RansomLens · Data provenance
Sources & licences
RansomLens combines its own observations of public leak-site pages with supplementary sources. These notices apply to the attributed data components, not to the entire RansomLens dataset.
RansomLook · CC BY 4.0
Source: RansomLook. We use group and source-discovery information to identify public sites. Its official licence notice makes website content, API responses and datasets available under Creative Commons Attribution 4.0 International (CC BY 4.0). Sharing and adaptation, including commercial use, are permitted subject to that licence.
Changes by RansomLens include selection, filtering, name normalisation and combination with our own observations; internal source addresses are not published. This is not an unchanged reproduction of the original dataset. Attribution does not imply endorsement or approval of RansomLens by RansomLook.
ThreatCluster · public feeds and terms
Source: ThreatCluster. We use its public source directory for group, infrastructure and reachability information, selected and normalised by RansomLens. Its terms of service and feed documentation apply.
ThreatCluster permits public-feed redistribution with attribution and marks feeds TLP:CLEAR. Its terms require a Business or MSSP agreement for embedding data in products or services you sell. Their scope for our specific use has not yet been conclusively clarified; RansomLens grants no independent commercial permission for these components. TLP:CLEAR is not a copyright licence. Attribution does not replace any required agreement.
Additional internal source review: explicit mirror and relocation notices on known group pages provide address proposals for manual review. The “Ransomware Group Sites” and “Signpost” directories are initially checked for availability only; their lists are not imported until content and terms have been assessed. Technical availability does not establish reuse permission.
For an exclusively internal historical inventory comparison, we also read four public GitHub directories: marktsec/Ransomware_Official_Domains, fastfire/deepdarkCTI, BushidoUK/Awesome-Ransomware and joshhighet/ransomwatch. deepdarkCTI identifies its repository licence as GPL-3.0 and Ransomwatch as Unlicense; the other two did not identify a repository licence when retrieved. These are not blanket data licences or redistribution permissions. The lists are not published as datasets. New addresses enter existing source validation only after explicit manual approval with source evidence. Technical acceptance or manual approval does not grant additional rights to the original dataset. A list describing an address as “official” does not establish operator identity or availability.
Processing and reuse
Our own listing text, time information and screenshots are collected from public listing and detail pages. Supplementary company and domain information may come from GLEIF, RDAP, public DNS and Wikidata, subject to the respective source's rights and conditions. Manual corrections and reviewed AI suggestions are additional processing by RansomLens, not confirmation by a source provider.
When reusing RansomLook components, appropriately credit RansomLook and the source, link to CC BY 4.0 and indicate modifications. Preserve existing notices. Our own redistribution restrictions do not limit rights granted by that third-party licence; this does not place all RansomLens data under CC BY 4.0. Other rights, including privacy, personality and trademark rights, must still be respected.
A group or victim listing records a public claim; it does not independently confirm an attack. Leaked victim files are not downloaded or offered. Ransomware.live is no longer actively queried; historical provenance records confer no additional permission.
See the third-party rights section of our terms. Questions about provenance or reuse: hello@ransomlens.com.