# RansomLook: watching ransomware leak sites and listing their victims

> RansomLook is a Python tool that scrapes ransomware group and market sites, stores everything in Valkey, and serves a Flask web interface and a REST API for tracking groups, victim announcements, leak sites and payments. It is a descendant of ransomwatch with a different storage and scraping design, and it costs you a compiled Valkey, a Tor daemon and a headless browser stack to run.

**RansomLook/RansomLook** — Yet another Ransomware gang tracker

- Repository: https://github.com/RansomLook/RansomLook
- Website: https://www.ransomlook.io
- Stars: 677 · Forks: 117
- Language: Python
- License: GPL-3.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/ransomlook-ransomlook

## A tracker whose output is a list of victims

RansomLook is a tool to monitor ransomware groups and markets and extract their victims. That is the whole product, and it is aimed at threat intelligence and incident response work where knowing which organisation a group has just claimed matters. The project is based on ransomwatch, and the differences listed are substantial enough to be a rewrite rather than a fork in name only. Details about the groups come from malpedia, and ransom notes are imported from ThreatLabs. Beyond announcements, it tracks threat actors with relations between groups, forums and peers, marks a wanted status, monitors dataleaks, and follows cryptocurrency addresses with transaction tracking through the Breadcrumbs One API. It also watches torrent swarms associated with posts, counting seeders, leechers and peer samples. The audience is analysts and researchers who want raw data they can query, not a polished consumer dashboard.

## Valkey and Flask replace files and generated markdown

The architectural decision that distinguishes RansomLook from its base is where the data lives and how it is served. All data are stored into Valkey, an open source BSD licensed key/value datastore that can run standalone or in a cluster, and it is used here as a primary database rather than only as a cache. Scraping is multithreaded, and it is done with Playwright, with screenshots taken at the same time as the page content, which is what makes the screen command possible. Parsers use BeautifulSoup and are independent of one another, so one broken site does not stop the others. The last change is the one you will feel most: the whole website is done using Flask, so there is no need to regenerate any markdown file. If you create a local account, you can add, edit and delete groups through the web interface. The result is a system that can be queried and edited at run time, rather than a set of static pages produced by a nightly job.

## Valkey first, then RansomLook beside it

The install guide recommends Ubuntu 24.04 strongly, and the order of operations is fixed. Poetry 2.1.0 is the first requirement, and the system dependencies for the browser stack come later. Valkey has to be built from source, and the repository must sit in the same directory as the one you will clone RansomLook into. The build itself is a clone, a checkout of the 8.0 tag, a make and an optional test run:

```bash
git clone https://github.com/valkey-io/valkey
cd valkey
git checkout 8.0
make
# Optionally, you can run the tests:
make test
cd ..
```

Then you clone RansomLook next to it, so that the two directories end up as siblings:

```bash
git clone https://github.com/RansomLook/RansomLook.git
```

A quick check with ls valkey RansomLook confirms the layout, and the guide says if you see a no such file or directory error, one of them is missing and the installation has to be fixed. The final shape is a valkey directory holding the compiled binary and a RansomLook directory holding the clone you are about to install.

## Installing the app, the env file and the web dependencies

The system packages are the usual headless browser stack, plus tor and ffmpeg, and they need root to install. Once they are in place, the project itself is installed with poetry, and the .env file is initialised with the RANSOMLOOK_HOME variable pointing at the checkout:

```bash
cd RansomLook  # if you're not already in the directory
poetry install
```

```bash
echo RANSOMLOOK_HOME="`pwd`" >> .env
```

The web assets, meaning the css, font and js, are pulled in by two helper scripts, and the guide warns that they are version constrained because Subresource Integrity is used, with the hashes set in website/web/sri.txt. That is a small detail with a large consequence: a script that fetches a different version of a dependency will fail the integrity check rather than silently change what your site loads. Configuration is a copied sample file that you then edit to your needs:

```bash
cp config/generic.json.sample config/generic.json
```

Finally, one command fetches the required javascript dependencies and launches the application:

```bash
poetry run update --yes
```

With the default configuration the web interface is reachable on port 8000.

## The scheduled pipeline and the enrichment jobs

The core pipeline is three commands that the guide says should be scheduled with cron, recommended every two hours. Tor has to be running first, since the scraper reaches the group sites through it:

```bash
# Make sure Tor is running first
sudo systemctl enable --now tor

poetry run scrape          # Scrape all group/market sites (DB 0 + 3)
poetry run parse           # Run all parsers to extract posts from scraped data
poetry run screen          # Take screenshots of group sites via Lacus/Playwright
```

The database numbers in the comments are the different Valkey logical databases each job writes to, which is how the enrichment sources stay separate from the scraped data. The enrichment set is where the integrations live, and it is long: mail notifications for new posts and new leaks, a scrape of leak-lookup.com for new breaches, a sync of cryptocurrency addresses from ransomwhe.re, transaction updates through the Breadcrumbs One API, Recorded Future channel data, ransom notes from the ThreatLabz repository, and a family of torrent jobs that fetch torrent information, scan swarms for tracked magnets, backfill torrents missing names, scrape trackers over BEP-48 and BEP-15, check BEP-19 webseed URLs, and enrich observed peer IPs through CIRCL with a seven day cache. Notification delivery goes out by email, with RocketChat used when a new post is created, and MISP is integrated with support for the MISP ransomware galaxy.

## Service commands and a container alternative

Once installed, the running state is managed through a small set of commands, each of which does one thing:

```bash
poetry run start           # Start backend (Valkey) + website
poetry run stop            # Stop website + backend
poetry run shutdown        # Graceful shutdown of all services
poetry run start_website   # Start only the web interface (Gunicorn)
poetry run run_backend     # Start only the Valkey backend
poetry run update --yes    # System update, fetch deps, integrity checks
```

The split between start_website, which runs the interface under Gunicorn, and run_backend, which runs only Valkey, is the useful one for a deployment where the database and the web tier need different lifecycles. With the default configuration the interface answers on http://127.0.0.1:8000, so a real deployment sits behind a reverse proxy. There is also a container path, since the repository ships a Dockerfile based on ubuntu:22.04 that installs the browser libraries, poetry and playwright, and a docker-compose.yml that brings up a redis service and a ransomlook service with the config, data, source and cache directories mounted and port 8000 published, starting Tor and then the pipeline with a scrape and a parse once the service is up. The interface is bilingual, English and French, with a cookie based switcher.

## Versions, licence and the shape of the codebase

The release line has moved quickly. Version 2.1.0, named Danaide, came on 2026-09-30 with major updates, version 2.0.0, named Mira, arrived on 2026-04-12 with observability, crypto traceability and a cleaner core, and 1.9.0, the Sunny release, dates from 2025-08-19. The default branch is named 2.1, so the branch you clone is the current series rather than master. The licence is GPL-3.0, which matters for a tool that scrapes and redistributes data, and the repository carries a SECURITY.md for responsible disclosure. The project is Python, with the manifest requiring Python 3.10 or newer and below 3.15, and the dependency list gives a sense of the shape: Flask 3.1.2 with Babel, Login, Moment and WTF for the interface, flask-restx for the API, the valkey client, BeautifulSoup, requests with socks support, Playwright with playwright-stealth and the lacuscore and pylacus packages for the screenshot work, libtorrent, gunicorn, Mastodon and RocketChat clients, pymisp, and LDAP support. The repository itself is organised into ransomlook/, bin/, tools/, website/, source/, config/, data/, cache/, translations/ and etc/, with mypy.ini and a .pylintrc for static checks. The last push to the 2.1 branch was on 2026-10-20.

## Conclusion

RansomLook suits threat intelligence analysts who want their own copy of the victim and leak data with a queryable API, rather than relying on somebody else's dashboard, and who are prepared to run Tor, a headless browser and a compiled Valkey. It is the wrong choice for a team that just needs a feed of announcements, since the operational cost of self hosting is real and the scraping targets are exactly the sites that change their defences. Before deploying, read the version notes for 2.1 and 2.0, check that the scraper commands in the cron job are the ones you want to schedule, and budget for the keys that external enrichment still needs, such as the Breadcrumbs One API key.

## FAQ

### What does RansomLook actually do?

It is a tool to monitor ransomware groups and markets and extract their victims, with group details from malpedia, ransom notes from ThreatLabs, threat actor relations, dataleak monitoring, cryptocurrency tracking through the Breadcrumbs One API, and a REST API with interactive Swagger documentation at /doc.

### What do I need before I can install RansomLook?

Poetry 2.1.0, the headless browser system packages, tor and ffmpeg, and a Valkey built from source in a directory next to the RansomLook clone. Ubuntu 24.04 is strongly recommended, and the manifest requires Python 3.10 or newer and below 3.15.

### How do I run the scraping pipeline on a schedule?

Run the scrape, parse and screen commands from cron, every two hours as the guide recommends, with Tor already running via sudo systemctl enable --now tor. Each job writes to its own Valkey logical database, which is why the comments name DB 0, DB 3 and others.

### Where is the web interface and how is it served?

With the default configuration the interface answers on http://127.0.0.1:8000, and the poetry run start_website command runs it under Gunicorn. The repository also ships a Dockerfile and a docker-compose.yml that publish port 8000 and mount the config, data, source and cache directories.

## Sources

- [License: GPL-3.0](https://github.com/RansomLook/RansomLook/blob/2.1/LICENSE)
- [Project website](https://www.ransomlook.io)
- [RansomLook/RansomLook on GitHub](https://github.com/RansomLook/RansomLook)
- [README](https://github.com/RansomLook/RansomLook/blob/2.1/README.md)
- [Releases](https://github.com/RansomLook/RansomLook/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/ransomlook-ransomlook