RansomWatch
Ransomware leak-site monitoring pointed at the Nordics — new DK/NO/SE victims land in Discord as they are posted, with worldwide stats on top.
Threat intel
live
The ransomware.live feed carries the whole world; most of it is noise if you only care about one region. RansomWatch ingests that feed into MySQL hourly, posts a threat-advisory card to Discord the moment a victim in Denmark, Norway or Sweden appears, and rolls the global picture — actor rankings, targeted countries — into weekly and monthly digests. It can backfill roughly 30k disclosures since 2020, runs with no Composer or npm, and only screenshots hosts that are already public. PHP 8.1+, Docker or bare metal, MIT licensed.
ransomware
leak-sites
threat-intelligence
nordics
discord
php