f3nris
534748f16a
Ransomware.live API v2 — OSINT tracking of ransomware/extortion groups and their claimed victims. 9 read-only commands: recent victims, list groups, group profile, group victims, and search victims by keyword, country, or date, plus recent cyberattacks and a test-connection check. Useful for third-party / supply-chain exposure checks (is a partner or domain listed as a victim?). API key is optional (sent as X-API-KEY when configured; keyless otherwise). stdlib-only Python (urllib), no extra dependencies. category: threat_intel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
44 lines
1.2 KiB
Python
44 lines
1.2 KiB
Python
import json, os, sys, urllib.request, urllib.error
|
|
|
|
DEFAULT_BASE = "https://api.ransomware.live/v2"
|
|
|
|
|
|
def _cfg():
|
|
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
|
|
|
|
|
def _inputs():
|
|
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
|
|
|
|
|
def _get(cfg, path):
|
|
base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
|
|
headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
|
key = str(cfg.get("api_key") or "").strip()
|
|
if key:
|
|
headers["X-API-KEY"] = key
|
|
req = urllib.request.Request(base + path, headers=headers)
|
|
with urllib.request.urlopen(req, timeout=60) as r:
|
|
raw = r.read()
|
|
return json.loads(raw) if raw else None
|
|
|
|
|
|
def _run(fn):
|
|
try:
|
|
print(json.dumps(fn(_cfg(), _inputs())))
|
|
except urllib.error.HTTPError as e:
|
|
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
|
sys.exit(1)
|
|
except Exception as e:
|
|
print(json.dumps({"error": str(e)}))
|
|
sys.exit(1)
|
|
|
|
|
|
def main(cfg, inputs):
|
|
data = _get(cfg, "/groups")
|
|
groups = data if isinstance(data, list) else []
|
|
return {"count": len(groups), "groups": groups}
|
|
|
|
|
|
_run(main)
|