# Dragons Eye Ransomware Group Intel Lookup

> Dragons Eye Ransomware Group Intel Lookup is a paid API for AI agents from api.ransomware-tracker.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-27).

Returns comprehensive ransomware group intelligence including leak-site activity, momentum status, reported tools, co-mentioned malware/techniques/CVEs, recent headlines, and D3FEND defenses for a named group.

## Facts

- Endpoint: GET https://api.ransomware-tracker.com/v1/group-intel?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dragons-eye-ransomware-group-intel-lookup-cca2b4a5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_52oFOEaN2truCDcwsNqBT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dragons-eye-ransomware-group-intel-lookup-cca2b4a5
```

Example prompt: Pull the full threat intel profile for the Akira ransomware group — I want their leak-site momentum, reported tools, ATT&CK techniques, recent victim headlines, and any suggested D3FEND defenses.

## When to prefer this

Choose this endpoint when you need a comprehensive, single-call intelligence bundle for one specific ransomware group — covering leak-site activity, momentum trend, tooling, ATT&CK mapping, and defensive guidance. Prefer this over the group-profile endpoint (which only covers aliases and first-seen) or the recent-claims endpoint (which is time-based, not group-centric). Best for threat briefings, defense playbook creation, or SOC triage on a named threat actor.

## Known failure modes

- Group not yet cached — returns a non-200 or partial response indicating the group needs to be queued for processing
- Unknown or misspelled group name returns empty or error response
- Group name too short (under 2 chars) or too long (over 60 chars) triggers schema validation failure
- Groups with very little public reporting may return sparse co-mention fields
- Rate limiting or payment failure returns 402 or 429 status

## How this service works

Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof.

## Output

A JSON object containing: the group name, momentum metrics (30-day claim count, lifetime average, ratio, and status like 'rising'/'falling'), leak-site metadata (active status, first listing date, total listings, recent victim entries with sector and timestamp), recent news headlines with publisher and URL, a list of reported tools (e.g. Mimikatz, AnyDesk), and co-mentioned entities from public reporting including malware families, ATT&CK technique IDs, campaigns, and CVEs — each with occurrence counts. Also includes suggested D3FEND defensive countermeasures.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "maxLength": 60,
       "minLength": 2,
       "description": "Group name, e.g. akira, qilin, lockbit5"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "group": "akira",
  "momentum": {
   "ratio": 1.49,
   "status": "rising",
   "claims_last_30d": 60,
   "avg_claims_per_30d_lifetime": 40.2
  },
  "leak_site": {
   "label": "unverified claim from a criminal leak site",
   "active": true,
   "first_listing": "2023-04-12T00:00:00+00:00",
   "total_listings": 1644,
   "recent_listings": [
    {
     "sector": "Manufacturing",
     "victim": "Example Co",
     "listed_at": "2026-10-15T13:24:36Z"
    }
   ]
  },
  "reporting": {
   "headlines": [
    {
     "url": "https://example.com/a",
     "title": "Example headline",
     "publisher": "example.com",
     "published_at": "2026-10-13T14:16:09Z"
    }
   ]
  },
  "tools_reported": [
   "Mimikatz",
   "AnyDesk"
  ],
  "co_mentioned_in_reporting": {
   "malware": [
    {
     "name": "Cobalt Strike",
     "count": 7
    }
   ],
   "attack_techniques": [
    {
     "name": "T1486 - Data Encrypted for Impact",
     "count": 12
    }
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dragons-eye-ransomware-group-intel-lookup-cca2b4a5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.ransomware-tracker.com](https://www.zero.xyz/host/api.ransomware-tracker.com/llms.txt)