Roundhouse

Dragons Eye Lookup

Public ransomware intelligence: live monitoring of leak-site victim claims, a directory of tracked ransomware groups, sector and geography statistics, MITRE ATT&CK context, and activity trends — for defenders, researchers, and SOC analysts.

DataLiveeip155:8453Exactvia cdp
https://api.ransomware-tracker.com/v1/vendor-report
Third-party-riskVendor-risk-reportTprmRansomwareSupplier-risk
Calls · 30d
1
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 4 snapshots so far.
$40.97
Verified settled volume
185 settlements proven x402 by their on-chain EIP-3009 marker.
$3.00
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-10-24 15:00Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x2dAF658B01e257206375798a15832E9f547D65dD

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "offer": {
    "asset": "USDC",
    "input": {
      "type": "http",
      "method": "GET",
      "queryParams": {
        "vendors": "example.com;Example Org"
      }
    },
    "price": "$3.00",
    "network": "eip155:8453",
    "mime_type": "application/json",
    "how_to_pay": "x402 v2: sign the accepts[0] requirement and retry with the PAYMENT-SIGNATURE header (challenge also in the PAYMENT-REQUIRED header). Invalid input is answered before payment and never charged.",
    "input_schema": {
      "type": "object",
      "required": [
        "type",
        "method"
      ],
      "properties": {
        "type": {
          "type": "string",
          "const": "http"
        },
        "method": {
          "enum": [
            "GET"
          ],
          "type": "string"
        },
        "queryParams": {
          "type": "object",
          "required": [
            "vendors"
          ],
          "properties": {
            "vendors": {
              "type": "string",
              "maxLength": 12000,
              "description": "Vendor domains or company names separated by newlines or semicolons, max 100, e.g. acme.com;Example Corp"
            }
          }
        }
      },
      "additionalProperties": false
    },
    "price_atomic": "3000000",
    "what_you_get": "Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less.",
    "output_schema": {
      "type": "object",
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string"
        },
        "example": {
          "type": "object"
        }
      }
    },
    "sample_output": {
      "label": "unverified claim from a criminal leak site",
      "report": "vendor_ransomware_risk",
      "summary": {
        "by_risk": {
          "high": 1,
          "unknown": 0,
          "elevated": 0,
          "historical": 0,
          "none_found": 1
        },
        "partial": false,
        "headline": "1 of 2 vendors were named in a ransomware leak-site claim in the last 90 days. Start with them.",
        "overall_risk": "high",
        "groups_involved": [
          {
            "group": "akira",
            "vendors": 1
          }
        ],
        "vendors_checked": 2,
        "priority_vendors": [
          {
            "risk": "high",
            "groups": [
              "akira"
            ],
            "vendor": "example.com",
            "newest_claim_at": "2026-09-01T00:00:00Z"
          }
        ],
        "vendors_with_claims": 1
      },
      "vendors": [
        {
          "kind": "domain",
          "risk": "high",
          "found": true,
          "claims": [
            {
              "group": "akira",
              "label": "unverified claim from a criminal leak site",
              "sector": "Technology",
              "country": "United States",
              "sources": [
                {
                  "url": "https://www.ransomlook.io/",
                  "name": "RansomLook",
                  "license": "CC BY 4.0",
                  "license_url": "https://creativecommons.org/licenses/by/4.0/"
                }
              ],
              "website": "example.com",
              "organization": "example.com",
              "first_observed_at": "2026-09-01T03:10:00Z",
              "claimed_published_at": "2026-09-01T00:00:00Z"
            }
          ],
          "groups": [
            "akira"
          ],
          "status": "ok",
          "vendor": "example.com",
          "actions": [
            "Ask the vendor in writing whether they had a security incident, what data was involved and whether your data was in scope."
          ],
          "claim_count": 1,
          "newest_claim_at": "2026-09-01T00:00:00Z",
          "oldest_claim_at": "2026-09-01T00:00:00Z"
        },
        {
          "kind": "name",
          "risk": "none_found",
          "found": false,
          "claims": [],
          "groups": [],
          "status": "ok",
          "vendor": "Example Org",
          "actions": [
            "No claim found in the licensed sources. Keep normal monitoring; this is not proof the vendor was never attacked."
          ],
          "claim_count": 0,
          "newest_claim_at": null,
          "oldest_claim_at": null
        }
      ]
    },
    "related_endpoints": [
      {
        "url": "https://api.ransomware-tracker.com/v1/lookup",
        "price": "$0.01",
        "method": "GET",
        "description": "Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sourc"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/recent",
        "price": "$0.01",
        "method": "GET",
        "description": "Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusabl"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/group",
        "price": "$0.02",
        "method": "GET",
        "description": "Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups r"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/batch",
        "price": "$0.05",
        "method": "GET",
        "description": "Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for "
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/bulk-check",
        "price": "$0.50",
        "method": "GET",
        "description": "Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for ris"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/watch",
        "price": "$0.30",
        "method": "POST",
        "description": "Dragons Eye Lookup: Prepaid vendor ransomware watch: up to 25 vendors for 30 days, webhook on new claims. Pay once; each vendor (domain or company name) is re-checked about once a day for 30 days. Whe"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/indicator-check",
        "price": "$0.01",
        "method": "GET",
        "description": "Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clu"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/indicator-batch",
        "price": "$0.25",
        "method": "GET",
        "description": "Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. "
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/cve",
        "price": "$0.03",
        "method": "GET",
        "description": "Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, publi"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/cve-batch",
        "price": "$0.50",
        "method": "GET",
        "description": "Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment l"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/group-intel",
        "price": "$0.05",
        "method": "GET",
        "description": "Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported to"
      }
    ]
  },
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
      "amount": "3000000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 120
    }
  ],
  "resource": {
    "url": "https://api.ransomware-tracker.com/v1/vendor-report",
    "tags": [
      "third-party-risk",
      "vendor-risk-report",
      "tprm",
      "ransomware",
      "supplier-risk"
    ],
    "mimeType": "application/json",
    "description": "Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less.",
    "serviceName": "Dragons Eye Lookup"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "method": "GET",
          "queryParams": {
            "vendors": "example.com;Example Org"
          }
        },
        "output": {
          "type": "json",
          "example": {
            "label": "unverified claim from a criminal leak site",
            "report": "vendor_ransomware_risk",
            "summary": {
              "by_risk": {
                "high": 1,
                "unknown": 0,
                "elevated": 0,
                "historical": 0,
                "none_found": 1
              },
              "partial": false,
              "headline": "1 of 2 vendors were named in a ransomware leak-site claim in the last 90 days. Start with them.",
              "overall_risk": "high",
              "groups_involved": [
                {
                  "group": "akira",
                  "vendors": 1
                }
              ],
              "vendors_checked": 2,
              "priority_vendors": [
                {
                  "risk": "high",
                  "groups": [
                    "akira"
                  ],
                  "vendor": "example.com",
                  "newest_claim_at": "2026-09-01T00:00:00Z"
                }
              ],
              "vendors_with_claims": 1
            },
            "vendors": [
              {
                "kind": "domain",
                "risk": "high",
                "found": true,
                "claims": [
                  {
                    "group": "akira",
                    "label": "unverified claim from a criminal leak site",
                    "sector": "Technology",
                    "country": "United States",
                    "sources": [
                      {
                        "url": "https://www.ransomlook.io/",
                        "name": "RansomLook",
                        "license": "CC BY 4.0",
                        "license_url": "https://creativecommons.org/licenses/by/4.0/"
                      }
                    ],
                    "website": "example.com",
                    "organization": "example.com",
                    "first_observed_at": "2026-09-01T03:10:00Z",
                    "claimed_published_at": "2026-09-01T00:00:00Z"
                  }
                ],
                "groups": [
                  "akira"
                ],
                "status": "ok",
                "vendor": "example.com",
                "actions": [
                  "Ask the vendor in writing whether they had a security incident, what data was involved and whether your data was in scope."
                ],
                "claim_count": 1,
                "newest_claim_at": "2026-09-01T00:00:00Z",
                "oldest_claim_at": "2026-09-01T00:00:00Z"
              },
              {
                "kind": "name",
                "risk": "none_found",
                "found": false,
                "claims": [],
                "groups": [],
                "status": "ok",
                "vendor": "Example Org",
                "actions": [
                  "No claim found in the licensed sources. Keep normal monitoring; this is not proof the vendor was never attacked."
                ],
                "claim_count": 0,
                "newest_claim_at": null,
                "oldest_claim_at": null
              }
            ]
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method"
            ],
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "type": "object",
                "required": [
                  "vendors"
                ],
                "properties": {
                  "vendors": {
                    "type": "string",
                    "maxLength": 12000,
                    "description": "Vendor domains or company names separated by newlines or semicolons, max 100, e.g. acme.com;Example Corp"
                  }
                }
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

3USDC≈ $3 USD
on Base · exact scheme

Pay 3 USDC on Base to 0x2dAF…D65dD. The signed payment is good for 2 minutes.

Paid to
0x2dAF…D65dD
USD Coin contract
0x8335…02913
Payment window
2 minutes
As published
3000000 smallest units
The catalog’s raw entry
[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
    "amount": "3000000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 120
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "type": "http",
        "method": "GET",
        "queryParams": {
          "vendors": "example.com;Example Org"
        }
      },
      "output": {
        "type": "json",
        "example": {
          "label": "unverified claim from a criminal leak site",
          "report": "vendor_ransomware_risk",
          "summary": {
            "by_risk": {
              "high": 1,
              "unknown": 0,
              "elevated": 0,
              "historical": 0,
              "none_found": 1
            },
            "partial": false,
            "headline": "1 of 2 vendors were named in a ransomware leak-site claim in the last 90 days. Start with them.",
            "overall_risk": "high",
            "groups_involved": [
              {
                "group": "akira",
                "vendors": 1
              }
            ],
            "vendors_checked": 2,
            "priority_vendors": [
              {
                "risk": "high",
                "groups": [
                  "akira"
                ],
                "vendor": "example.com",
                "newest_claim_at": "2026-09-01T00:00:00Z"
              }
            ],
            "vendors_with_claims": 1
          },
          "vendors": [
            {
              "kind": "domain",
              "risk": "high",
              "found": true,
              "claims": [
                {
                  "group": "akira",
                  "label": "unverified claim from a criminal leak site",
                  "sector": "Technology",
                  "country": "United States",
                  "sources": [
                    {
                      "url": "https://www.ransomlook.io/",
                      "name": "RansomLook",
                      "license": "CC BY 4.0",
                      "license_url": "https://creativecommons.org/licenses/by/4.0/"
                    }
                  ],
                  "website": "example.com",
                  "organization": "example.com",
                  "first_observed_at": "2026-09-01T03:10:00Z",
                  "claimed_published_at": "2026-09-01T00:00:00Z"
                }
              ],
              "groups": [
                "akira"
              ],
              "status": "ok",
              "vendor": "example.com",
              "actions": [
                "Ask the vendor in writing whether they had a security incident, what data was involved and whether your data was in scope."
              ],
              "claim_count": 1,
              "newest_claim_at": "2026-09-01T00:00:00Z",
              "oldest_claim_at": "2026-09-01T00:00:00Z"
            },
            {
              "kind": "name",
              "risk": "none_found",
              "found": false,
              "claims": [],
              "groups": [],
              "status": "ok",
              "vendor": "Example Org",
              "actions": [
                "No claim found in the licensed sources. Keep normal monitoring; this is not proof the vendor was never attacked."
              ],
              "claim_count": 0,
              "newest_claim_at": null,
              "oldest_claim_at": null
            }
          ]
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method"
          ],
          "properties": {
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "GET"
              ],
              "type": "string"
            },
            "queryParams": {
              "type": "object",
              "required": [
                "vendors"
              ],
              "properties": {
                "vendors": {
                  "type": "string",
                  "maxLength": 12000,
                  "description": "Vendor domains or company names separated by newlines or semicolons, max 100, e.g. acme.com;Example Corp"
                }
              }
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog
2026-10-24 15:01Z
Last indexed by Roundhouse
2026-10-26 22:40Z
Last enriched (probe, favicon, geo)
2026-10-24 19:16Z
x402 version
2
Max timeout
120s
Liveness probe
HTTP 402
Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 4 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md
Show the prompt
Using Roundhouse, look up the x402 service Dragons Eye Lookup and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=Dragons%20Eye%20Lookup'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://api.ransomware-tracker.com/v1/vendor-report, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.