Crime intelligence
Ransomwhere ransomware payment addresses
Ransomwhere is a crowdsourced, open dataset of ransomware payment addresses created by Jack Cable. CompliAPI ingests it weekly and flags matches as crime intelligence — distinct from any sanctions designation.
- Publisher
- Ransomwhere (Jack Cable)
- List type
- Crime intelligence
- Refresh
- Ingested weekly
- API list slug
ransomwhere- Official source
- ransomwhe.re
- License
- CC BY 4.0 (Zenodo doi:10.5281/zenodo.13999026)
About this list
Ransomwhere collects ransomware payment addresses reported by victims and researchers, with each address attributed to a ransomware family (WannaCry, Conti, REvil and hundreds more). Reports are validated before inclusion, and addresses become public through the dataset's export 90 days after submission.
This is crime intelligence, not a government list: an address here was reported as a ransomware payment destination, not designated by any authority. CompliAPI keeps that distinction explicit — a Ransomwhere match sets flagged: true and carries list_type "crime", but never sets sanctioned.
The dataset is published by Jack Cable under CC BY 4.0 (Cable, Jack. Ransomwhere: A Crowdsourced Ransomware Payment Dataset, Zenodo, doi:10.5281/zenodo.13999026), which permits commercial use with attribution.
What CompliAPI extracts
- Ransomware payment addresses — BTC, ETH, XMR, LTC
How CompliAPI handles it
Weekly export ingestion
CompliAPI pulls the dataset's public export weekly. Addresses span Bitcoin, Ethereum, Monero and Litecoin, each stored with its chain and ransomware family.
Family attribution kept
The ransomware family is the closest thing the dataset has to a listed party, so it is preserved in the match metadata — a hit tells you which campaign the address was reported under.
Flagged, never sanctioned
Matches carry list_type "crime" and set only the flagged field. Your policy decides what a ransomware-payment association means; the API will not conflate it with a sanctions designation.
Screen against this list
Every /screen endpoint checks all enabled lists by default and names the list behind each match. Add the ?lists= filter to restrict a request to this source.
GET /api/v1/screen/crypto/{address}?lists=ransomwhere
curl "https://api.compliapi.com/api/v1/screen/crypto/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94?lists=ransomwhere" \
-H "Authorization: Bearer $COMPLIAPI_TOKEN"Response
{
"value": "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94",
"flagged": true,
"sanctioned": false,
"lists_checked": ["ransomwhere"],
"matches": [
{
"list": "ransomwhere",
"list_name": "Ransomwhere ransomware payment addresses",
"list_type": "crime",
"match": "exact",
"value": "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94",
"source_url": "https://ransomwhe.re/",
"metadata": { "name": "WannaCry", "family": "WannaCry" }
}
]
}Frequently asked questions
Is a ransomware-address match a sanctions hit?
No. Ransomwhere is crowdsourced crime intelligence, not a government designation list. A match sets flagged: true with list_type "crime" and leaves sanctioned: false — the distinction is explicit in every response.
Where does the Ransomwhere data come from?
From ransomwhe.re, a crowdsourced dataset created by Jack Cable. Victims and researchers report ransomware payment addresses, reports are validated, and addresses are published through the export 90 days after submission.
Which chains does the ransomware dataset cover?
Bitcoin, Ethereum, Monero and Litecoin addresses, each stored with its chain symbol and the ransomware family it was reported under.
Why might a known ransomware address not match yet?
The dataset publishes addresses 90 days after they are submitted, and CompliAPI re-ingests weekly — so very recent campaign addresses can lag the news cycle. The delay is a property of the upstream dataset.
Can I opt out of crime-intelligence results?
Yes. Use the ?lists= filter to name only the lists you want checked, or branch on list_type in the response — crime hits are always labeled.
Related
Risk exposure
Tornado Cash association lists
How CompliAPI builds its Tornado Cash lists: a daily crawl of the mixer's Ethereum pool events records depositors and relayers, with the evidencing transaction on every hit.
Sanctions list
FBI-published Lazarus Group crypto addresses
How CompliAPI screens the crypto addresses the FBI attributed to North Korea's Lazarus Group after the $41M Stake.com theft: transcribed verbatim from the official press release and checked on every crypto screen.
Sanctions screening
Wallet screening API for crypto compliance
Screen crypto wallets against OFAC and global sanctions lists in one GET request.
Screen against Ransomwhere data
Get a free API key and make your first request in minutes — every screen checks all enabled lists in one call.
14-day free trial. No credit card required.
CompliAPI provides data and tools that support compliance workflows. It does not provide legal advice, and organizations should determine their obligations with qualified counsel.