Ransomwhere.org aggregates data from multiple open-source intelligence feeds to provide a comprehensive view of the ransomware threat landscape. Here's how we do it.
Server-side jobs fetch data from 7 open-source feeds on a scheduled basis. API responses are cached to reduce load and improve performance.
Raw data is normalized into consistent formats — country codes mapped to names, timestamps unified, duplicates merged, and data gaps filled.
Data is served via Next.js ISR (Incremental Static Regeneration) with client-side SWR for live updates. Charts and maps render in real-time.
Open-source aggregator tracking 300+ ransomware groups' leak sites on Tor. Provides real-time victim data, group profiles, and historical records.
Open crowdsourced platform tracking Bitcoin payments to known ransomware wallets. Maintained by Jack Cable (CISA). Requires API key.
MalwareHunterTeam's service for identifying ransomware strains from ransom notes or encrypted file samples. Powers our identification tool concept.
Europol-led initiative providing free decryption tools for 180+ ransomware families. We maintain a curated list of available decryptors.
Community-driven threat intelligence sharing platform. ThreatFox provides Indicators of Compromise (IoCs), MalwareBazaar hosts malware samples.
RSS feeds from leading cybersecurity news outlets, filtered for ransomware-related content using keyword matching.
Platform for reporting and searching cryptocurrency addresses associated with fraud, ransomware, and scams.
Want to build on this data? Check out our API documentation.
View API Docs →