Dataset and attribution

Ransomchats source record

Casualtek/Ransomchats collects real-world ransomware negotiations for public research and documents its approach to victim anonymization in the upstream repository.

Actor-lineage evidence and media record

Lineage is a curated reference layer, not a third primary corpus and not a replacement for either source dataset. Every alias, event, and relationship points to normalized source records with publisher, date, source type, access date, and reliability tier. Actor claims and technical overlaps are not silently promoted to authoritative attribution.

MITRE enrichment is kept separate from extortion.wiki's own claims. An ATT&CK software alias does not prove an actor identity, and only explicit mappings in data/mappings/mitre-actors.json may produce a group mapping.

Documentary media is locally archived only after source, rights, attribution, procedural wording, hash, and human-review checks pass. Approved records include official wanted posters, authentic seizure imagery, court-document previews, and advisory previews. Every displayed derivative links to its original publisher and states its evidence and publication-review status.

documentary-excerpt-reviewed is an editorial review workflow, not a claim that every government-hosted asset is public domain. It requires an original page and direct asset, access date, inclusion rationale, appropriately sized derivative, no misleading alteration, visible attribution, and review notes. Third-party credits, official insignia restrictions, and per-item publisher terms remain controlling.

When an actor or event has no approved documentary image, the site always uses the single local unknown-person.png silhouette. It is labeled as a neutral archive placeholder and is never presented as a real suspect, official photograph, historical evidence, or documentary source image.

ThreatLabz ransomware-notes source record

The ransomware notes originate from ThreatLabz/ransomware_notes. ThreatLabz is the upstream collector. extortion.wiki did not create or originally collect these files; it independently generates a static archive view from the commit-pinned local snapshot.

Ransomware notes form a separate corpus from the negotiation dataset. Note families and note files are not added to threat-actor, negotiation, or message totals, and negotiation records are not added to note statistics.

seized.fyi source and rights-review record

The seized.fyi About page explicitly offers the JSON database for download and describes the project as an attempt to archive every website seizure banner image or page created by government agencies. It also states that domain lists are not always complete and that takedowns without an image or unique page design are outside its scope.

No blanket media license was found. Local copies are preserved as reviewed documentary archive material; copyright, seal, trademark, and other rights remain with their respective owners and publishers. The review found no separate conventional terms, privacy, license, or robots document; those paths resolve to the application rather than distinct policies.

Records marked upstream as screenshots are treated as captures of HTML seizure pages. extortion.wiki never embeds or executes active upstream HTML. Animated images use static previews by default; video never autoplays; all ordinary display paths are local.

The collection is broader than ransomware and receives independent statistics. Records unrelated to extortion remain published without fake actor mappings. Category and actor enrichment is optional and requires an explicit reviewed mapping.

Attribution boundary

extortion.wiki does not claim authorship of the transcripts, ransomware notes, seizure banners, upstream parsers, indexes, redactions, or source collection. Cite the applicable upstream archive alongside the stable internal archive URL. Cross-links exist only when an explicit mapping records the relationship.

Archive processing

Ransomchats JSON is parsed and normalized for transcript presentation. ThreatLabz files are copied byte-for-byte into a local source snapshot, decoded into a separate presentation field, hashed with SHA-256, and normalized separately for search. seized.fyi JSON and media are snapshotted separately; byte signatures, upstream MIME declarations, local hashes, safe previews, domains, source URLs, and change status remain traceable. Original note or seizure-page content is never emitted as executable HTML.

The production build requires no runtime GitHub fetch. The methodology describes the static document and search boundaries.

Known limitations

Upstream collections vary in naming, dates, structure, and completeness. A source family label is not independent attribution. A cross-corpus alias is a navigation aid, not proof that similarly named operations share operators, infrastructure, or history. seized.fyi specifically warns that its associated-domain lists may be incomplete.

Preserved Ransomchats license notice

MIT License

Copyright (c) 2026 nonrecognition

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Preserved ThreatLabz license and copyright notice

The upstream license file is included in the versioned snapshot without alteration. Its copyright notice is Copyright (c) 2022 Zscaler ThreatLabz.

MIT License

Copyright (c) 2022 Zscaler ThreatLabz

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Revision information

Negotiation routes and statistics are recalculated from the validated Ransomchats data during production builds. Ransomware-note routes and statistics are generated from the commit-pinned ThreatLabz snapshot by scripts/sync-ransomware-notes.mjs. Seizure routes and statistics are generated from the local seized.fyi snapshot by scripts/sync-seized-fyi.mjs. Both synchronized collections are verified offline before rendering.