Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
Updated on August 17, 2026
By accessing or using the data provided by Ransomware.live ("the Data"), you agree to comply with and be bound by these Terms & Conditions ("T&C"). If you do not agree with any part of these T&C, you must refrain from using the Data.
"the Data" means all content made available by Ransomware.live, including but not limited to victim and group listings, negotiation transcripts, ransom notes, YARA rules, IoCs, KQL queries, statistics, and any other intelligence published on the platform or served via the API. Different categories of Data may be subject to additional restrictions noted on their respective pages; where no additional restriction is noted, the general Fair Usage and Permitted Use rules below apply.
Use the dedicated endpoint at api-pro.ransomware.live (free, and will remain free) with a personal token generated at my.ransomware.live.
The legacy api.ransomware.live remains online for compatibility purposes only. It will not evolve further and is subject to additional restrictions; see ransomware.live/api for details.
These Fair Usage rules apply to both commercial and non-commercial use:
These restrictions apply without prior written approval from the owner of Ransomware.live; exceptions may be granted at the owner's sole discretion.
The Data is freely available for non-commercial use. This includes personal research, academic purposes, cybersecurity awareness, open-source projects, and use by government and law-enforcement agencies. Users may utilize the Data without prior approval, provided that appropriate attribution is given to Ransomware.live and the Fair Usage rules in Section 4 are respected.
Commercial use of the Data is strictly prohibited without prior written approval from the owner of Ransomware.live. Commercial use includes, but is not limited to:
Entities or individuals wishing to use the Data for commercial purposes must request explicit authorization from the owner of Ransomware.live by contacting the Ransomware.live team. Approval is granted at the sole discretion of the owner.
Ransomware.live must be clearly named as the source, linking back to ransomware.live, on any page, dashboard, or interface where this data is displayed, and in any report, publication, or deliverable making use of our intelligence. The recommended citation is:
"Source: Ransomware.live"
This service is provided as-is, with no service level agreement and no guarantee of accuracy, completeness, or availability. Data should be independently verified before use in critical decisions. Inclusion of any entity, group, or incident in the Data does not constitute a determination or confirmation by Ransomware.live that a claimed event occurred as described.
Ransomware.live is an independent personal project, not a commercial product. It may be modified, suspended, or discontinued at any time, without prior notice.
Requests to correct, remove, or dispute the inclusion of specific entries should be submitted via the contact channel in Section 11 and should identify the entry in question and the basis for the request. Requests are reviewed on a case-by-case, without-prejudice basis and at the owner's discretion; submission of a request does not obligate removal, and review timelines are not guaranteed given the No SLA provision in Section 7.
Ransomware.live reserves the right to suspend or revoke API tokens and access, without prior notice, for any use that violates these T&C, including breaches of the Fair Usage rules in Section 4 or unauthorized commercial use under Section 5.2.
You agree to indemnify and hold harmless Ransomware.live and its owner from any claims, damages, or liabilities arising from your use of the Data, including any downstream product, service, or decision built upon it.
These T&C are governed by French law. Any dispute arising from or relating to these T&C or the use of the Data shall be subject to the exclusive jurisdiction of the competent French courts, without prejudice to any applicable source-protection framework, including Loi n° 2022-401 du 21 mars 2022 ("Loi Waserman"), which may apply to the platform's data collection methodology and sources.
Ransomware.live reserves the right to update or modify these T&C at any time. Continued use of the Data constitutes acceptance of the latest version of these T&C.
For any inquiries regarding the use of the Data, please contact:
https://ransomware.live/contact
If you'd like to support the project's upkeep, coffees are always welcome: https://buymeacoffee.com/ransomwarelive. This is entirely optional, never a requirement for access.
By using the data under these conditions, you acknowledge and accept them.