Does Ransomfeed give me the leaked files?

No. It reads the leak site's index and listing pages only. Archives, torrents and download links are never followed, and those links are stripped from what we store.

Does a listing mean the victim was breached?

It means a group says so. A listing is the group's claim about a named organisation, recorded as the group published it; we do not confirm it, and the record never presents it as confirmed.

Which groups do you cover?

The groups whose sites we collect from are the values of the group filter in the API reference, so the list you can filter on is exactly the list we read. It is not every group: leak sites appear and go dark, and a site is added when a collector for it is written.

How do I filter by country reliably?

Use victim_country_code, the ISO two-letter code we derive from the site's own wording. victim_country is that wording as published and has to match it exactly.

MODULE 10 · Ransomware Leak SitesEarly access

Has a ransomware group named you, your clients or your suppliers, and what did it say?

Ransomware and extortion groups announce their victims on leak sites, most of them on Tor. Ransomfeed reads those sites and turns each listing into a structured record: the group, the victim with its domain, country and sector as the site gives them, the deadline, the claimed data size, a screenshot of the page and every later edit kept as a version. It never downloads the stolen data.

Start free evaluation Ask for a Proof of Concept

01Capabilities

What Ransomfeed sees

Every edit is a version

When a group rewrites a post, moves a deadline or adds a line about published data, the change is captured as a new version rather than written over the old one. The listing you read today still carries what it said the day it went up.

Victims, groups and listings, kept apart

A victim named by two groups is one victim, matched on name and domain, so "has this organisation been named before" is a single query. Groups carry their aliases and the contact their site advertises; listings carry the post itself, with the group's publication date and the date we first saw it.

Delisting, on the record

When a listing drops off a group's index, the time is stamped. What a delisting means is something no leak site tells anyone, so the record says that it happened and never what it implies.

A screenshot, never the files

Each listing page is rendered to a screenshot you can open from the result. Links to the stolen material are stripped from what we store: Ransomfeed reads the index and the listing, and never follows an archive, a torrent or a download link.

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/ransomfeed/search

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/ransomfeed/search\
?victim_country_code=DE&published_from=2026-09-01&size=20"

RESPONSE · 200

{
  "total": 1,
  "page": 1,
  "size": 20,
  "results": [
    {
      "id": 90412,
      "group": "••••",
      "victim": {
        "name": "••••",
        "domain": "••••",
        "country": "Germany",
        "country_code": "DE",
        "sector": "Logistics"
      },
      "title": "••••",
      "status": "••••",
      "deadline": "7 days",
      "data_size": "420 GB",
      "published_at": "2026-10-02T06:10:00Z",
      "first_seen_at": "2026-10-02T08:45:31Z",
      "delisted_at": null,
      "versions": 2,
      "screenshot_url": "https://••••"
    }
  ]
}

Group, victim and link values are redacted in this sample. versions above 1 means the group edited the post; GET /api/ransomfeed/listings/{id}/versions returns every captured version. The group filter takes the groups we collect from, listed in the API reference; sector, status and country are the site's own wording, while victim_country_code is the normalised ISO code. screenshot_url is a signed link that expires.

Early access

Ransomfeed is live and in no plan yet. It is open in the free self-serve evaluation and in a Proof of Concept with us, where its API and your own AI over MCP come with it.

Ask for a Proof of Concept

Full API reference ships with your workspace: every endpoint, versioned.

03In practice

A supplier on a leak site

Day 1

A group names a logistics firm on its leak site: a seven-day deadline and a claimed 420 GB.

Day 2

Checking your supplier list, an analyst finds the listing with the group, the firm's domain, the deadline and a screenshot of the page.

Day 5

The group edits the post and the deadline moves. The first version stays on the record beside the new one.

Day 9

The listing disappears from the group's index. Ransomfeed stamps the date and says nothing about why.

Questions

Ransomfeed, honestly answered

Keep exploring

The other windows

Platform overview

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

Start free evaluation Explore the platform

Want the API, your own AI over MCP, or a Proof of Concept run with us? Request a demo

NDA-friendly briefings · global coverage · no slideware