RansomLens · Rules for use
Terms of service
1. Operator and service
RansomLens is operated by David Günzel-Steinhoff. The address and further operator information are in the legal notice. For usage permissions, enquiries and complaints, contact hello@ransomlens.com.
These terms describe the use of the website, account functions, API and supplied data. RansomLens supports defensive IT security analysis of publicly accessible threat metadata. Leaked victim files are neither downloaded nor offered. New account registration is currently disabled.
2. Free service and permitted use
The services currently offered are free of charge. Introducing paid offerings in the future will not automatically create a payment obligation; a separate agreement would be required.
To the extent of the rights the operator can grant, data may be used for private, scientific and commercial purposes. This includes your own security analyses, internal evaluations and dashboards, scientific publications, consultancy and client reports. The third-party restrictions in section 4 and the remaining terms also apply.
External publications, presentations and client reports relying on RansomLens data must visibly identify “Source: RansomLens” and, where technically possible, link to https://ransomlens.com/. Existing source references and restrictions attached to individual information must not be removed or misleadingly altered. Attribution does not grant additional usage rights.
3. Redistribution and building other services
Without the operator's prior express permission in text form, such as email, data obtained through RansomLens must not be redistributed, sold or published as a raw dataset, or re-served through your own API, feed or comparable data access service. This also covers systematic subsets and repeated retrieval intended to reconstruct the collection.
The same permission is required to use RansomLens data to build or operate a similar or identical service accessible to third parties. This includes standalone ransomware or leak-site monitoring platforms, searchable victim or group databases, and corresponding data APIs and feeds. The restriction applies whether the resulting service is free or paid.
Your own analyses, limited supporting excerpts in publications and client reports permitted under section 2 do not constitute such raw redistribution if they do not substitute for the dataset or service. Purely internal tools for your own organisation remain permitted. Statutory usage rights and information lawfully obtained independently of RansomLens are not restricted by these terms. The operator does not claim ownership of third-party content.
Third-party licences take precedence: The restrictions in this section and the additional requirement to credit RansomLens in section 2 do not limit broader rights granted by applicable third-party licences to the relevant data components. In particular, rights to RansomLook components under CC BY 4.0 remain unaffected. No additional permission from RansomLens is required for those rights; licence conditions and attribution requirements must be met. This does not license our entire dataset under that licence.
4. Third-party content and rights
Some information comes from external sources and may be subject to their own terms or protected rights. RansomLens can only grant rights actually available to the operator. Public accessibility and free access do not mean unrestricted reuse is permitted.
The sources and licence notices explain provenance, processing and the conditions of key third-party sources. RansomLook publishes website content, API responses and datasets under CC BY 4.0, which permits commercial use subject to its conditions. Retain the associated source, licence and modification notices when reusing these components.
No commercial permission is currently granted by RansomLens for ThreatCluster components. Its terms permit redistribution of public feeds with attribution, but require a Business or MSSP agreement for embedding data in products or services you sell. Their scope for RansomLens's specific use has not yet been conclusively clarified. Rights granted directly to you by ThreatCluster remain unaffected. Attribution does not replace any agreement that may be required.
Ransomware.live is no longer queried as an active data source. To the extent historical data components or provenance records from that source remain, RansomLens still grants no commercial permission for them. Contact the operator before reuse if provenance or the scope of permission is unclear.
Permission to use RansomLens does not override third-party restrictions. Personal data, trademarks, text and images may only be processed within the applicable rights. Unconfirmed claims must not be presented as independently verified facts.
5. API and fair use
Observe the request and usage limits shown in your account, API documentation or API responses. Query according to actual need, avoid unnecessarily frequent repeats, and respect error, waiting and quota messages. Prefer locally cached results where compatible with your purpose and the applicable data rights. Undocumented access routes must not be used to bypass intended restrictions.
A usage allowance is shared by the relevant organisation or, for private use, the individual person, unless expressly agreed otherwise. It must not be multiplied through registrations using other email addresses, additional accounts or API keys, key replacement, fictitious identities, distributed requests or coordinated third-party use. Legitimate team use does not create an extra allowance. Request prior approval if you need more capacity.
Keep API keys and credentials confidential and protect them against unauthorised use. Do not publish them in websites, source-code repositories or shared datasets. Notify the operator of suspected misuse. A redistribution API requires permission even if it stays within the request allowance.
6. Prohibited use
Unlawful use, bypassing access controls or suspensions, attacks on the service, deliberate overloading, and using information for extortion, threats, harassment or other harmful activity are prohibited. Listing an organisation neither confirms a compromise nor authorises testing, access or contacting anyone in RansomLens's name. Publicly available information does not authorise access to leaked files.
7. Meaning, accuracy and completeness of information
Information is supplied in its current state of processing. No guarantee of accuracy, completeness, currency, absence of errors or suitability for a particular purpose is provided. Collection may be incomplete; attackers' statements and automated matches may be wrong. The absence of an entry does not prove that an incident did not occur.
RansomLens does not replace independent assessment, professional security advice or a contractually guaranteed monitoring system. Verify results against suitable independent information before making decisions with significant consequences. Mandatory statutory rights and liability under section 10 remain unaffected.
8. Changes, availability and discontinuation
No particular feature set, dataset, operating period, response time or availability is promised; there is no service-level agreement. Features, datasets, formats, interfaces and quotas may be changed, restricted or discontinued, particularly due to technical development, maintenance, security requirements, legal obligations, changed data sources or limited personnel and financial resources.
The entire free service may also be discontinued for such reasons. Significant planned restrictions or discontinuation will be announced in advance where possible and reasonable. Urgent security issues, legal requirements, outages or comparably important reasons may require measures at short notice or immediately. No fixed advance-notice period is promised; mandatory statutory information, termination and other rights remain unaffected.
The service is not a permanent archive for your own data. Keep your own copies of lawfully obtained results and working materials where consistent with these terms and third-party rights. Existing statutory rights to obtain or delete data are not restricted.
9. Restricting or ending access
Where there are concrete indications of misuse, exceeded quotas, circumvention, breaches of these terms or threats to safe operation, the operator may apply proportionate protective measures. These include request limits, temporary suspensions and revocation of API keys. Where compatible with the measure's purpose, affected users will be informed of the reason and given an opportunity to clarify or remedy the issue.
Serious or repeated breaches, or other good cause, may result in access being terminated. Immediate protective measures remain possible in urgent situations. Suspensions must not be bypassed using other accounts, identities or keys. Questions and objections may be sent to hello@ransomlens.com. You may stop using the service at any time and request account deletion through that address.
10. Liability
The operator is liable without limitation for intent and gross negligence, culpably caused injury to life, body or health, and other cases of mandatory statutory liability. This includes claims under the German Product Liability Act, expressly assumed guarantees within their scope, and mandatory data protection claims.
For a slightly negligent breach of an essential contractual obligation, liability is limited to foreseeable damage typical for the contract at its conclusion. Essential obligations are those enabling proper contractual performance and on whose fulfilment users may normally rely. Otherwise, liability for slight negligence is excluded to the extent permitted by law. These limitations also benefit legal representatives and persons used to perform contractual obligations. These provisions do not create a performance or availability guarantee.
11. Privacy, corrections and complaints
The privacy policy explains data processing and affected persons' rights. These terms do not replace data protection consent. Send reports of errors, rights infringements or disputed entries to hello@ransomlens.com, identifying the relevant RansomLens page. Do not send leaked files or credentials. The absence of an SLA does not exclude statutory review, information or response obligations.
12. Incorporation, amendments and governing law
Contractual obligations require these terms to be validly incorporated into the agreement. Publication alone or silence in response to amendments does not replace consent where required. Changes to existing usage agreements follow statutory requirements; express consent will be obtained where necessary. Revised versions are identified by date and version and do not apply retroactively merely because they are published.
The law of the Federal Republic of Germany applies. Consumers retain the protection of mandatory rules applicable under the law of their habitual residence in the absence of a choice of law. Statutory jurisdictions remain unchanged. The language version validly incorporated into the agreement applies; a translation does not restrict mandatory consumer rights. Invalid provisions, or provisions not incorporated into the agreement, are replaced by the applicable statutory rules.