Ransomware groups
Every known group with its victim total (ransomware.live, cached by the sync job), sorted by victim count descending, or with sort=activity by claims posted on its leak site in the last 30 days. When the claim history is cached, each group also carries claims30d, claimsPrev30d (the 30 days before), lastClaimAt and firstClaimAt (RFC 3339, null without a dated claim), and activity gives the window: {computedAt, dataAt, windowDays, windowClaims, previousWindowClaims, activeGroups} (null otherwise). Duplicate postings of one victim on one day count once. total is the number of groups known, limit the effective page size. Costs one request of the monthly quota.
Query parameters
Number of groups, 1–500 (default 100; 0 means the default).
victims (default): by all-time victim count. activity: by claims in the last 30 days, then the latest claim.
Response
{"groups": [{"name", "victimCount", "claims30d", "claimsPrev30d", "lastClaimAt", "firstClaimAt"}], "total", "limit", "activity"}