# Dragons Eye Ransomware Leak-Site Lookup

> Dragons Eye Ransomware Leak-Site Lookup is a paid API for AI agents from dragonseye-lookup.dario-9fa.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-14).

Looks up ransomware group claims against a company name or domain, returning group identity, dates, sector, country, and source attribution from criminal leak sites.

## Facts

- Endpoint: GET https://dragonseye-lookup.dario-9fa.workers.dev/v1/lookup?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dragons-eye-ransomware-leak-site-lookup-39ff346c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_yd0wEcCx3ZqzDSdsBMgSC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dragons-eye-ransomware-leak-site-lookup-39ff346c
```

Example prompt: Can you check if 'Acme Corp' or acme.com has been listed on any ransomware leak sites — I need to know which group claimed them, when, and what sector they're in?

## When to prefer this

Use this endpoint when you need rapid, low-cost lookup of whether a specific company or domain has been claimed by a ransomware group on criminal leak sites, especially for vendor due diligence, incident triage, or threat intelligence enrichment. It is purpose-built for ransomware victimology lookups with commercially reusable CC BY 4.0 source attribution, making it suitable for inclusion in reports and products. Prefer this over broader threat intelligence platforms when the specific need is ransomware leak-site claims by company or domain identifier.

## Known failure modes

- No claims found for the queried company or domain (found: false, empty claims array)
- Query string too short (under 3 characters) or too long (over 120 characters) returns validation error
- Ambiguous company name may return zero or unrelated claims if the name does not match indexed leak-site data
- Upstream ransomware intelligence data may be stale or incomplete for recently posted claims
- Payment failure via x402 protocol results in 402 response and no data returned

## How this service works

Dragons Eye Lookup: Ransomware leak-site claim lookup by company name or domain. Returns ransomware-group claims (group, dates, country, sector, sources) matching the company or domain. Unverified claims from criminal leak sites; commercially reusable sources only.

## Output

Returns a JSON object indicating whether claims were found, the query kind (company or domain), total claim count, and an array of individual claims each containing: ransomware group name, sector, country, first observed date, claimed publish date, organization name, website, and source attribution (name, license, URL). All results are labeled as unverified claims from criminal leak sites.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "q"
     ],
     "properties": {
      "q": {
       "type": "string",
       "maxLength": 120,
       "minLength": 3,
       "description": "Company name or domain, e.g. 'Acme Corp' or acme.com"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "found": true,
  "label": "unverified claim from a criminal leak site",
  "query": {
   "kind": "domain",
   "value": "example.com"
  },
  "claims": [
   {
    "group": "akira",
    "label": "unverified claim from a criminal leak site",
    "sector": "Technology",
    "country": "United States",
    "sources": [
     {
      "url": "https://www.ransomlook.io/",
      "name": "RansomLook",
      "license": "CC BY 4.0",
      "license_url": "https://creativecommons.org/licenses/by/4.0/"
     }
    ],
    "website": "example.com",
    "organization": "example.com",
    "first_observed_at": "2026-09-01T03:10:00Z",
    "claimed_published_at": "2026-09-01T00:00:00Z"
   }
  ],
  "claim_count": 1
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dragons-eye-ransomware-leak-site-lookup-39ff346c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dragonseye-lookup.dario-9fa.workers.dev](https://www.zero.xyz/host/dragonseye-lookup.dario-9fa.workers.dev/llms.txt)