "Only keep breaches disclosed on or after this date (YYYY-MM-DD). Leave empty for no lower bound." }, "dateTo": { "title": "To date", "type": "string", "description": "Only keep breaches disclosed on or before this date (YYYY-MM-DD). Leave empty for no upper bound." }, "maxResults": { "title": "Max results", "minimum": 0, "type": "integer", "description": "How many breach records to collect in total. Default 100. Set to 0 to collect every matching record (large runs can return tens of thousands).", "default": 100 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```