# Dragons Eye Bulk Threat Indicator Check

> Dragons Eye Bulk Threat Indicator Check is a paid API for AI agents from api.ransomware-tracker.com, paid per call via x402, $0.25/call, status unknown (last checked 2026-10-27).

Checks up to 100 domains or IPv4 addresses in a single call against a high-confidence ransomware/C2 threat feed, returning match verdicts and threat intelligence per indicator.

## Facts

- Endpoint: GET https://api.ransomware-tracker.com/v1/indicator-batch?utm_source=zero.xyz
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dragons-eye-bulk-threat-indicator-check-31d747dc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TOY2uRYdBP-o8IDGZ7by8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dragons-eye-bulk-threat-indicator-check-31d747dc
```

Example prompt: Can you check these 50 domains and IPs against the Dragons Eye ransomware threat feed and tell me which ones are flagged as malicious — here's the list: bad1.example.com, 192.0.2.1, evil2.example.net, ...

## When to prefer this

Use this endpoint when you need to screen more than one but up to 100 domains or IPv4 addresses in a single API call at a flat price, making it more cost-efficient and faster than calling the single-indicator endpoint repeatedly. Prefer this over the single /v1/indicator-check endpoint whenever you have a batch of IOCs to triage in bulk, such as during incident response, log analysis, or vendor screening workflows.

## Known failure modes

- 503 Service Unavailable returned when the threat feed is stale — call is not charged in this case
- Invalid or malformed indicators may be skipped or return no match
- Exceeding 100 indicators per call may result in an error or truncation
- Network timeout if the batch is large and response takes too long
- Payment failure via x402 protocol prevents the call from completing

## How this service works

Dragons Eye Lookup: Bulk threat-indicator check: up to 100 domains or IPv4 addresses in one call. Same check as /v1/indicator-check for up to 100 domains/IPv4 addresses (comma-, semicolon- or newline-separated). One flat price. Stale feed -> 503, not charged.

## Output

Returns a JSON object with a results array — one entry per indicator — each containing a verdict ('listed' or 'clean'), match details (match type, reason, confidence, listed value), associated threat source URLs and publisher info, ThreatCluster campaign references, and feed metadata (confidence level, refresh time, feed size). Also returns top-level item_count and listed_count summaries.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "q"
     ],
     "properties": {
      "q": {
       "type": "string",
       "maxLength": 30000,
       "description": "Up to 100 domains or IPv4 addresses separated by commas, semicolons or newlines"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "results": [
   {
    "feed": {
     "confidence": "high",
     "refreshed_at": "2026-10-17T06:07:00Z",
     "window_hours": 720,
     "indicators_in_feed": 831
    },
    "matches": [
     {
      "match": "exact_domain",
      "reason": "Listed as a C2 server in a threat report",
      "sources": [
       {
        "url": "https://example.com/report",
        "title": "Example report",
        "publisher": "Example Labs",
        "published_at": "2026-10-08 11:13:46+00:00"
       }
      ],
      "clusters": [
       {
        "url": "https://threatcluster.io/cluster/example",
        "title": "Example malware campaign",
        "cluster_id": "10809d58-4fc2-411d-9b88-efece0536531"
       }
      ],
      "confidence": "high",
      "listed_type": "domain",
      "listed_value": "bad.example"
     }
    ],
    "verdict": "listed",
    "indicator": {
     "type": "domain",
     "value": "bad.example"
    },
    "match_count": 1
   }
  ],
  "item_count": 2,
  "listed_count": 1
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dragons-eye-bulk-threat-indicator-check-31d747dc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.ransomware-tracker.com](https://www.zero.xyz/host/api.ransomware-tracker.com/llms.txt)