Ransomware traffic dataset


This mini dataset has 281 malicious TLS flows generated by multiple ransomware samples for a few days, during late June 2025.
Please refer to instructions page for more information.

Download dataset

======= Statistics =========
Total pcaps: 96
All streams: 3334
Suspicious streams: 281, 281/3334 = 0.08
Services: TLS: 191, unknown: 90

======= Families =========
Thanos: 272 streams
WannaCry: 9 streams

Unique addresses(num: 9)
---------------
{'178.254.20.134', '99.83.136.84', '86.59.119.83', '192.34.63.137', '212.83.154.33', '75.2.73.197', '91.232.155.81', '91.219.236.222', '46.28.207.19'}

Unique hosts(num: 2)
---------------
{'825610.parkingcrew.net', 'web-ha.kapsi.fi'}