{"uid":"cap_PXyAjnXX-H2L0dBbltmzz","slug":"relayshield-ransomware-risk-check-2a8aa841","name":"RelayShield Ransomware Risk Check","description":"RelayShield Landing Site","url":"https://api.relayshield.net/v1/payg/ransomware-risk","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"domain":{"type":"string","description":"Domain to check against the ransomware victim list"}}},"responseSchema":{"type":"json","example":{"ok":true,"data":{"domain":"acme.com","on_victim_list":false,"pre_ransomware_credential_count":0}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.4","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.4/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.4","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.4","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_IDSkxCdRYZWmclQrd3C4C","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.4","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a given domain appears on known ransomware victim lists and returns associated pre-ransomware credential exposure counts","exampleAgentPrompt":"Can you check if acme.com appears on any ransomware victim lists and tell me how many pre-ransomware credentials have been exposed for that domain?","exampleUseCases":[{"title":"Vendor due diligence ransomware screening","prompt":"Before we onboard supplierco.com as a vendor, can you check if they've ever appeared on a ransomware victim list and how many pre-breach credentials are associated with their domain?"},{"title":"Incident response domain triage","prompt":"We're investigating a potential breach — can you check if contoso.com is on any ransomware victim lists and whether there were credential leaks leading up to it?"},{"title":"Portfolio company cyber risk audit","prompt":"Run a ransomware risk check on each of these portfolio company domains — start with techstartup.io — and tell me if any are on victim lists or have pre-ransomware credential exposures."}],"resultDescription":"Returns a JSON object with: the queried domain, a boolean indicating whether it appears on known ransomware victim lists, and an integer count of pre-ransomware credential exposures associated with that domain.","failureModes":["Invalid or malformed domain input returns an error","Domain not found in database returns on_victim_list: false with zero credential count (may be a true negative or data gap)","Payment failure via x402 protocol blocks the request","Rate limiting on high-volume queries","Network timeout if upstream threat intel feeds are slow"],"whenToPreferThis":"Use this endpoint when you need a fast, pay-per-query ransomware victim list check against a specific domain without committing to a subscription threat intelligence platform. It is especially useful for one-off vendor assessments, incident triage, or enriching domain risk profiles in automated workflows where you only need the victim-list status and pre-ransomware credential count rather than a full threat report.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:42:10.110Z","isFirstParty":false}