Build-time ingestion

The ransomware-notes synchronization script reads every upstream family directory from a pinned Git checkout, rejects unsafe paths and symlinks, enforces a file-size limit, detects supported text and markup formats, preserves original bytes in a local snapshot, records the source commit and URLs, calculates SHA-256 hashes, and emits both a typed JSON dataset and a validation report. Unsupported, empty, malformed, oversized, and invalid-encoding inputs are reported rather than silently discarded.

The site reads the source index during the static build. Zod validates index entries, conversation containers, and each message. Source paths are resolved below the dataset root; unsafe paths are rejected. Source files are never rewritten.

Lineage actors, aliases, relationships, events, source records, and explicit MITRE mappings are stored as versioned local JSON. The optional MITRE synchronization script reads a pinned ATT&CK release and writes a local subset; production builds never fetch MITRE or another intelligence service at runtime.

A conversation needs a usable identifier and at least one valid message. Malformed or empty messages are excluded from message totals and reported during the build; conversations with no valid messages are excluded. The archive does not guess missing content. Guessing is already well represented elsewhere on the internet. This snapshot reported 34 normalization issues.

seized.fyi synchronization

scripts/sync-seized-fyi.mjs downloads the structured banners.json file, preserves its exact bytes, validates every array item independently, processes every valid record without a topic filter, downloads each supported media asset, detects its byte-signature MIME, calculates SHA-256, and creates a fixed local WebP preview. The current snapshot accounts for 276 records and 6,788 associated domains.

Upstream-supplied names, filenames, MIME declarations, dimensions, article URLs, first-seen timestamps, domains, and media flags remain separately labeled. The display date is the date portion of the preserved first-seen timestamp; a missing display title is derived from the first domain and marked with that basis. Detected MIME, hashes, previews, publisher labels, category mappings, and cross-links are local derivations.

Synchronization compares stable upstream IDs, metadata fingerprints, and content hashes with the prior snapshot. New, changed, unchanged, removed-upstream, malformed, media-download-failed, and metadata-only results are written to a machine-readable report and human-readable changelog. Disappeared upstream records are retained historically rather than deleted.

Seizure taxonomy

The upstream JSON supplies names, filenames, MIME declarations, dimensions, article URLs, first-seen timestamps, domains, and screenshot/video flags. It does not supply a category taxonomy. extortion.wiki therefore stores category as unknown unless an explicit evidence-backed mapping exists; it does not classify records through title keywords or a ransomware allowlist.

Seizure source enrichment

Article URLs remain upstream-derived metadata. An agency name is added only when an upstream article URL uses a reviewed authoritative publisher host such as justice.gov or europol.europa.eu. This identifies the source publisher; it does not infer sole operational responsibility. Actor and lineage links require a separate explicit mapping with source IDs and a written rationale.

Affected-domain handling

Every unique upstream domain value is retained as raw text alongside a normalized lowercase search value; repeated values within one record are represented once using their first upstream occurrence. Domains, subdomains, internationalized values, malformed historical text, and onion addresses are escaped and never made active. Large lists expose only the first 100 values in initial HTML; remaining values load from a same-origin static JSON export on request. Each record also has static TXT, JSON, and CSV downloads; TXT and JSON retain exact raw values, while CSV neutralizes spreadsheet-formula prefixes.

Normalization policy

  • Actor names and conversation identifiers are retained for display.
  • URL slugs are deterministic, lowercase, and collision-safe.
  • Message sequence follows source-array order.
  • Message wording is retained. At render time, presentation-only whitespace is normalized: single source line wraps become spaces and blank lines remain paragraph boundaries.
  • Ransomware-note source filenames, relative paths, bytes, hashes, encodings, and commit-pinned URLs are recorded separately.
  • Note search normalization produces a derived plain-text field; it never replaces the raw archived content.
  • Cross-corpus links use a small explicit alias map rather than opportunistic string equality.
  • Lineage mappings use explicit actor IDs. Malware names, vendor names, and group names remain distinct unless a cited mapping establishes the relationship.
  • Locations written inside transcripts remain inert plain text.
  • Only source URLs matching the Casualtek/Ransomchats raw GitHub path are linked.

Lineage evidence model

Every published alias, timeline event, and relationship references one or more normalized source records. Each relationship retains a specific type, direction, status, evidence summary, and confidence level. Government and law-enforcement material is distinguished from MITRE, vendor research, journalism, actor claims, and unverified reports through source type and reliability tier.

Confirmed means explicit authoritative attribution or multiple strong independent sources. High, moderate, low, disputed, and unknown records preserve the uncertainty in their source wording. Similar malware, language, infrastructure style, negotiations, or affiliates are not sufficient by themselves to establish common operators, rebranding, or succession.

Dates and chronology

Many records have blank timestamps or use inconsistent timestamp formats. Listing dates are inferred only from valid eight-digit dates in filenames or chat identifiers. They describe the source record label, not necessarily the first message, compromise date, publication date, or payment date. Records without a defensible label date remain marked “Date not recorded.”

Lineage events separately record date precision. A source-supported year, month, quarter, or approximate period is displayed at that precision; it is never expanded into an invented exact date. Equal-date events sort by stable event identifier.

Search construction

Pagefind constructs a static full-text index after Astro renders the site. Negotiation pages use the negotiation corpus tag; ransomware-note pages use ransomware-note; seizure records use seizure-banner with title, date, year, domains, detected media type, category, official publisher, archive ID, and local status. Lineage and research pages use reference. Global search spans all collections; dedicated searches pin one corpus. Search executes locally in the browser.

Document safety

Astro renders negotiation and ransomware-note content as escaped text. HTML and HTA notes are shown only as source inside a selectable preformatted viewer. seized.fyi records marked as HTML-page screenshots use only local inert captures; no active upstream HTML, scripts, forms, event handlers, styles, frames, fonts, or remote resources are embedded. Video has controls and never autoplays; GIF records use a static preview until the original is explicitly opened.

Documentary media review

Actor media is supplementary evidence. Production records require a traceable original page and direct asset, publisher, caption, alt text, access date, evidence status, publication-review status, visible attribution, SHA-256 hash, local archival original, appropriately sized raster derivative, and human approval. Human photographs additionally require an authoritative source that explicitly identifies the person and supports the displayed procedural status.

The documentary-excerpt-reviewed status permits a restrained preview of the official record being discussed when an explicit reusable license is absent. It requires an inclusion rationale, low-resolution or appropriately sized derivative, no misleading alteration, review notes, and visible source context. This is an editorial rights review, not a claim that every government-hosted asset is public domain; third-party image credits, seals, and per-item restrictions are checked separately.

Remote hotlinks, search-engine thumbnails, AI-generated images, untraceable sources, unreviewed files, unsafe active formats, fabricated seizure banners, unsupported human identification, and captions that overstate an allegation or charge fail validation. Rejected candidates remain recorded with their specific reason.

A single hash-verified local PNG, unknown-person.png, is the universal fallback for every actor or event without approved documentary media. Its visible caption states that no verified documentary image is available. The silhouette never implies a real suspect, an official photograph, historical evidence, or a documentary source image.

Known limitations

extortion.wiki does not authenticate speakers, verify ransom amounts, confirm data theft, determine whether payment occurred, or independently attribute infrastructure or activity. Both source datasets and the curated lineage layer are selective rather than comprehensive. An absent alias or relationship means only that no publishable evidence record exists in this snapshot. Actor and family labels reproduce upstream classification; redactions, collection decisions, parsing artifacts, encoding recovery, and incomplete exports can affect analysis.

Research rule

Treat every statement inside a transcript as a claim made in a coercive negotiation, not as an independently verified fact.

References