Ransomware Group
Imnotavillain
Known victims2Distinct claims on its leak site, one per victim and day, as ransomware.live publishes them. A claim is not proof of a compromise.First claim2026-09-24Latest claim2026-09-24
Claims, last 30 days
0
Previous 30 days: 2
Close to the 30 days beforeMore or fewer when the change is at least 3 claims and a quarter of the previous 30 days; otherwise close.
Data as of 2026-11-09 03:59Z
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Known infrastructure
The following Tor hidden services have been associated with this group:
o6rtgcjdjqyimjxexpejddhdfbehsjn4fcsazfkgwydeb27gqhtdntyd.onion
These sites are malicious. Open them only from an isolated environment.
Who Imnotavillain targets
Share of its claims, through 2026-09-24.
Targeted sectors
- 01Financial services1 claim50 %
- 02Government1 claim50 %
Targeted countries
- 01GBUnited Kingdom1 claim50 %
- 02ITItaly1 claim50 %
Check if you’re affected
Look up your domain to see whether it appears on Imnotavillain’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request