Build-time ingestion

The ransomware-notes synchronization script reads every upstream family directory from a pinned Git checkout, rejects unsafe paths and symlinks, enforces a file-size limit, detects supported text and markup formats, preserves original bytes in a local snapshot, records the source commit and URLs, calculates SHA-256 hashes, and emits both a typed JSON dataset and a validation report. Unsupported, empty, malformed, oversized, and invalid-encoding inputs are reported rather than silently discarded.

The site reads the source index during the static build. Zod validates index entries, conversation containers, and each message. Source paths are resolved below the dataset root; unsafe paths are rejected. Source files are never rewritten.

A conversation needs a usable identifier and at least one valid message. Malformed or empty messages are excluded from message totals and reported during the build; conversations with no valid messages are excluded. The archive does not guess missing content. Guessing is already well represented elsewhere on the internet. This snapshot reported 34 normalization issues.

Normalization policy

  • Actor names and conversation identifiers are retained for display.
  • URL slugs are deterministic, lowercase, and collision-safe.
  • Message sequence follows source-array order.
  • Message wording is retained. At render time, presentation-only whitespace is normalized: single source line wraps become spaces and blank lines remain paragraph boundaries.
  • Ransomware-note source filenames, relative paths, bytes, hashes, encodings, and commit-pinned URLs are recorded separately.
  • Note search normalization produces a derived plain-text field; it never replaces the raw archived content.
  • Cross-corpus links use a small explicit alias map rather than opportunistic string equality.
  • Locations written inside transcripts remain inert plain text.
  • Only source URLs matching the Casualtek/Ransomchats raw GitHub path are linked.

Dates and chronology

Many records have blank timestamps or use inconsistent timestamp formats. Listing dates are inferred only from valid eight-digit dates in filenames or chat identifiers. They describe the source record label, not necessarily the first message, compromise date, publication date, or payment date. Records without a defensible label date remain marked “Date not recorded.”

Search construction

Pagefind constructs a static full-text index after Astro renders the site. Negotiation pages use the negotiation corpus tag with actor and year facets. Ransomware-note pages use the ransomware-note corpus tag with family, filename, format, and archive-ID metadata. Global search can span both plus reference pages; dedicated searches pin the appropriate corpus. Search executes locally in the browser.

Document safety

Astro renders negotiation and ransomware-note content as escaped text. HTML and HTA notes are shown only as source inside a selectable preformatted viewer. Source scripts, forms, event handlers, styles, images, frames, fonts, and remote resources are never embedded or loaded. Static security headers additionally restrict scripts, frames, objects, form targets, referrers, and cross-origin behavior.

Known limitations

extortion.wiki does not authenticate speakers, verify ransom amounts, confirm data theft, determine whether payment occurred, or independently attribute infrastructure or activity. Both source datasets are selective rather than comprehensive. Actor and family labels reproduce upstream classification; redactions, collection decisions, parsing artifacts, encoding recovery, and incomplete exports can affect analysis.

Research rule

Treat every statement inside a transcript as a claim made in a coercive negotiation, not as an independently verified fact.

References