Dragons Eye Ransomware Claims

Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no network request, no payment.

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "maxLength": 200,
      "description": "Company name or domain to normalize, e.g. 'Acme Corp' or acme.com"
    }
  },
  "required": [
    "q"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carries. No input, no network request, no payment.

{
  "type": "object",
  "properties": {},
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date, country, sector and licensed sources. Use it for a single vendor or target; use batch_exposure_check for a list of up to 25 vendor domains, and recent_claims for the newest claims overall. Every result is an unverified claim from a criminal leak site, not a confirmed breach, and found=false is not proof of absence (only commercially reusable sources are covered). Read-only, live lookup. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "Company name or domain, e.g. 'Acme Corp' or acme.com (3-120 chars)"
    }
  },
  "required": [
    "q"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim to search for a specific company. Only commercially reusable sources are used, so country and sector are often null. Every result is an unverified claim from a criminal leak site, not a confirmed breach. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "group": {
      "description": "Ransomware group name, e.g. akira, qilin",
      "type": "string",
      "maxLength": 60
    },
    "limit": {
      "description": "Max claims to return (1-10, default 10)",
      "type": "integer",
      "minimum": 1,
      "maximum": 10
    }
  },
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use recent_claims for a longer list of its latest claims. Unknown groups return an error and are not charged. Every claim is an unverified claim from a criminal leak site, not a confirmed breach. Read-only. Costs $0.02 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "group": {
      "type": "string",
      "minLength": 1,
      "maxLength": 60,
      "description": "Ransomware group name or alias, e.g. akira"
    }
  },
  "required": [
    "group"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}

Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim count, claims with group, dates and sources). Domains only; use lookup_victim for company names. At most 15 claim records are read per batch, so a domain with many matches is marked partial. Every result is an unverified claim from a criminal leak site, not a confirmed breach; found=false is not proof of absence. Read-only; one flat price. Costs $0.05 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

{
  "type": "object",
  "properties": {
    "domains": {
      "minItems": 1,
      "maxItems": 25,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 260
      },
      "description": "Vendor/supplier domains to check, 1-25, e.g. [\"acme.com\", \"example.org\"]"
    }
  },
  "required": [
    "domains"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}