Dragons Eye Lookup

Dragons Eye Lookup: Prepaid vendor ransomware watch: up to 25 vendors for 30 days, webhook on new claims. Pay once; each vendor (domain or company name) is re-checked about once a day for 30 days. When one appears in a new ransomware leak-site claim from a commercially reusable source you get an HMAC-signed JSON POST at your https webhook_url (event watch.changed). A watch.created POST is sent rig

Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for risk levels and actions; use /v1/vendor-report.

Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. Don't use this for one indicator; /v1/indicator-check costs less.

Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less.

Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clusters and feed freshness. If the feed is older than 3 hours it returns 503, not charged. Don't use this as proof a domain is safe; no match is not proof of absence.

Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for company names or more than 25; use /v1/bulk-check.

Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less.

Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, public exploit repos, an AI-generated ATT&CK attack flow (flagged) and D3FEND countermeasures. Uncached CVEs return 404, not charged. Don't use this for CVEs not yet cached; they return 404 and are queued.

Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof.

Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sources. Don't use this as proof of a breach; these are unverified claims from criminal leak sites.

Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusable sources only. Don't use this for checking a specific company; use /v1/lookup.

Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups return 404, not charged. Don't use this for tools, TTPs or momentum; use /v1/group-intel.