Skip to main content
Ransomware groups name the organizations they claim on their leak sites. Threat Actor Publications indexes those posts as victim records: the company, its domain when one is known, the group that posted it, the victim’s country, region and industry, and when the post was discovered. Search by company or domain to check an organization, a supplier or a peer. Every organization searches the same records. One GET returns the matches in the same response. In the API reference this source is the Ransomwatch tag, and a domain quick search reports it as Cyber Intel. To be alerted when a new victim matches, create a monitor on the Ransomware source.

​
Availability and cost

Availability: Ransomware Threat Actor Monitoring. Plans and quotas lists what each plan includes. Cost: no metered allowance. As with every call made with an API key, each call that returns 2xx counts once against your monthly API Calls allowance. See Rate limits. Without the feature, or when your license is not active, every endpoint on this page returns 403:
No call on this page draws a metered allowance. A 429 comes from the per-second rate limit, the API Calls allowance or the source’s own per-minute cap. Errors explains each body.

​
Source per-minute cap

The source caps traffic per endpoint per minute across all DarknetSearch callers, not per organization: 60 for the victim search, each lookup and each statistic, 20 for victim reads, 2 for CSV exports. A 429 with {"error": "Rate limit exceeded: 2 per 1 minute"} can occur even after a few calls of your own. Wait a minute and retry.

​
Search victims

ransomware_victims_list returns one page of matching victims and the total count.
Search by domain and narrow to a date window:
  • Filters combine with AND. Send none to list every victim.
  • Dates count whole UTC days. Both dates are cut to midnight UTC of their day, so end_date excludes victims discovered later that day. The example above covers 1 January to 30 September 2026.
  • Newest first by default. Results are ordered by discovered, newest first. To sort another way, send both sort_by and sort_by_2. If either is NONE, the default order applies.
  • There is no group filter. Sort by GROUP to cluster victims by the group that posted them. For victim counts per group, see Read index statistics.
  • Page with skip. Raise skip by take until it reaches count.

​
What comes back

  • count — victims matching your filters, across all pages.
  • rows — this page of victims. Each carries:
    • id — the victim record’s ID, as a string. Use it to read one victim.
    • company — the name the group posted.
    • domain — the victim’s domain, or null.
    • groupname — the ransomware group that posted the victim.
    • country, region, industry_type — where the victim is and what it does, or null.
    • description — a summary of the post, or null.
    • discovered — when the post was discovered on the leak site.
    • created_at, updated_at — when the record was stored and last changed.

​
Read one victim

ransomware_victim_detail/{victim_id} returns one victim with the same fields as a list row. Pass the row’s id as digits.
An unknown ID returns 404 with {"detail": "Victim not found"}.

​
Find filter values

Three lookups return the values stored in the records, each with its victim count:
Each returns the 20 most frequent values, most frequent first. Send q with any value, for example q=all, to get every value instead. That list is unsorted, and q does not filter it.

​
Read index statistics

ransomware_group_attacks counts victims per ransomware group. It returns groupname and count for the 10 groups with the most victims, most first. As with the lookups, send q with any value to get every group instead, unsorted.
Seven more calls describe the whole index. They take no parameters.

​
Export the list as CSV

ransomware_victims_csv_export returns every matching victim as one file, exported_victims.csv.
  • It takes the same filters as the search, plus sort_by. It has no take, skip or sort_by_2.
  • The dates filter on created_at here, when the record was stored, not on discovered.
  • sort_by always sorts descending. DATE sorts by created_at.
  • The columns are id, company, groupname, domain, country, industry_type, region, discovered, description, created_at and updated_at.
  • When nothing matches, the file is empty, with no header row.
For JSON or XLSX, create the export through the export service with the RansomWatchVictim catalog entry. Its arguments use camelCase names: company, domain, targetedCountry, targetedRegion, industryType, startDate, endDate and sort_by.

​
Errors

​
Endpoints