// Methodology

Automated ingestion routines pull from public leak-site trackers, government vulnerability catalogs, and community IOC feeds on fixed schedules. Every routine writes into our own cache; no user request is ever proxied to an upstream provider. Each source has an enforced minimum interval between outbound requests, and ingestion is refused when that interval has not elapsed.

Every ingested record carries a deterministic upstream identifier, the originating source name, the source terms URL, a restriction code, and the date its terms were last reviewed. Records matching an existing upstream identifier are updated rather than duplicated.

Records move through draft, needs review, verified, deprecated, and false positive states. Only verified records are eligible for machine-readable output, and only when their source permits redistribution.

Each source below is displayed with its required attribution. Restricted sources are shown in the interface for defensive research but withheld from STIX exports, TAXII collections, RSS, and MCP tools.

• Ransomware.live — Restricted: display only, no redistribution. Refresh floor 30 min. terms
• CISA KEV — Redistribution permitted. Refresh floor 0 min. terms
• NVD (NIST) — Redistribution permitted. Refresh floor 0 min. terms
• abuse.ch ThreatFox — Redistribution permitted. Refresh floor 5 min. terms
• MITRE ATT&CK — Redistribution permitted. Refresh floor 0 min. terms

RansomScope currently operates as a free, non-commercial defensive research project. It does not charge users, run advertisements, sell access or data, offer paid plans, or request or accept donations. No commercial relationship, sponsorship, endorsement, or affiliation with Ransomware.live is implied.

Current operating state: monetization=false · donations=false · advertising=false · sponsorships=false · paid_api=false

Attribution to a third-party source identifies where data originated. It does not imply endorsement, partnership, sponsorship, or affiliation between that source and RansomScope.

This describes current operation and is not a promise that the service will remain free indefinitely. If monetization, paid services, sponsorships, advertising, affiliate revenue, donations, or other commercial activity are ever considered, RansomScope will first review the applicable source licenses and terms and obtain any required written approvals before that activity begins.

Enabling any commercial or funding flag automatically places Ransomware.live-derived records on a compliance hold until written commercial authorization is recorded in the source registry. Donations and sponsorships trigger the same review even when they are not tied to data access.

This documents current operating facts only. It is not a claim of blanket legal compliance, and RansomScope is not presented as a charity, nonprofit organization, or legally recognized nonprofit.

Report inaccurate, stale, or improperly sourced records through the contact form on the About page. Full usage rules are documented in Terms & Data Source Usage.