Addresses reported for ransomware
Addresses reported as having received ransomware payments. Reports are crowdsourced and verified against the public ledger, so a hit means an address has been reported in connection with a ransomware campaign rather than sanctioned by an authority.
Cite this dataset
Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122
https://doi.org/10.5281/zenodo.6512122What a record holds4 fields
These are the fields a match on this list carries back. Not every record has all of them filled in, since sources only publish what they have.
- Wallet address
- address
- Chain the address is on
- network
- Why it is flagged
- info
- Linked sanctioned entity, where there is one
- entity
A wallet check runs against this list and every other wallet list at the same time, so you do not need to screen against it separately.
We use cookies to improve your experience on our website. By browsing this website, you agree to our use of cookies.