A major update for the Ransomware News Bot bringing quiet hours, per-webhook filters, automatic retries, hot-reload, and many quality-of-life improvements.
Quiet Hours
Webhooks can now be muted on a schedule. No more alerts at 3 AM unless you want them.
The setting is configured per webhook individually in config_general.json.
- Configurable per webhook individually (Discord/Slack, per channel)
- Flexible time windows (e.g. 10 PM - 7 AM)
- Supports any timezone
Webhook Filters
New per-webhook filtering system for targeted notifications:
- Filter by country, group, or keyword (literal or regex)
- Include/exclude lists for fine-grained control
- Applies to both ransomware API entries and RSS feeds
Message Ordering
All messages are now sent in chronological order (oldest first). This applies to ransomware API alerts, RSS feeds, and recovery messages - making it easier to follow the timeline of events.
Retry System
Failed messages are no longer lost. The new retry system ensures delivery:
- Automatic retries for failed webhook deliveries
- Configurable number of attempts and time window
- Payload is persisted so entries that disappear from the API can still be delivered
Hot-Reload
Configuration changes are now automatically detected and applied every 60 seconds. No restart required for changes to intervals, log level, feeds, or webhooks.
Freshness Filter
Optional maximum age for RSS entries via rss_max_item_age.
Prevents sending outdated articles on first startup - only fresh content gets delivered.
Docker
- Alpine updated to latest (currently 3.23)
- Go dependencies updated to latest versions
- Image is now consistently named
ransomware-bot - Healthcheck via
pidofenabled
Other Improvements
- Dry-run mode (
--dry-run) - Preview without actually sending - Configurable data directory (
data_dir) - Improved log rotation with configurable limits
- More robust RSS deduplication (GUID + content signature)