{"uid":"cap_TOY2uRYdBP-o8IDGZ7by8","slug":"dragons-eye-bulk-threat-indicator-check-31d747dc","name":"Dragons Eye Bulk Threat Indicator Check","description":"Dragons Eye Lookup: Bulk threat-indicator check: up to 100 domains or IPv4 addresses in one call. Same check as /v1/indicator-check for up to 100 domains/IPv4 addresses (comma-, semicolon- or newline-separated). One flat price. Stale feed -> 503, not charged.","url":"https://api.ransomware-tracker.com/v1/indicator-batch?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["q"],"properties":{"q":{"type":"string","maxLength":30000,"description":"Up to 100 domains or IPv4 addresses separated by commas, semicolons or newlines"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"results":[{"feed":{"confidence":"high","refreshed_at":"2026-10-17T06:07:00Z","window_hours":720,"indicators_in_feed":831},"matches":[{"match":"exact_domain","reason":"Listed as a C2 server in a threat report","sources":[{"url":"https://example.com/report","title":"Example report","publisher":"Example Labs","published_at":"2026-10-08 11:13:46+00:00"}],"clusters":[{"url":"https://threatcluster.io/cluster/example","title":"Example malware campaign","cluster_id":"10809d58-4fc2-411d-9b88-efece0536531"}],"confidence":"high","listed_type":"domain","listed_value":"bad.example"}],"verdict":"listed","indicator":{"type":"domain","value":"bad.example"},"match_count":1}],"item_count":2,"listed_count":1}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.25","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.25/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.25","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.25","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ERjZHNXOlsCYQjEgJDZ6h","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.25","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks up to 100 domains or IPv4 addresses in a single call against a high-confidence ransomware/C2 threat feed, returning match verdicts and threat intelligence per indicator.","exampleAgentPrompt":"Can you check these 50 domains and IPs against the Dragons Eye ransomware threat feed and tell me which ones are flagged as malicious — here's the list: bad1.example.com, 192.0.2.1, evil2.example.net, ...","exampleUseCases":[{"title":"SOC triage of phishing-reported domains","prompt":"We just got a phishing report with 30 suspicious domains embedded in the email headers — can you run all of them through the Dragons Eye threat feed and tell me which ones are known C2 servers or ransomware infrastructure?"},{"title":"Firewall blocklist validation","prompt":"I have a list of 80 outbound IPs flagged by our SIEM. Can you check them all against the ransomware tracker threat feed so I know which ones are confirmed bad and should be blocked immediately?"},{"title":"Vendor third-party risk screening","prompt":"Before we onboard these new vendors, can you check their 15 domains against the Dragons Eye indicator feed to see if any of them have been associated with ransomware or C2 activity?"}],"resultDescription":"Returns a JSON object with a results array — one entry per indicator — each containing a verdict ('listed' or 'clean'), match details (match type, reason, confidence, listed value), associated threat source URLs and publisher info, ThreatCluster campaign references, and feed metadata (confidence level, refresh time, feed size). Also returns top-level item_count and listed_count summaries.","failureModes":["503 Service Unavailable returned when the threat feed is stale — call is not charged in this case","Invalid or malformed indicators may be skipped or return no match","Exceeding 100 indicators per call may result in an error or truncation","Network timeout if the batch is large and response takes too long","Payment failure via x402 protocol prevents the call from completing"],"whenToPreferThis":"Use this endpoint when you need to screen more than one but up to 100 domains or IPv4 addresses in a single API call at a flat price, making it more cost-efficient and faster than calling the single-indicator endpoint repeatedly. Prefer this over the single /v1/indicator-check endpoint whenever you have a batch of IOCs to triage in bulk, such as during incident response, log analysis, or vendor screening workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T12:59:37.452Z","isFirstParty":false,"canonicalSlug":"dragons-eye-bulk-threat-indicator-check-31d747dc"}