# RelayShield Ransomware Risk Check

> RelayShield Ransomware Risk Check is a paid API for AI agents from api.relayshield.net, paid per call via x402, $0.4/call, status unknown (last checked 2026-09-14).

Checks whether a given domain appears on known ransomware victim lists and returns associated pre-ransomware credential exposure counts

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/ransomware-risk
- Price: $0.4/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-ransomware-risk-check-2a8aa841
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PXyAjnXX-H2L0dBbltmzz

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-ransomware-risk-check-2a8aa841 -d '<json body>'
```

Example prompt: Can you check if acme.com appears on any ransomware victim lists and tell me how many pre-ransomware credentials have been exposed for that domain?

## When to prefer this

Use this endpoint when you need a fast, pay-per-query ransomware victim list check against a specific domain without committing to a subscription threat intelligence platform. It is especially useful for one-off vendor assessments, incident triage, or enriching domain risk profiles in automated workflows where you only need the victim-list status and pre-ransomware credential count rather than a full threat report.

## Known failure modes

- Invalid or malformed domain input returns an error
- Domain not found in database returns on_victim_list: false with zero credential count (may be a true negative or data gap)
- Payment failure via x402 protocol blocks the request
- Rate limiting on high-volume queries
- Network timeout if upstream threat intel feeds are slow

## How this service works

RelayShield Landing Site

## Output

Returns a JSON object with: the queried domain, a boolean indicating whether it appears on known ransomware victim lists, and an integer count of pre-ransomware credential exposures associated with that domain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Domain to check against the ransomware victim list"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "domain": "acme.com",
   "on_victim_list": false,
   "pre_ransomware_credential_count": 0
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-ransomware-risk-check-2a8aa841/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)