Ransomware Command
Live leak-site aggregation via Ransomware.live · cached 0m agoTracked Groups
380
Recent Victims
100
Active Groups (recent)
19
Platform Ransomware IOCs
59K
🏴 Attributed Crews (0)
No crew attribution yet — run Ransomware Intel (or the Full Fusion pipeline).
🔑 Free Decryptors (0)
No decryptors loaded yet — run Ransomware Intel.
Ransomware Response Resources
↗ No More Ransom (decryptors) — Free decryptors + Crypto Sheriff ↗ ID Ransomware — Identify family from note/sample ↗ Ransomware.live — Groups, victims, negotiation notes (live API) ↗ Ransomwhere — Crowdsourced ransom payment tracking ↗ Emsisoft Decryptors — Free decryption tools ↗ Ransom note samples — ThreatLabz ransom-note corpus ↗ RansomLook — Leak-site + group tracking ↗ RansomFeed — Claims feed / statistics ↗ VX-Underground — Samples & threat-actor archives ↗ CISA #StopRansomware — Advisories + reportingAI Skills
Copy a prompt into your analysis:
🧠 Identify the ransomware family from a note or extension
🧠 Summarize a group's TTPs and known decryptors
🧠 Draft victim-notification + preservation steps
🧠 Map observed IOCs to ATT&CK techniques
Playbooks & Automation
Platform Ransomware Indicators (58,998)
| Indicator | Type | Actions |
|---|---|---|
trzobridg.zapier.app |
other | +Case · Pivot |
twu-hwt.org |
other | +Case · Pivot |
updatemycomcast.weebly.com |
other | +Case · Pivot |
www.knockknock.top |
other | +Case · Pivot |
xfinityloginconnect.weebly.com |
other | +Case · Pivot |
xfinityloginservice.weebly.com |
other | +Case · Pivot |
xfinitypageupdate.weebly.com |
other | +Case · Pivot |
preciosasjoyitas.com.mx |
other | +Case · Pivot |
bc1q6ex4wjfz2p8lqvz9x2n0ck6z9tsh2k8v9d0m0q |
bitcoin | +Case · Pivot |
3KHb1MDkgHRZmVGbHkT6QaHesJbqZjJqCA |
bitcoin | +Case · Pivot |
1DA11mPS9t2LnFdWjkK9kkyDLTBPQ8Vg2W |
bitcoin | +Case · Pivot |
3JVGkBmznbQXpQBLnAcuBB2eSJRUDpc5kU |
bitcoin | +Case · Pivot |
bc1qs8lqzrp82m4dh0d2n0v33dd6awpc3rpaf3l7xy |
bitcoin | +Case · Pivot |
1L8ybXjfM68tHfLh5vAT56pKAWy7iH2eyE |
bitcoin | +Case · Pivot |
https://www.ransomlook.io/group/crpx0 |
url | +Case · Pivot |
http://crpx0.su/ |
url | +Case · Pivot |
http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/redact |
url | +Case · Pivot |
http://ursba4dbibo27dtwtgy3l2pc3ekut7helebvmy7ny3b2s3mbzph4qdad.onion |
url | +Case · Pivot |
http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/sevyware |
url | +Case · Pivot |
http://sevykkkuzbxjpkb7gtfxnltn73bm6vaxglxh5xsd55trqqew3xpowwid.onion/index.php |
url | +Case · Pivot |
https://www.ransomlook.io/group/spy |
url | +Case · Pivot |
https://spycorp.pro/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/0day |
url | +Case · Pivot |
http://odaygplp3zhyx7zl45egetl6dzc4reduisnoyym34rjdmaryfaz5doqd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/settra |
url | +Case · Pivot |
http://pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onion/ |
url | +Case · Pivot |
http://c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onion/ |
url | +Case · Pivot |
http://ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onion/ |
url | +Case · Pivot |
http://26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onion/ |
url | +Case · Pivot |
http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/ulose |
url | +Case · Pivot |
https://www.ransomlook.io/group/icarus |
url | +Case · Pivot |
http://e6ujsppajgb756x7x5ykdryvlcjynltb52eiwi6pd4bfwo6hddd6neid.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/bavacai |
url | +Case · Pivot |
https://www.ransomlook.io/group/doommageddon |
url | +Case · Pivot |
http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/cmd |
url | +Case · Pivot |
https://cmdofficial.com/ |
url | +Case · Pivot |
http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/blackfile |
url | +Case · Pivot |
http://blacknbsxfdmjtx4yn533zzm4bemtdfl6dyopbmhg46ckhn4qy7i77id.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/triple |
url | +Case · Pivot |
http://6qqz6m3b6htudohg2mlf5gdcalonxy3sh5g4dix4mpyirjcgelqqufad.onion |
url | +Case · Pivot |
http://ojcmpbdncjo5dhaxxll44bq6to3kwqtoeraevgsjquhdtt4uv5l4igid.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/wallstreet |
url | +Case · Pivot |
http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/booba |
url | +Case · Pivot |
http://7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion/ |
url | +Case · Pivot |
http://7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion/leaks |
url | +Case · Pivot |
https://www.ransomlook.io/group/titan |
url | +Case · Pivot |
https://titanblog.org/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/deadlock |
url | +Case · Pivot |
https://www.ransomlook.io/group/mnt6 |
url | +Case · Pivot |
http://ttvbuilv5mf2wggfjgmvin22ndzghpukhsyy6coz3p4wt5nqnxah7tyd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/prinz |
url | +Case · Pivot |
http://prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion/ |
url | +Case · Pivot |
http://6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/hyflock |
url | +Case · Pivot |
http://e5hdifgit6ua7k4ggmltume7kbyryksdnlrkc55we33fnshgxfeqgsyd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/aurora |
url | +Case · Pivot |
https://exposedrecords.io/ |
url | +Case · Pivot |
http://pavregldzg2ypbd3gxbil2suxfok7ykmcknwhkli24anpks6lndymyyd.onion/ |
url | +Case · Pivot |
http://ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/leak |
url | +Case · Pivot |
https://www.ransomlook.io/group/timc |
url | +Case · Pivot |
http://rzzfiwoop67jrxadngcy7nvjm7suwtrjznview63ooowqfsm5sq7gmqd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/killada |
url | +Case · Pivot |
http://killada5556ahpb4cwmatv5qpzku2qmdlwawshtykpq37cvfva7zjhid.onion/ |
url | +Case · Pivot |
http://killada7qgdpvzpezjxaa64b47bz47hzbn6oql5aa4lppzzwymnukqqd.onion/ |
url | +Case · Pivot |
http://killadahaynpqrkppe2m2tgindbruaeiefzr7pm3cp47tzohhhnogwad.onion/ |
url | +Case · Pivot |
http://killadax36r6bbb3md67ekcfv5yasdlnoaklyag66ot4tefa32ywgnyd.onion/ |
url | +Case · Pivot |
http://killadaxczzw3wnuaxkygib67lk2qkgnki4gyjqoo76vh53egitoyaqd.onion/ |
url | +Case · Pivot |
http://killadaayyuzdshwskrnsvh5owzuwa4yj7gs2vbhkcjpfslrplfgwwqd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/audit |
url | +Case · Pivot |
http://cjg2avmzoly7k6mw7xobnyre354jxro4qegkoazhsmigdk2j3aziexyd.onion/ |
url | +Case · Pivot |
http://6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/threatmarket |
url | +Case · Pivot |
http://hi6bo2aihmuzkaj6gi6sigmut5bcwvguqpma3hwxsjfbqsccnchmybid.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/lamashtu |
url | +Case · Pivot |
http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion/api/posts?page=1&filter=all |
url | +Case · Pivot |
http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/alp-001 |
url | +Case · Pivot |
http://qthem3ogqqixjhhwacto6pqbjfy2vcykdlz7woulnewsrwy4lfjocfqd.onion/ |
url | +Case · Pivot |
http://b4riuxx7ypobdptctf6lyfcvgi6vn74iurzdh4kn2agbk7472dvywgyd.onion/index |
url | +Case · Pivot |
https://www.ransomlook.io/group/nblock |
url | +Case · Pivot |
http://nblockn6jjp3xxh2do4ckkcer7w54sube7jdqaq7ttfvucgz6nsi4fad.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/blackwater |
url | +Case · Pivot |
http://ejzl7cjxmkx7lzhiqwidmrwtfjv45pkczbc4fnyaut3t7gll3yaiq5id.onion/ |
url | +Case · Pivot |
http://6t5g73fbzdjuhvvovuvuhc4mdgefrwn75szssx4ftqzxyuacdij47pad.onion |
url | +Case · Pivot |
https://www.ransomlook.io/group/krybit |
url | +Case · Pivot |
http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/ |
url | +Case · Pivot |
http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/ |
url | +Case · Pivot |
http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/ |
url | +Case · Pivot |
http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/m3rx |
url | +Case · Pivot |
http://4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onion/ |
url | +Case · Pivot |
http://pippahtohg6qgioqu3ixrsueefuw7thythmmeanyrgwn3eixcuu6jvqd.onion/ |
url | +Case · Pivot |
https://www.ransomlook.io/group/netrunner |
url | +Case · Pivot |
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports