Dragons Eye Lookup

Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sources. Don't use this as proof of a breach; these are unverified claims from criminal leak sites.

Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups return 404, not charged. Don't use this for tools, TTPs or momentum; use /v1/group-intel.

Dragons Eye Lookup: Newest ransomware leak-site claims, optionally for one group. Up to 10 of the newest ransomware-group claims, optionally for one group. Unverified claims from criminal leak sites; commercially reusable sources only (country/sector often null).

Dragons Eye Lookup: Batch vendor exposure check: up to 25 domains for ransomware leak-site claims. One call checks up to 25 vendor/supplier domains (comma-separated) and returns, per domain, any matching ransomware-group claims. Unverified claims from criminal leak sites; commercially reusable sources only. found:false is not proof of absence.

Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, public exploit repos, an AI-generated ATT&CK attack flow (flagged) and D3FEND countermeasures. Uncached CVEs return 404, not charged. Don't use this for CVEs not yet cached; they return 404 and are queued.

Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof.

Dragons Eye Lookup: Domain or IPv4 threat-indicator check against ThreatCluster's 30-day high-confidence IOC feed. Is this domain (or a parent domain) or IPv4 address listed as attacker infrastructure in recent threat reporting? Returns verdict listed/not_listed, match type, the stated reason, linked reports and ThreatCluster clusters, and feed freshness. Served from a cache refreshed about hourly; if the feed is older than 3 hours the call returns 503 and is not charged. No match is not proof o

Dragons Eye Lookup: Bulk vendor check: up to 100 vendor domains or company names for ransomware leak-site claims. One call checks up to 100 vendors (domains or company names, separated by newlines or semicolons; commas work for a list of domains) and returns, per vendor, matching ransomware-group claims (group, dates, sources). Claims only: risk levels, summary and actions are in /v1/vendor-report. Unverified claims from criminal leak sites; commercially reusable sources only. If the source fail

Dragons Eye Lookup: CVE intel bundle: up to 50 CVEs in one call. The /v1/cve record for up to 50 CVEs (comma-separated). Charged only if at least half of them are covered; otherwise 404 with the covered list, not charged. Uncovered ids are listed and queued.

Dragons Eye Lookup: Bulk threat-indicator check: up to 100 domains or IPv4 addresses in one call. Same check as /v1/indicator-check for up to 100 domains/IPv4 addresses (comma-, semicolon- or newline-separated). One flat price. Stale feed -> 503, not charged.

Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less.

Dragons Eye Lookup: Prepaid vendor ransomware watch: up to 25 vendors for 30 days, webhook on new claims. Pay once; each vendor (domain or company name) is re-checked about once a day for 30 days. When one appears in a new ransomware leak-site claim from a commercially reusable source you get an HMAC-signed JSON POST at your https webhook_url (event watch.changed). A watch.created POST is sent right away. Webhook only, no email. Free status at GET /v1/watch/{watch_id}. Bad input 400, never charg