# Dragons Eye Watchlist

> Dragons Eye Watchlist is a paid API for AI agents from dragonseye-watchlist.dario-9fa.workers.dev, paid per call via x402, $2/call, status unknown (last checked 2026-10-31).

Creates a 30-day ransomware leak-site watchlist monitoring up to 25 domains and sending signed webhook alerts on new claims

## Facts

- Endpoint: POST https://dragonseye-watchlist.dario-9fa.workers.dev/v1/watchlists?utm_source=zero.xyz
- Price: $2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dragons-eye-watchlist-528fd2ed
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_nIOYM6PRXDUG6Pr-lttvv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dragons-eye-watchlist-528fd2ed -d '<json body>'
```

Example prompt: Set up a 30-day ransomware leak-site watch on acme-corp.com, supplier-xyz.com, and partnerco.net — send alerts to https://alerts.mycompany.com/webhook if any of them show up in a new claim.

## When to prefer this

Choose this endpoint when you need near-real-time (15-minute polling) ransomware leak-site claim alerts delivered as signed webhooks for a batch of up to 25 specific domains, especially for SOC automation, MSSP client monitoring, or M&A due diligence scenarios. It is purpose-built for ransomware threat intelligence from commercially reusable sources and is priced as a flat $2 USDC one-time fee per 30-day watchlist, making it cost-effective for multi-domain coverage. Prefer alternatives if you need broader dark web monitoring beyond ransomware leak sites, historical claim lookups, or real-time streaming rather than webhook delivery.

## Known failure modes

- Invalid or non-HTTPS webhook_url causes rejection
- More than 25 entries submitted returns validation error
- Missing required domain field on any entry causes rejection
- Payment not completed or insufficient USDC balance blocks watchlist creation
- Webhook delivery fails if the target URL is unreachable or returns non-2xx — no guaranteed retry SLA disclosed
- Alerts are unverified criminal claims — false positives possible
- Watchlist expires after 30 days with no auto-renewal
- manage_token and webhook_secret shown only once at creation; loss is unrecoverable

## How this service works

Watch up to 25 domains for 30 days for new ransomware leak-site claims. $2.00 USDC on Base, paid once. Checked every 15 minutes; on a domain or exact-name match you get a signed webhook. Validate entries free first at POST /v1/watchlists/validate. Alerts are unverified claims from criminal leak sites, commercially reusable sources only.

## Output

Returns a watchlist object with a unique watchlist_id, manage_url, a one-time manage_token and webhook_secret for validating signed callbacks, the list of accepted entries with their matching mode (domain only, or domain+name), any rejected entries, and an expires_at timestamp 30 days out. Every 15 minutes the service polls ransomware leak sites; on a domain or name match it delivers a signed POST to the configured webhook_url.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "entries": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "domain"
    ],
    "properties": {
     "name": {
      "type": "string",
      "maxLength": 120
     },
     "domain": {
      "type": "string"
     }
    }
   },
   "maxItems": 25,
   "minItems": 1
  },
  "delivery": {
   "type": "object",
   "properties": {
    "webhook_url": {
     "type": "string",
     "description": "Public HTTPS URL"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "status": "active",
  "entries": [
   {
    "name": null,
    "domain": "example.com",
    "matches_by": "domain only"
   }
  ],
  "delivery": {
   "webhook_url": "https://example.com/hook"
  },
  "rejected": [],
  "expires_at": "2026-11-23T00:00:00.000Z",
  "manage_url": "https://dragonseye-watchlist.dario-9fa.workers.dev/v1/watchlists/wl_abcdefghijklmnop",
  "manage_token": "<shown once>",
  "watchlist_id": "wl_abcdefghijklmnop",
  "webhook_secret": "<shown once>"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dragons-eye-watchlist-528fd2ed/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dragonseye-watchlist.dario-9fa.workers.dev](https://www.zero.xyz/host/dragonseye-watchlist.dario-9fa.workers.dev/llms.txt)