# Dragons Eye Ransomware Tracker - Vendor Report > Dragons Eye Ransomware Tracker - Vendor Report is a paid API for AI agents from api.ransomware-tracker.com, paid per call via x402, $3/call, status unknown (last checked 2026-10-16). Checks up to 100 vendor domains or company names against ransomware leak-site claims and returns per-vendor risk ratings, involved ransomware groups, claim details, and recommended actions. ## Facts - Endpoint: GET https://api.ransomware-tracker.com/v1/vendor-report?utm_source=zero.xyz - Price: $3/call - Payment: x402 - Status: unknown - Last checked: 2026-10-16 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/dragons-eye-ransomware-tracker-vendor-report-336b80f7 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZSMzibhe-Fz1PiD4rwByX Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability dragons-eye-ransomware-tracker-vendor-report-336b80f7 ``` Example prompt: Can you run a ransomware exposure check on these vendors for me: acme.com, globex.com, and Initech Corp — I want to know if any of them have appeared on ransomware leak sites and which groups were involved. ## When to prefer this Use this endpoint when you need batch ransomware exposure screening for multiple vendors (up to 100) at once, want structured per-vendor risk ratings with recommended follow-up actions, and need claim details attributed to specific ransomware groups with source licensing info. Prefer this over single-lookup endpoints when doing supply-chain audits, pre-contract due diligence, or SOC triage across a vendor list. ## Known failure modes - Too many vendors submitted (over 100) causing a validation error - Malformed vendor list (incorrect delimiter or encoding) leading to a parse error - Vendor name ambiguity resulting in no match when a match exists - Claim data may be delayed relative to live leak sites - No claims found does not mean the vendor was never attacked — only that no licensed source recorded a claim - Payment failure (insufficient USDC balance) blocking the request - Temporary upstream data source unavailability returning partial results ## How this service works Public ransomware intelligence: live monitoring of leak-site victim claims, a directory of tracked ransomware groups, sector and geography statistics, MITRE ATT&CK context, and activity trends — for defenders, researchers, and SOC analysts. ## Output Returns a per-vendor breakdown with a risk level (high, elevated, historical, none_found, unknown), matched ransomware groups, individual claim details (sector, country, organization, first observed, claimed published date, source attribution), and recommended actions. Also includes an aggregated summary with overall risk, a priority vendor list, group tallies, and a plain-English headline. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "vendors" ], "properties": { "vendors": { "type": "string", "maxLength": 12000, "description": "Vendor domains or company names separated by newlines or semicolons, max 100, e.g. acme.com;Example Corp" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object" } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "unverified claim from a criminal leak site", "report": "vendor_ransomware_risk", "summary": { "by_risk": { "high": 1, "unknown": 0, "elevated": 0, "historical": 0, "none_found": 1 }, "partial": false, "headline": "1 of 2 vendors were named in a ransomware leak-site claim in the last 90 days. Start with them.", "overall_risk": "high", "groups_involved": [ { "group": "akira", "vendors": 1 } ], "vendors_checked": 2, "priority_vendors": [ { "risk": "high", "groups": [ "akira" ], "vendor": "example.com", "newest_claim_at": "2026-09-01T00:00:00Z" } ], "vendors_with_claims": 1 }, "vendors": [ { "kind": "domain", "risk": "high", "found": true, "claims": [ { "group": "akira", "label": "unverified claim from a criminal leak site", "sector": "Technology", "country": "United States", "sources": [ { "url": "https://www.ransomlook.io/", "name": "RansomLook", "license": "CC BY 4.0", "license_url": "https://creativecommons.org/licenses/by/4.0/" } ], "website": "example.com", "organization": "example.com", "first_observed_at": "2026-09-01T03:10:00Z", "claimed_published_at": "2026-09-01T00:00:00Z" } ], "groups": [ "akira" ], "status": "ok", "vendor": "example.com", "actions": [ "Ask the vendor in writing whether they had a security incident, what data was involved and whether your data was in scope." ], "claim_count": 1, "newest_claim_at": "2026-09-01T00:00:00Z", "oldest_claim_at": "2026-09-01T00:00:00Z" }, { "kind": "name", "risk": "none_found", "found": false, "claims": [], "groups": [], "status": "ok", "vendor": "Example Org", "actions": [ "No claim found in the licensed sources. Keep normal monitoring; this is not proof the vendor was never attacked." ], "claim_count": 0, "newest_claim_at": null, "oldest_claim_at": null } ] } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dragons-eye-ransomware-tracker-vendor-report-336b80f7/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from api.ransomware-tracker.com](https://www.zero.xyz/host/api.ransomware-tracker.com/llms.txt)