SCOUTz / Ransomware Intel
Is this prospect, or one of their vendors, on a ransomware leak site right now?
Look up a domain or another indicator against ransomware.live, CISA KEV, and SEC EDGAR sources. A leak-site listing is a claim by the group, not a verified incident.
What it does
- Look up a domain, CVE, hash, URL, group, or ransom note.
- Read source information from ransomware.live, CISA KEV, and SEC EDGAR.
- Review groups active in the last 7 and 30 days, with trend.
- Check weekly supplier and vendor alerts against each client's supplier register.
- Send one alert email per vendor to workspace owners, never to a client.
- Sweep what clients expose hourly against CISA KEV and new critical flaws.
- See a red alert on Today when the sweep flags exposure.
- Keep leak-site claims distinct from verified incidents.
Illustrative example
· Not customer data
A supplier register includes 1 vendor with a leak-site listing. The workspace owner receives the vendor alert; the client does not receive it.
Questions MSPs ask
Does a leak-site listing prove an incident?
No. Leak-site listings are claims by the groups, not verified incidents.
Which sources are used?
The sources are ransomware.live, CISA KEV, and SEC EDGAR.
Who receives supplier alerts?
Workspace owners receive one email per vendor. These alerts are never sent to a client.
How often is exposed client infrastructure checked?
An hourly sweep checks what clients expose against CISA KEV and new critical flaws, with a red alert on Today.
What can I search for?
Search by domain, CVE, hash, URL, group, or ransom note.