RansomWatch | by Zander Work


by Zander Work


Build Image Docker Hub Publish Docker Hub Image

RansomWatch is a ransomware leak site monitoring tool. It will scrape all of the entries on various ransomware leak sites, store the data in a SQLite database, and send notifications via Slack or Discord when a new victim shows up, or when a victim is removed.


In config_vol/, please copy config.sample.yaml to config.yaml, and add the following:

  • Leak site URLs. I decided not to make this list public in order to prevent them from gaining even more noteriety, so if you have them, add them in. If not, this tool isn't for you.
    • To get the Hive API onion, load their main site and press F12 to use the developer tools. Look for XHR requests, you should see a few to a hiveapi... onion domain.
  • Notification destinations. RansomWatch currently supports notifying via.the following:
    • Slack: Follow these instructions to add a new app to your Slack workspace and add the webhook URL to the config.
    • Discord: Follow these instructions to add a new app to your Discord server and add the webhook URL to the config.
    • Teams: Follow these instructions to add a new app to your Teams channel and add the webhook URL to the config.

Additionally, there are a few environment variables you may need to set:

  • RW_DB_PATH: Path for the SQLite database to use
  • RW_CONFIG_PATH: Path to the config.yaml file

These are both set in the provided docker-compose.yml.


This is intended to be run in Docker via a cronjob on whatever increment you decide to use.

First, build the container: docker-compose build app

Then, add it to your crontab. Example crontab entry (running every 8 hours):

0 */8 * * * cd /path/to/ransomwatch && docker-compose up --abort-on-container-exit

If you'd prefer, you can use the image published on Docker Hub (captaingeech/ransomwatch) instead, with a docker-compose.yml that looks something like this:

version: "3"

    image: captaingeech/ransomwatch:latest
      - proxy
      - ./db_vol:/db
      - ./config_vol:/config
      RW_DB_PATH: /db/ransomwatch.db
      RW_CONFIG_PATH: /config/config.yaml

    image: captaingeech/tor-proxy:latest

This can also be run via the command line, but that requires you to have your own Tor proxy (with the control service) running. Example execution:

$ RW_DB_PATH=./db_vol/ransomwatch.db RW_CONFIG_PATH=./config_vol/config.yaml python3 src/ransomwatch.py

Example Slack Messages

Slack notification for new victim

Slack notification for removed victim

Slack notification for site down

Slack notification for an error

The messages sent to Discord and Teams are very similar in style, identical in content.

Leak Site Implementations

The following leak sites are supported:

  •  Conti
  •  Sodinokibi/REvil
  •  Pysa
  •  Avaddon
  •  DarkSide
  •  CL0P
  •  Nefilim
  •  Mount Locker
  •  Suncrypt
  •  Everest
  •  Ragnarok
  •  Ragnar_Locker
  •  Pay2Key
  •  Cuba
  •  RansomEXX
  •  Pay2Key
  •  Ranzy Locker
  •  Astro Team
  •  BlackMatter
  •  Arvin
  •  El_Cometa
  •  Lorenz
  •  Xing
  •  Lockbit
  •  AvosLocker
  •  LV
  •  Marketo
  •  Lockdata

If there are other leak sites you want implemented, feel free to open a PR or DM me on Twitter, @captainGeech42

About the Author:

Zander Work

The article was originally published at: https://github.com/captainGeech42/ransomwatch

December 18, 2021
Notify of

1 Comment
Oldest Most Voted
Inline Feedbacks
View all comments
Isaac Begum
1 year ago

very interested

© HAKIN9 MEDIA SP. Z O.O. SP. K. 2013