Ransomware.live API

Free Ransomware.live API with no key: recent ransomware victims claimed on leak sites, group profiles, negotiation data and infostealer context. Passive OSINT, no scanning.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the Ransomware.live API?

The Ransomware.live API is a free, key-free service tracking ransomware activity by monitoring the leak sites operated by ransomware groups. It returns recently claimed victims with the attacking group, sector, country and discovery timestamp, plus group profiles and related threat context.

Ransomware groups run public extortion sites where they name victims who have not paid, and Ransomware.live monitors those sites and structures what appears on them. The result is one of the few near-real-time public views of ransomware activity: which groups are active, who they are hitting, in which sectors and countries. The example returns a healthcare victim claimed by the Anubis group hours earlier.

The provenance demands care and the project is honest about it. Every record is a claim made by criminals on their own leak site — not a verified breach, not a confirmed compromise, and occasionally a fabrication or a re-listing of an old incident to manufacture pressure. Some `description` fields are explicitly marked `[AI generated]`, meaning a language model summarised the victim's business rather than a human verifying anything. Treat the data as an indicator of group activity and sector targeting, and never publish a named organisation as breached on this basis alone. Note also that `claim_url` values are Tor onion addresses pointing at live extortion sites; store them as data, do not fetch them.

Quick facts

Base URL: https://api.ransomware.live/v2
Authentication: No API key or account. The project is community-run and free; it asks for attribution. All data is scraped from criminal leak sites and consists of unverified attacker claims.
Rate limit: No published limit. The dataset updates as leak sites post, so polling every few minutes is more than enough.
Pricing: Free, with attribution requested.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the Ransomware.live API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch the most recently claimed ransomware victims

GET https://api.ransomware.live/v2/recentvictims

curl

curl 'https://api.ransomware.live/v2/recentvictims' \
  -H 'Accept: application/json'

JavaScript (fetch)

const res = await fetch("https://api.ransomware.live/v2/recentvictims", {
  headers: {
    "Accept": "application/json",
  },
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Accept": "application/json",
}

res = requests.get("https://api.ransomware.live/v2/recentvictims", headers=headers, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

[
  {
    "activity": "Healthcare",
    "attackdate": "2026-08-21T02:52:18.456997+00:00",
    "claim_url": "http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/r/qSyLjdjTxND8z6QcanI76118t3safzffkx25VyrsP8pRisU9uC3yns7FVVZTZ2KwlAv3deD5VCYDtdSoeUz2NJc1JRNFJi",
    "country": "US",
    "data_size": null,
    "description": "Data breach at a major healthcare franchise headquarters.",
    "discovered": "2026-08-21T02:53:01.068671+00:00",
    "domain": "interimhealthcare.com",
    "group": "anubis",
    "infostealer": {
      "employees": 0,
      "employees_url": 0,
      "infostealer_stats": {
        "Azorult": 2,
        "Generic Stealer": 3,
        "Lumma": 1,
        "RedLine": 1
      },
      "last_employee_compromised": "1970-01-01T00:00:00+00:00",
      "last_user_compromised": "2025-05-09T00:22:30+00:00",
      "thirdparties": 4,
      "update": "2026-08-21T05:28:44.319095",
      "users": 5,
      "users_url": 6
    },
    "press": null,
    "ransom": null,
    "screenshot": "https://images.ransomware.live/victims/185bc067268bd0d0ff7bd1e8461dcd97.png",
    "url": "https://www.ransomware.live/id/SW50ZXJpbSBIZWFsdGhDYXJlIFtIZWFkIG9mZmljZV1AYW51Ymlz",
    "victim": "Interim HealthCare [Head office]"
  },
  {
    "activity": "Education",
    "attackdate": "2026-08-21T02:23:05.936000+00:00",
    "claim_url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/110",
    "country": "",
    "data_size": null,
    "description": "[AI generated] Studee is an online platform that helps international students find and appl

Parameters

Parameter	Type	Required	Description
`(endpoint) /recentvictims`	path	Optional	Most recent victims claimed across all tracked groups. `/v2/recentvictims`
`(endpoint) /groups`	path	Optional	Every tracked ransomware group with profile and activity data. `/v2/groups`
`(endpoint) /group/{name}`	path	Optional	Detail and victim list for one group. `/v2/group/anubis`
`(endpoint) /countryvictims/{code}`	path	Optional	Victims filtered to one country by ISO code. `/v2/countryvictims/GB`
`(endpoint) /sectorvictims/{sector}`	path	Optional	Victims filtered to one sector. `/v2/sectorvictims/Healthcare`

Response fields

victimstring: Organisation name as the group wrote it on its leak site. Spelling and accuracy are the attacker's.
groupstring: Ransomware group claiming the attack.
activitystring: Sector classification such as `Healthcare` or `Education`.
countrystring: Two-letter country code, frequently empty when the group did not make it clear.
attackdate / discoveredstring: When the group dated the attack and when the monitor first saw the posting. The two can differ by a lot.
descriptionstring: Business description. Some are marked `[AI generated]`, meaning a language model wrote them from public sources.
claim_urlstring: Tor onion URL of the extortion post. Store as evidence; do not fetch it.
infostealerobject: Related credential-theft context where available, including counts by stealer family.

What you can build with the Ransomware.live API

Track which ransomware groups are most active this month
Monitor claimed attacks in your sector or country
Feed group activity trends into a threat intelligence briefing
Study targeting patterns for research or reporting
Correlate a suspected incident with public extortion claims

Common errors and how to fix them

Unverified or false claims

Records are attacker assertions, not confirmed breaches.

Fix: Never treat a listing as proof. Groups re-list old victims and occasionally invent them to apply pressure.

Empty country or sector fields

Groups do not publish structured data.

Fix: Fields are extracted from unstructured leak-site posts. Expect gaps and do not build required-field logic around them.

AI-generated descriptions

Some summaries are model-written.

Fix: Check for the `[AI generated]` marker before quoting a description anywhere it might be read as fact.

Service interruption

This is a small community project monitoring hostile infrastructure.

Fix: Cache results and degrade gracefully; the upstream sites it watches are themselves frequently offline.

Ransomware.live API — frequently asked questions

Is the Ransomware.live API free?

Yes, free with no key or registration. It is a community-run project and asks only for attribution when you use its data.

Is the victim data verified?

No, and this is the most important thing to understand about it. Every entry is a claim published by a criminal group on its own extortion site. Claims can be exaggerated, recycled from old incidents, or entirely fabricated. Use the data for activity trends, not for asserting that a named organisation was breached.

Is it safe to use this API?

Querying the API is entirely passive — it reads a database the project maintains and touches no victim infrastructure. Do not follow the `claim_url` onion links, which point at live criminal extortion sites.

What are the infostealer fields?

Context from credential-theft datasets showing how many compromised credentials are associated with the victim's domain, broken down by stealer family. It is correlation rather than causation, but stolen credentials are a common initial access route.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

CSV Filter

Filter CSV rows online by column conditions — equals, contains, regex, empty, numeric ranges — combined with AND/OR. Keep or remove matches, fully in-browser.

Ransomware.live is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.