> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Actor Publications

> Search ransomware leak-site victims to see which organizations a ransomware group has named and published

Search ransomware leak-site victims to see which organizations ransomware groups have named and published. Use it to confirm whether a company, a supplier, or a peer in your sector has been posted on a group's data-leak blog, and which group claimed the attack.

### Search

This is a synchronous lookup. One `GET` to [`ransomware_victims_list`](https://client-api.leak.center/scalar-docs/#tag/ransomwatch/GET/service/ransomware_victims_list/) returns matching victims in the same response. Search by `company` name or by `domain`.

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/ransomware_victims_list/?company=Acme&take=10&skip=0&sort_by=DATE&sort_by_2=DESC" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

Search by domain instead, and narrow to a window with `start_date` / `end_date`:

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/ransomware_victims_list/?domain=acme.com&start_date=2026-01-01T00:00:00&end_date=2026-06-22T23:59:59" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

Results are paginated: pass `take` (page size, max 100) and `skip` (offset), and walk the offset forward against the `count` in the response.

### Request parameters

| Parameter          | Type     | Required | Notes                                                                                               |
| ------------------ | -------- | -------- | --------------------------------------------------------------------------------------------------- |
| `company`          | string   | No       | Company name to match against named victims (e.g. `Acme`).                                          |
| `domain`           | string   | No       | Victim domain to match (e.g. `acme.com`).                                                           |
| `targeted_region`  | string   | No       | Filter by the victim's region.                                                                      |
| `targeted_country` | string   | No       | Filter by the victim's country.                                                                     |
| `industry_type`    | string   | No       | Filter by the victim's industry.                                                                    |
| `start_date`       | datetime | No       | Lower bound on when the victim was discovered/posted (ISO 8601).                                    |
| `end_date`         | datetime | No       | Upper bound on when the victim was discovered/posted (ISO 8601).                                    |
| `take`             | integer  | No       | Page size, 1–100. Default `10`.                                                                     |
| `skip`             | integer  | No       | Number of rows to skip (offset). Default `0`.                                                       |
| `sort_by`          | enum     | No       | Sort field: `DATE`, `GROUP`, `REGION`, `COUNTRY`, `COMPANY`, `INDUSTRY`, or `NONE`. Default `NONE`. |
| `sort_by_2`        | enum     | No       | Sort direction: `ASC`, `DESC`, or `NONE`. Default `NONE`.                                           |

Rate limit: 10,000 requests per day. This source costs 0 credits per call.

### What comes back

The response is an object with a total `count` and a `rows` array, where each row is one ransomware-leak victim record.

* `count` — total number of victims matching your query, across all pages.
* `rows` — the page of victim records. Each record carries:
  * `id` — the victim record identifier.
  * `company` — the named organization.
  * `domain` — the victim's domain, when the group published one.
  * `groupname` — the ransomware group that claimed the victim.
  * `country` — the victim's country.
  * `region` — the victim's region.
  * `industry_type` — the victim's industry.
  * `description` — the group's posted description of the victim or the leak.
  * `discovered` — when the victim was first seen on the leak site.
  * `created_at` — when the record was first stored.
  * `updated_at` — when the record was last updated.

```json theme={"dark"}
{
  "count": 1,
  "rows": [
    {
      "id": "184273",
      "company": "Acme",
      "domain": "acme.com",
      "groupname": "examplelocker",
      "country": "United States",
      "region": "North America",
      "industry_type": "Manufacturing",
      "description": "Internal documents and customer records published on the group's leak site.",
      "discovered": "2026-05-14T09:21:00Z",
      "created_at": "2026-05-14T09:25:11Z",
      "updated_at": "2026-05-14T09:25:11Z"
    }
  ]
}
```

A hit here means the organization has already been named on a group's leak site, so treat it as a confirmed compromise, not a warning. Use `groupname` and `discovered` to attribute and time the incident, and run the same search on your key suppliers and partners to catch third-party exposure that lands in your supply chain.