Cryptocurrency addresses linked to payments for ransomware attacks
Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.
Cryptocurrencies have, in recent years, become a common method to transact ransom payments in such attacks. The ransomwhe.re site collects addresses (accounts) that are known to be linked to these payments.
|Entity count:||10,329 target entities · 10,329 searchable entities · 10,329 total|
|Publisher:||ransomwhe.re / Jack Cable non-official source|
|Source data:||api.ransomwhe.re (JSON)|
|Collections:||in Warrants and Criminal Entities · OpenSanctions Default|
Downloads contain the full set of entities contained in this dataset. You can fetch a simplified tabular form, or detailed, structured data in JSON format. Updated files will be provided once a day at the same location.
|File name||Export type||Size|
|FollowTheMoney entities||5 MB|
|Target names text file||1 kB|
|Senzing entity format||2 MB|
|Source data||5 MB|
|Targets as nested JSON||5 MB|
|Targets as simplified CSV||2 MB|
You can query the data in this dataset via the application programming interface (API) endpoints below. Please read the introduction for documentation and terms of service.
|Use the Reconciliation API in OpenRefine:|
|For full-text search, use the |
|For entity matching, use the |
The following targeted entities have been added to this data source most recently: