[protanopia]

The transactions are public but the reasons for them are not. Usually ransomware victims don't publicize the fact that they were attacked. Even if they do, they additionally don't publish in which transaction they transferred the ransom. There isn't a practical to determine whether a specific transaction that a wallet received was from ransomware.