Dragons Eye Lookup

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "offer": {
    "asset": "USDC",
    "input": {
      "type": "http",
      "method": "GET",
      "queryParams": {
        "domains": "example.com,example.org"
      }
    },
    "price": "$0.05",
    "network": "eip155:8453",
    "mime_type": "application/json",
    "how_to_pay": "x402 v2: sign the accepts[0] requirement and retry with the PAYMENT-SIGNATURE header (challenge also in the PAYMENT-REQUIRED header). Invalid input is answered before payment and never charged.",
    "input_schema": {
      "type": "object",
      "required": [
        "type",
        "method"
      ],
      "properties": {
        "type": {
          "type": "string",
          "const": "http"
        },
        "method": {
          "enum": [
            "GET"
          ],
          "type": "string"
        },
        "queryParams": {
          "type": "object",
          "required": [
            "domains"
          ],
          "properties": {
            "domains": {
              "type": "string",
              "maxLength": 4000,
              "description": "Comma-separated domains, max 25, e.g. acme.com,example.org"
            }
          }
        }
      },
      "additionalProperties": false
    },
    "price_atomic": "50000",
    "what_you_get": "Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for company names or more than 25; use /v1/bulk-check.",
    "output_schema": {
      "type": "object",
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string"
        },
        "example": {
          "type": "object"
        }
      }
    },
    "sample_output": {
      "label": "unverified claim from a criminal leak site",
      "errors": 0,
      "partial": false,
      "results": [
        {
          "found": true,
          "claims": [
            {
              "group": "akira",
              "label": "unverified claim from a criminal leak site",
              "sector": "Technology",
              "country": "United States",
              "sources": [
                {
                  "url": "https://www.ransomlook.io/",
                  "name": "RansomLook",
                  "license": "CC BY 4.0",
                  "license_url": "https://creativecommons.org/licenses/by/4.0/"
                }
              ],
              "website": "example.com",
              "organization": "example.com",
              "first_observed_at": "2026-09-01T03:10:00Z",
              "claimed_published_at": "2026-09-01T00:00:00Z"
            }
          ],
          "domain": "example.com",
          "status": "ok",
          "claim_count": 1
        },
        {
          "found": false,
          "claims": [],
          "domain": "example.org",
          "status": "ok",
          "claim_count": 0
        }
      ],
      "domain_count": 2,
      "domains_with_claims": 1
    },
    "related_endpoints": [
      {
        "url": "https://api.ransomware-tracker.com/v1/lookup",
        "price": "$0.01",
        "method": "GET",
        "description": "Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sourc"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/recent",
        "price": "$0.01",
        "method": "GET",
        "description": "Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusabl"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/group",
        "price": "$0.02",
        "method": "GET",
        "description": "Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups r"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/vendor-report",
        "price": "$3",
        "method": "GET",
        "description": "Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/bulk-check",
        "price": "$0.50",
        "method": "GET",
        "description": "Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for ris"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/watch",
        "price": "$0.30",
        "method": "POST",
        "description": "Dragons Eye Lookup: Prepaid vendor ransomware watch: up to 25 vendors for 30 days, webhook on new claims. Pay once; each vendor (domain or company name) is re-checked about once a day for 30 days. Whe"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/indicator-check",
        "price": "$0.01",
        "method": "GET",
        "description": "Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clu"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/indicator-batch",
        "price": "$0.25",
        "method": "GET",
        "description": "Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. "
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/cve",
        "price": "$0.03",
        "method": "GET",
        "description": "Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, publi"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/cve-batch",
        "price": "$0.50",
        "method": "GET",
        "description": "Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment l"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/group-intel",
        "price": "$0.05",
        "method": "GET",
        "description": "Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported to"
      }
    ]
  },
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
      "amount": "50000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 120
    }
  ],
  "resource": {
    "url": "https://api.ransomware-tracker.com/v1/batch",
    "tags": [
      "vendor-risk",
      "third-party-risk",
      "batch",
      "ransomware",
      "supplier-check"
    ],
    "mimeType": "application/json",
    "description": "Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for company names or more than 25; use /v1/bulk-check.",
    "serviceName": "Dragons Eye Lookup"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "method": "GET",
          "queryParams": {
            "domains": "example.com,example.org"
          }
        },
        "output": {
          "type": "json",
          "example": {
            "label": "unverified claim from a criminal leak site",
            "errors": 0,
            "partial": false,
            "results": [
              {
                "found": true,
                "claims": [
                  {
                    "group": "akira",
                    "label": "unverified claim from a criminal leak site",
                    "sector": "Technology",
                    "country": "United States",
                    "sources": [
                      {
                        "url": "https://www.ransomlook.io/",
                        "name": "RansomLook",
                        "license": "CC BY 4.0",
                        "license_url": "https://creativecommons.org/licenses/by/4.0/"
                      }
                    ],
                    "website": "example.com",
                    "organization": "example.com",
                    "first_observed_at": "2026-09-01T03:10:00Z",
                    "claimed_published_at": "2026-09-01T00:00:00Z"
                  }
                ],
                "domain": "example.com",
                "status": "ok",
                "claim_count": 1
              },
              {
                "found": false,
                "claims": [],
                "domain": "example.org",
                "status": "ok",
                "claim_count": 0
              }
            ],
            "domain_count": 2,
            "domains_with_claims": 1
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method"
            ],
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "type": "object",
                "required": [
                  "domains"
                ],
                "properties": {
                  "domains": {
                    "type": "string",
                    "maxLength": 4000,
                    "description": "Comma-separated domains, max 25, e.g. acme.com,example.org"
                  }
                }
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
    "amount": "50000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 120
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "type": "http",
        "method": "GET",
        "queryParams": {
          "domains": "example.com,example.org"
        }
      },
      "output": {
        "type": "json",
        "example": {
          "label": "unverified claim from a criminal leak site",
          "errors": 0,
          "partial": false,
          "results": [
            {
              "found": true,
              "claims": [
                {
                  "group": "akira",
                  "label": "unverified claim from a criminal leak site",
                  "sector": "Technology",
                  "country": "United States",
                  "sources": [
                    {
                      "url": "https://www.ransomlook.io/",
                      "name": "RansomLook",
                      "license": "CC BY 4.0",
                      "license_url": "https://creativecommons.org/licenses/by/4.0/"
                    }
                  ],
                  "website": "example.com",
                  "organization": "example.com",
                  "first_observed_at": "2026-09-01T03:10:00Z",
                  "claimed_published_at": "2026-09-01T00:00:00Z"
                }
              ],
              "domain": "example.com",
              "status": "ok",
              "claim_count": 1
            },
            {
              "found": false,
              "claims": [],
              "domain": "example.org",
              "status": "ok",
              "claim_count": 0
            }
          ],
          "domain_count": 2,
          "domains_with_claims": 1
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method"
          ],
          "properties": {
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "GET"
              ],
              "type": "string"
            },
            "queryParams": {
              "type": "object",
              "required": [
                "domains"
              ],
              "properties": {
                "domains": {
                  "type": "string",
                  "maxLength": 4000,
                  "description": "Comma-separated domains, max 25, e.g. acme.com,example.org"
                }
              }
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-24 14:34Z

Last indexed by Roundhouse

2026-10-26 13:16Z

Last enriched (probe, favicon, geo)

2026-10-24 17:16Z

x402 version

2

Max timeout

120s

Liveness probe

HTTP 402