~ digitalchk / docs / ransomware-chk
Ransomware Chk searches public ransomware victim disclosures for a company or domain, and publishes a browsable catalog of the groups behind them. It answers a question a prospect rarely asks out loud: has anyone in my position already been hit.
How it works
Victim search
Searches the ransomware.live dataset for a company name or domain and reports matches with their dates and the group that claimed them.
Group profiles
Publishes a page per ransomware group with its victim list, tooling and ransom notes, at /ransomware-group/{name}/.
Statistics and feed
Shortcodes for aggregate statistics and a recent-victims feed, useful as standalone content.
Honest failures
When the upstream API is unavailable, pages return a 503 with a retry hint rather than a 404 or an empty result that would read as good news.
Literal search
Matches are literal, to avoid false positives on generic words. Groups often publish only a domain, so when nothing is found the tool suggests trying the domain and other names the company uses.
Leak-site monitoring
Below every search, visitors can ask to be emailed when that name or domain appears in a new leak-site post. Any term of 4 or more characters can be watched, up to 5 per address by default; only the receiving address is confirmed, with a code. The plugin reads the recent-posts feed every 6 hours by default (12 hours or daily in the Monitoring submenu), alerts only on posts found after sign up, and never repeats one. Each alert links to stop that term or all monitoring, and those links ask for confirmation first, because mail security scanners open every link. Two days after an alert, a follow-up repeats what was found in case it was missed. Unsubscribing from the newsletter also stops it.
Auto-publisher
Can draft posts about notable incidents, with AI-written copy and a generated featured image. Text works with any AI service with a Chat Completions API, with a Reasoning effort setting for reasoning models, and images with any standard image-generation API. Each can have a backup provider that takes over when the main one fails. Deleting a draft tells the publisher no: it remembers that incident and never writes it again, and restoring the draft from the trash undoes it (Auto-Publisher > Deleted articles, where you can also turn it off or forget the list). An optional Named group only filter skips press items that do not name the ransomware group behind the attack; it is off by default.
Requirements
- WordPress 5.8 or newer
- PHP 7.4 or newer
- An API key for ransomware.live. Their free tier allows one request per minute and excludes commercial use, so a paid tier is the right choice for a business site
Publishing it
Drop one of these shortcodes on any page or post. Each one is self-contained and needs no theme integration.
[ransomware_chk][ransomware_check][ransomware_chk_groups][ransomware_chk_stats][ransomware_chk_feed][ransomware_chk_press]
Attribution. The plugin shows a small “A tool by Digital Checkmark” line, with a link to digitalchk.com, under the search widget, at the foot of the PDF report and under every email it sends. It is part of the plugin and has no setting to turn it off. If a tool and a Leads Chk form share a page, the line shows once.
Setup
Anti-abuse Recommended
Under Settings, add your Cloudflare Turnstile site key and secret key. Without it, anyone can script the public tool and consume your quotas on the outside services it uses.
With the keys in place, the plugin also refuses to email a verification code or a report unless the visitor recently passed a Turnstile check. A normal search counts; if not, a small check window opens before sending.
Email verification Recommended
The plugin verifies in three layers before sending a report: format, disposable domain, and, if you add a Reoon key, a real deliverability check. This protects your sending reputation from bounces to invented addresses.
PDF reports Optional
Reports are converted to PDF by Gotenberg, which you self-host. Set its URL in the reports tab; on the same machine that is http://127.0.0.1:3000. Without Gotenberg the rest of the plugin works unchanged.
Delivery and branding
Configure the SMTP server that sends the reports and the branding that appears on them: name, tagline, logo, colors and cover.
Notifications and contacts Optional
It can notify you by email or webhook when a lead arrives and, if you use Leads Chk, hand that lead to it, which keeps your contacts and your newsletter. Everything filters by event and by source, so you are not paged for noise.
Lead capture and retention
When somebody asks for their report, the plugin stores the address as a lead along with a summary of the result, and builds the report only from the result the server kept when the check ran (for up to 2 hours), so it always matches what the tool found. You will find these under Leads, and they export to CSV.
Retention is governed by GDPR Retention (days): leads older than that are deleted automatically by a scheduled task. Set it to 0 to disable the purge, though we would not recommend it. Declare in your privacy policy what you store and for how long.
The plugin also works with the WordPress privacy tools (Tools > Export Personal Data and Erase Personal Data): one request exports or deletes everything it keeps for an email address, together with the other Digital Checkmark plugins you have installed.
If Leads Chk is installed, every address the plugin collects through a report, the usage wall or the access gate is also sent there, with tags (the tool, how the address arrived, business or personal, and the result) and a consent record. What happens next (saved only, newsletter offered with a checkbox, or subscribed) and which list it goes to is decided in this plugin’s Integrations screen. Addresses that were only looked up, and could belong to someone else, stay out of Leads Chk. Leads Chk can also place a newsletter form under the tool.
If something does not work
Group pages return 503.
The upstream API is refusing or failing. That is the honest path working as designed. Check your API key and tier.
A group page 404s when you type its name with hyphens.
Group names that contain spaces resolve only with %20. The catalog links them correctly; a hand-typed hyphenated URL will not match.
A company you know was hit does not show up by name.
Groups often publish only the domain. Search the domain, for example company.com, or the name without LLC or Inc.
Getting help
Write to us through the support page. Include your plugin version, your WordPress and PHP versions, and the exact text of any error.