185.25.51.173-20220226.json May 2026

Logs reveal how the group handled ransom negotiations, target selection, and internal payroll. Technical Metadata: Each entry typically includes: ts : Timestamp of the message.

The string refers to a specific log file from the Conti ransomware leaks (also known as the "ContiLeaks"). 185.25.51.173-20220226.json

The filename prefix 185.25.51.173 is the IP address of the server where the chat logs were hosted or intercepted. 🔍 Key Features of the Data Logs reveal how the group handled ransom negotiations,

The data was leaked by a pro-Ukrainian insider in February 2022 following the Conti Group's public support for the Russian invasion of Ukraine. The filename prefix 185

The files document real-time conversations between members of the Wizard Spider group (the operators of Conti).

This specific JSON file contains Jabber (XMPP) chat logs from February 26, 2022 .