---
title: "Check a domain against ransomware leak sites"
method: POST
path: "/v1/metered/ransomware-risk"
tags: ["Vendor and organisation risk"]
---

# Check a domain against ransomware leak sites

`POST /v1/metered/ransomware-risk`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/ransomware-risk`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Queries 100+ active ransomware group leak sites for a victim listing, and counts credentials for the domain that appeared in stealer logs before the incident -- the pre-attack reconnaissance signal.

**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `domain` string, required: Domain to check. A leading `www.` is stripped.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `domain` string: The normalised domain.
    - `on_victim_list` boolean: True when claimed by at least one ransomware group.
    - `victim_groups` string[]: Groups claiming the victim.
    - `first_seen` string: Earliest listing date. Empty when not listed.
    - `pre_ransomware_ioc_count` integer: Credentials for this domain seen in stealer logs before the incident.
    - `risk_level` 'CRITICAL' | 'HIGH' | 'CLEAN': CRITICAL when listed, HIGH when only pre-ransomware credentials exist, otherwise CLEAN.
    - `recommendation` string: Recommended action.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: `domain` is missing or contains no '.'.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `500`: Ransomware victim query failed.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)