api.ransomware-tracker.com x402 offerings

Dragons Eye Lookup: Bulk vendor check: up to 100 vendor domains or company names for ransomware leak-site claims. One call checks up to 100 vendors (domains or company names, separated by newlines or semicolons; commas work for a list of domains) and returns, per vendor, matching ransomware-group claims (group, dates, sources). Claims only: risk levels, summary and actions are in /v1/vendor-report. Unverified claims from criminal leak sites; commercially reusable sources only. If the source fail

Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups return 404, not charged. Don't use this for tools, TTPs or momentum; use /v1/group-intel.

Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusable sources only. Don't use this for checking a specific company; use /v1/lookup.

Has a ransomware group claimed this company or vendor? Input: ?q=acme.com or ?q=Acme Corp (domain or company name). Returns found, claim_count and each claim's group, claimed/first-seen dates, country, sector and source with license. $0.01 USDC on Base. Useful for vendor due diligence. These are unverified claims from criminal leak sites, not proof of a breach. For many domains at once use /v1/batch ($0.05).

Dragons Eye Lookup: Batch vendor exposure check: up to 25 domains for ransomware leak-site claims. One call checks up to 25 vendor/supplier domains (comma-separated) and returns, per domain, any matching ransomware-group claims. Unverified claims from criminal leak sites; commercially reusable sources only. found:false is not proof of absence.

Dragons Eye Lookup: Domain or IPv4 threat-indicator check against ThreatCluster's 30-day high-confidence IOC feed. Is this domain (or a parent domain) or IPv4 address listed as attacker infrastructure in recent threat reporting? Returns verdict listed/not_listed, match type, the stated reason, linked reports and ThreatCluster clusters, and feed freshness. Served from a cache refreshed about hourly; if the feed is older than 3 hours the call returns 503 and is not charged. No match is not proof o

Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less.

Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. Don't use this for one indicator; /v1/indicator-check costs less.

Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof.

Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, public exploit repos, an AI-generated ATT&CK attack flow (flagged) and D3FEND countermeasures. Uncached CVEs return 404, not charged. Don't use this for CVEs not yet cached; they return 404 and are queued.

Third-party-risk report in one call: for up to 100 vendors (domains or company names) returns matching ransomware leak-site claims (group, claimed and first-observed dates, sources), a per-vendor risk level (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary with priority vendors, and concrete follow-up actions. Separate