Extortion activity and victim disclosures across active groups.
Data source: RansomLook API (`/api/posts?days=1`, fetched 2026-07-19 00:06 UTC+8). The API returns only three fields — group / victim / discovered — so sector and geo are analyst inferences.
Data source: RansomLook `/api/posts?days=1` (this batch returned items discovered 2026-07-15; upstream runs 2–3 days behind)
Data source: RansomLook `/api/posts?days=1` (this run returned **successfully**, covering all of 2026-07-15 UTC)
⚠️ The RansomLook API (`/api/posts?days=1`) and its RSS feed were both unreachable from the runner today (sandbox network restrictions; 403 tunnel). This page is compiled from public reporting rather than a structured RansomLook pull; per-victim detail will be backfilled once access is restored.
⚠️ Data source note: today both RansomLook `/api/posts?days=1` and its RSS feed were unreachable from the runtime environment (sandbox network restrictions; curl returned empty). What follows is a **roundup based on public reporting**, not RansomLook structured per-item data; the per-victim table will be backfilled once the API recovers.
Data source: RansomLook `/api/posts?days=1`. The API returned a window of **Jul 10 → Jul 11** (roughly one day behind the current date; recorded as actually returned).
Source: RansomLook Recent Posts API (`?days=1`) · Window approx. the past 24–48h (covering new disclosures from Jul 10 – Jul 11)
⚠️ Data source note: in this run the RansomLook API (`/api/posts?days=1`) was unreachable from the sandbox (network restricted, empty response); the RSS fallback did not yield real-time entries either. Below is a **degraded view based on public reporting**, not a real-time leak-site pull.
⚠️ Data source note: in this run the RansomLook API (`/api/posts?days=1`) was unreachable (sandbox egress blocked, curl exit 56), and the RSS fallback did not yield per-post data either. The tables below are an **aggregate picture** based on public reporting, not same-day real-time victim details. Per-item details will be backfilled once the API recovers.
⚠️ RansomLook `api/posts?days=1` and RSS were both unreachable from the sandbox in this run (Tunnel 403). Data on this page comes from public threat-intel / breach aggregation (WebSearch) and represents **disclosure claims, not independent verification**. The usual poisoning/exaggeration risks apply; cross-validate victim notification status and actual leak evidence.
Data source: RansomLook `api/posts?days=1`. Pulled 9 posts today; `discovered` timestamps cluster in 2026-07-03 ~ 07-04 (nothing newer on RansomLook's side in the past 24–48h; the feed lags, recorded as actually returned).
⚠️ **Data source degradation notice**: Today RansomLook `/api/posts?days=1` returned **HTTP 403 (tunnel forbidden)** from the sandbox egress, so structured API data could not be retrieved. This page is instead assembled from **open-source disclosure reporting** (WebSearch results from public mirrors such as Ransomware.live / Breachsense), covering new disclosures on Jul 3–4; field completeness is lower than the API. **Re-verify against the ransomlook.io website the next day.**
Data source: RansomLook `/api/posts?days=1` (new posts in the past 24h)
Data source: RansomLook Recent Posts API (`?days=1`). Window: the past 24h.
⚠️ RansomLook `api/posts?days=1` returned an empty body from the sandbox (a fourth consecutive day with no new API data; sandbox network access is restricted). The data below was cross-checked against open reporting from **ransomware.live** and is centred on items **discovered/published 2026-06-30**.
RansomLook logged 6 new posts across 5 groups (play, safepay and others); the days=1 API feed has been stalled at 06-28 for a third day, so these figures are a lower bound.
ℹ️ Data source: RansomLook `api/posts?days=1`. The feed **did not advance** this run, returning exactly the same 6 posts as 06-29, with the latest `discovered` still at **2026-06-28T12:52Z**. Treat this as **no new data today** (feed stalled).
ℹ️ Data source: RansomLook `api/posts?days=1`. The feed **has advanced** this run, with the latest `discovered` at **2026-06-28T12:52Z** (the stall at 06-26 seen in the previous two editions has cleared). A relatively quiet day within the window.
ℹ️ Data source: RansomLook `api/posts?days=1`. The latest `discovered` value returned by this pull is **2026-06-26T15:57Z**; the feed has not advanced to 06-27/06-28 (the public RansomLook endpoint often runs 1-2 days behind). The tables below therefore overlap heavily with the 06-27 edition and should be **treated as a continuation of the same batch of leak-site posts**, with limited new signal.
Data source: RansomLook `/api/posts?days=1` (24h window, latest entry 2026-06-26T15:57)
Data source: RansomLook `/api/posts?days=1`. ⚠️ This run returned the same window as 2026-06-25 (latest post timestamp 2026-06-25T00:22, no newer posts). The tables below overlap with yesterday's and are retained only for a complete archive.
Source: RansomLook `api/posts?days=1` (new leak-site posts over the past 24h). Watchlist hits are pinned and highlighted at the top.
Source: RansomLook `api/posts?days=1` (new leak-site posts over the past 24h). Watchlist hits are pinned and highlighted at the top.
Data source: RansomLook `/api/posts?days=1` (public endpoint, direct connection succeeded).
Data source: RansomLook `/api/posts?days=1` (public endpoint, direct connection succeeded). Window covers the past ~24h (discovered 2026-06-20 → 2026-06-21).
Data source: RansomLook `/api/posts?days=1` (public endpoint). Window covers the past ~24h (discovered 2026-06-18 → 2026-06-19).
Data source: RansomLook `/api/posts?days=1` (public endpoint). Window covers the past ~24h (discovered 2026-06-18 → 2026-06-19).
Data window: RansomLook `/api/posts?days=1`, actually covering **2026-06-17T20:46 → 2026-06-18T14:45 UTC** (real-time clock lags the report date; roughly an 18-hour window). The API returns only `group_name / post_title / discovered`, with no sector/geo fields — sector/geography is inferred manually from victim names.
Data source: RansomLook `?days=1`. Note: the real-time clock lags the 06-18 report date, so this API call still returned the **06-16 08:39 → 06-17 03:46 UTC** window (overlapping the 2026-06-17 report). Some victim titles are redacted server-side; sector/geo must be inferred manually.
Data source: RansomLook `?days=1` (roughly the past 24 hours, 2026-06-16 08:39 → 2026-06-17 03:46 UTC). This issue's API returned victim titles (some redacted server-side); sector/geo must be inferred manually.