# Ransomware Risk Check

> Ransomware Risk Check is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.4/call, status unknown (last checked 2026-09-14).

Checks whether a domain appears on a ransomware group's victim or leak-site list and whether pre-ransomware credential harvesting was detected beforehand.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/ransomware-risk
- Price: $0.4/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ransomware-risk-check-8533ca45
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VnHCtnfo9MXbRl4ktieJP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ransomware-risk-check-8533ca45 -d '<json body>'
```

Example prompt: Check whether acmecorp.com appears on any known ransomware group leak sites and whether there were any pre-ransomware credential harvesting signals detected for that domain.

## When to prefer this

Choose this endpoint when you need to assess active or historical ransomware exposure for a specific domain, particularly when you want to know both whether a domain appeared on a ransomware leak site AND whether pre-attack credential harvesting was detected. Prefer this over generic breach-check endpoints when ransomware-specific threat intelligence (leak-site listings, group attribution, pre-ransomware infostealer activity) is the primary concern rather than general data breach history.

## Known failure modes

- Domain not found in any ransomware database — returns no-match result
- Invalid or malformed domain input — returns validation error
- Ransomware threat intelligence feed temporarily unavailable — service error
- Rate limiting exceeded — returns HTTP 429
- Payment not processed or insufficient — returns HTTP 402

## How this service works

Check whether a domain appears on a known ransomware group's victim/leak-site list, and whether pre-ransomware credential harvesting was detected beforehand. Call to assess active ransomware exposure for a domain, not just historical breach history.

## Output

Returns whether the queried domain appears on known ransomware group victim or leak-site lists, identifies the specific ransomware group(s) if applicable, and indicates whether pre-ransomware credential harvesting activity was detected for the domain prior to any attack.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Domain to check against the ransomware victim list"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ransomware-risk-check-8533ca45/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)