Ransomware.live

Ransomware.live tracks ransomware groups, victims, negotiations, payment demands, and recent cyberattacks.

ransomware.live
Ransomware.live homepage screenshot

About Ransomware.live

Ransomware.live is a web-based monitoring service that tracks ransomware groups and the victims they claim. It continuously monitors and scrapes ransomware group leak sites to identify newly published victim disclosures, and the main page lists the 100 most recent of these, attributed to groups as detected by the platform. The homepage shows the last 10 days of activity, with daily victim counts and breakdowns by the most active groups, the countries of victims and the sectors affected. Individual entries can carry markers such as whether a screenshot is available, whether infostealer data was found, whether the victim has denied the claim, whether a ransom amount or leak size is known, whether a duplicate claim was detected, and whether there is press coverage. The site is sponsored by Hudson Rock and asks visitors to donate to support continued tracking and new features; no pricing is stated.

Key features

  • Lists the 100 most recent victim disclosures attributed to ransomware groups
  • Shows daily victim counts for the last 10 days
  • Breaks activity down by top groups, victim countries and sectors
  • Marks entries with screenshot availability, infostealer data and denied claims
  • Flags known ransom amounts, known leak sizes and duplicate claims
  • Labels sectors such as healthcare, manufacturing, technology and government
Best for: Security researchers, analysts and incident responders who need a running view of ransomware group activity and newly claimed victims.
Good for
  • Aggregates leak-site victim disclosures into a single recent-victims list
  • Adds per-victim context such as infostealer data, denials and press coverage
  • Summarizes activity by group, country and sector over the last 10 days
Watch out for
  • The main victims page displays only the 100 most recent disclosures
  • No pricing information is stated; the site requests donations to continue its work
  • Listings are attributed as detected by the platform's own scraping, and victims may deny claims

Ransomware.live at a glance

Type
Website
Pricing
Not confirmed. Check the site
Platforms
Web
Open source
Not stated
Language
English
Last checked
Oct 5, 2026 · Online when checked
Listed
Oct 5, 2026

Ransomware.live alternatives

Tools and sites you could use instead, ranked by how closely they match.

All 24 alternatives

Popular in Security Research

Well-known listings from the same topic.

All 50

Ransomware.live FAQ

How does Ransomware.live collect its data?
It continuously monitors and scrapes ransomware group leak sites to identify and list newly published victims.
What does the recent victims list contain?
It displays the 100 most recent victim disclosures attributed to ransomware groups, as detected by Ransomware.live.
What do the icons next to a victim entry indicate?
They indicate items such as screenshot availability, the company website, infostealer data found, a victim denial, a known ransom amount, a known leak size, a duplicate claim and press coverage.
Is something wrong or out of date?

Tell us and an editor will check it.

Own this website?

Claim the listing and suggest updates yourself. An editor checks every claim first.

Claim this listing