Mission Domains

🔒 Ransomware

Mission domain · code ransom

Catalog sources

5 no-auth

Disciplines

mapped

Data points

covered

Skills

run →

automation

🔧 Workbench 📈 Native dashboard All sources → AI Skills Playbooks Copilot brief Report

Intelligence Disciplines

CRYPTINT (4) DARKINT (1) ACTORINT (1) FININT (1) MALINT (1)

Data Points

crypto_address (4) crypto_tx (3) onion (1) malware_family (1) hash (1) yara_rule (1)

Sources for this domain (6)

Name	Category	Auth	Format
mempool.space / Blockchain.com On-chain transaction & address analytics.	CRYPTINT	NONE	`json`	home↗ api↗
Ransomwatch Leak Sites Ransomware leak-site post tracker.	Dark Web	NONE	`json`	home↗ api↗
Ransomwhere Crowdsourced ransomware payment tracking.	Ransom Payments	NONE	`json`	home↗ api↗
Ransomwhere export Crowd-sourced ransomware payment wallets + family attribution.	Ransom Payments	NONE	`json`	home↗ api↗
Ransomwhere payments Crowdsourced ransomware payment address tracking.	Ransom Payments	NONE	`json`	home↗ api↗
Malpedia Curated malware family encyclopedia.	MALINT	KEY	`json`	home↗ api↗

🔍 Lookup

📊 Pre-built Queries · Ransomware

Sources in this domain No-auth feeds only High-severity indicators Recent additions Sanctioned entities Open cases

🔄 Live Datasets & APIs (5 key-free · ingestible)

Dataset / API	Format	Endpoint
mempool.space / Blockchain.com	`json`	https://mempool.space/api/	collect
Ransomwatch Leak Sites	`json`	https://raw.githubusercontent.com/joshhighet/ransomwatch/mai	collect
Ransomwhere	`json`	https://api.ransomwhe.re/export	collect
Ransomwhere export	`json`	https://api.ransomwhe.re/export	collect
Ransomwhere payments	`json`	https://api.ransomwhe.re/export	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — Ransomware operations

Direction — frame the requirement for Ransomware: what decision does this support, by when?
Collection — collect from the 6 mapped domain sources and enabled feeds; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🔗 Pivots

Sources →Country risk →Threat feed →Cases →Campaigns →

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Integrations →

🔄 Data Feeds & Datasets

Feed	Category	Format	Status
FireHOL: ransomware_rw.netset	IP Blocklists	`text`	enabled
FireHOL: ransomware_rw.ipset	IP Blocklists	`text`	off
Ransomware.live recentvictims	Ransomware	`json`	off
Maltrail ransomware	Ransomware	`text`	off
MISP Galaxy Ransomware	Ransomware Actors	`json`	off
Ransomware.live recent victims	Ransomware	`json`	off
Ransomware.live groups	Ransomware Actors	`json`	off
Ransomware Abuse Domains	Ransomware	`text`	off
Ransomwhere	Ransomware	`json`	off

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook