---
title: "Recent ransomware victims"
method: GET
path: "/ransomware/feed"
tags: ["ransomware"]
---

# Recent ransomware victims

`GET /ransomware/feed`

The newest leak-site postings, from the Redis cache the sync jobs fill
(ransomware.live), normalised to one shape per victim: `group`, `victim`,
`country`, `sector`, `date`, `screenshot`, `permalink` (the last four
nullable). With `press=true` each victim also carries
`press{pressCount, topPressTitle, topPressUrl}`: the articles naming the
victim in their title, domain or victim field, and the newest of them —
never the rest of its group's press. The 200 body is a bare array. Costs
one request of the monthly quota.

## Query parameters

- `limit` integer
- `press` string

## Response `200`

Array of victims: `{group, victim, country, sector, date, screenshot, permalink, press?}`

- object[]

## Other responses

- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/ransomware/feed/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/0fa256b179f3?raw)