isMalicious Ransomware API

openapi: 3.2.0
info:
  title: Ismalicious Com Ransomware API
  version: 1.2.0
  contact:
    name: isMalicious Support
    url: https://ismalicious.com/support
    email: contact@ismalicious.com
  license:
    name: Proprietary
    url: https://ismalicious.com/terms
  description: 'Operations tagged ransomware across 2 of this provider''s published API definitions: ismalicious-com-openapi.json, ismalicious-com-openapi2.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.ismalicious.com
  description: Production server
security:
- ApiKeyAuth: []
- BearerAuth: []
- BasicAuth: []
tags:
- name: ransomware
  description: 'Ransomware intelligence from the cached ransomware.live datasets: victims, groups, sectors, press. Authenticated, one request each except `/ransomware/live-quota`'
paths:
  /ransomware/feed:
    get:
      tags:
      - ransomware
      summary: Recent ransomware victims
      description: 'The newest leak-site postings, from the Redis cache the sync jobs fill

        (ransomware.live), normalised to one shape per victim: `group`, `victim`,

        `country`, `sector`, `date`, `screenshot`, `permalink` (the last four

        nullable). With `press=true` each victim also carries

        `press{pressCount, topPressTitle, topPressUrl}`: the articles naming the

        victim in their title, domain or victim field, and the newest of them —

        never the rest of its group''s press. The 200 body is a bare array. Costs

        one request of the monthly quota.'
      operationId: getRansomwareFeed
      parameters:
      - name: limit
        in: query
        description: Number of victims, 1–100 (default 30).
        required: false
        schema:
          type: integer
          minimum: 0
        example: 30
      - name: press
        in: query
        description: '`true` attaches a `press` block to each victim.'
        required: false
        schema:
          type: string
        example: 'true'
      responses:
        '200':
          description: 'Array of victims: `{group, victim, country, sector, date, screenshot, permalink, press?}`'
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/group-profile:
    get:
      tags:
      - ransomware
      summary: Ransomware group profile
      description: 'One threat actor, aggregated from the cached ransomware.live datasets:

        `{name, description, firstSeen, lastSeen, victimCount, attacksThisYear,

        countries[], sectors[], tools, onionSites, recentVictims[],

        totalVictimsFetched, negotiations, yaraRules, pressEntries}`. Nullable

        where a dataset has nothing on the group; 404 when neither TTPs nor

        victims are known. `pressEntries` is newest first: entries attributed to

        the group (or, for `lockbit`, to a numbered release), and unattributed

        ones whose title names it as a ransomware; an entry dated more than a day

        ahead is dropped. Costs one request of the monthly quota.'
      operationId: getRansomwareGroupProfile
      parameters:
      - name: group
        in: query
        description: Group name (required), as listed by `/ransomware/groups`.
        required: false
        schema:
          type: string
        example: lockbit3
      responses:
        '200':
          description: '`{name, description, firstSeen, lastSeen, victimCount, attacksThisYear, countries, sectors, tools, onionSites, recentVictims, totalVictimsFetched, negotiations, yaraRules, pressEntries}`'
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Missing `group`
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Unknown group
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/groups:
    get:
      tags:
      - ransomware
      summary: Ransomware groups
      description: 'Every known group with its victim total (ransomware.live, cached by the

        sync job), sorted by victim count descending, or with `sort=activity` by

        claims posted on its leak site in the last 30 days. When the claim history

        is cached, each group also carries `claims30d`, `claimsPrev30d` (the 30

        days before), `lastClaimAt` and `firstClaimAt` (RFC 3339, null without a

        dated claim), and `activity` gives the window: `{computedAt, dataAt,

        windowDays, windowClaims, previousWindowClaims, activeGroups}` (null

        otherwise). Duplicate postings of one victim on one day count once.

        `total` is the number of groups known, `limit` the effective page size.

        Costs one request of the monthly quota.'
      operationId: getRansomwareGroups
      parameters:
      - name: limit
        in: query
        description: Number of groups, 1–500 (default 100; `0` means the default).
        required: false
        schema:
          type: integer
          minimum: 0
        example: 100
      - name: sort
        in: query
        description: '`victims` (default): by all-time victim count. `activity`: by claims

          in the last 30 days, then the latest claim.'
        required: false
        schema:
          type: string
        example: activity
      responses:
        '200':
          description: '`{"groups": [{"name", "victimCount", "claims30d", "claimsPrev30d", "lastClaimAt", "firstClaimAt"}], "total", "limit", "activity"}`'
          headers:
            Cache-Control:
              schema:
                type: string
              description: Always `public, s-maxage=300, stale-while-revalidate=600`
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: No group data cached yet
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/live-quota:
    get:
      tags:
      - ransomware
      summary: ransomware.live call budget
      description: 'How much of this month''s upstream ransomware.live call budget is used:

        `{used, cap, remaining, percent, circuitOpen, month ("YYYY-MM"),

        metric}`. **Not metered** — asking whether one may call is free.'
      operationId: getRansomwareLiveQuota
      responses:
        '200':
          description: '`{used, cap, remaining, percent, circuitOpen, month, metric}`'
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/press:
    get:
      tags:
      - ransomware
      summary: Ransomware press
      description: 'Recent cyberattack press coverage from the cached ransomware.live

        `/press/all` dataset, newest first, entries dated more than a day ahead

        dropped: `{"entries": [{title, date, source,

        country, url, ransomwareGroup, infostealerRelated, description}],

        "total"}` where `total` counts the returned entries. Costs one request of

        the monthly quota.'
      operationId: getRansomwarePress
      parameters:
      - name: limit
        in: query
        description: Number of entries, 1–100 (default 50).
        required: false
        schema:
          type: integer
          minimum: 0
        example: 50
      - name: groups
        in: query
        description: 'Comma-separated group names; keeps entries attributed to one of them,

          or unattributed with a title naming one as a ransomware

          ("Play ransomware …").'
        required: false
        schema:
          type: string
        example: lockbit,akira
      responses:
        '200':
          description: '`{"entries": [{title, date, source, country, url, ransomwareGroup, infostealerRelated, description}], "total"}`'
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/sector-risk:
    get:
      tags:
      - ransomware
      summary: Sector risk
      description: 'Sector risk analysis from the Redis indexes the sync job builds (no live

        HTTP). With `sector`, the 200 body is that sector''s cached object (keys

        owned by the sync job, among them `sector`, `attacksThisMonth`,

        `topGroups[{name, …}]`); 404 when nothing is cached for it. Without

        `sector`, `{"sectors": […]}` holds every cached sector sorted by

        `attacksThisMonth` descending, each carrying `press{sector,

        recentPressCount, latestPressDate, topPressTitle, topPressUrl,

        topCitedGroups[{name, count}]}` when `press=true`: the articles about one

        of the sector''s top groups (attributed to it, or unattributed with a title

        naming it as a ransomware) or naming the sector. Costs one request of the

        monthly quota.'
      operationId: getRansomwareSectorRisk
      parameters:
      - name: sector
        in: query
        description: One sector name; omitted, every sector is returned under `sectors`.
        required: false
        schema:
          type: string
        example: healthcare
      - name: press
        in: query
        description: '`true` attaches a `press` block to each sector (all-sectors form only).'
        required: false
        schema:
          type: string
        example: 'true'
      responses:
        '200':
          description: 'One sector object (`sector=`) or `{"sectors": […]}`'
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: '`sector=` set and nothing cached for it'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Sector list not cached yet
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/sector-risk/history:
    get:
      tags:
      - ransomware
      summary: Sector risk history
      description: 'Daily sector-risk snapshots over the window: `{"snapshots": [{date,

        sectors: […]}], "days", "availableDates"}`. Each snapshot''s `sectors`

        are the sector objects as cached that day. Degrades instead of failing:

        a Redis error yields `snapshots: []` with a 200. Costs one request of

        the monthly quota.'
      operationId: getRansomwareSectorRiskHistory
      parameters:
      - name: days
        in: query
        description: Window in days, 1–120 (default 30).
        required: false
        schema:
          type: integer
          format: int64
        example: 30
      - name: sector
        in: query
        description: Keep only this sector inside each snapshot (case-insensitive).
        required: false
        schema:
          type: string
        example: healthcare
      responses:
        '200':
          description: '`{"snapshots": [{date, sectors}], "days", "availableDates"}`'
          headers:
            Cache-Control:
              schema:
                type: string
              description: Always `public, s-maxage=0, stale-while-revalidate=3600`
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/sector-victims:
    get:
      tags:
      - ransomware
      summary: Sector victims
      description: 'Drill-down for one sector: `{sector, name, riskLevel, attacksThisMonth,

        attacksThisYear, totalKnown, recentVictims[], topGroups[{name, count,

        description, firstSeen, lastSeen, victimCount, countries, tools}]}`.

        `recentVictims` are the raw cached victim documents, newest claim first.

        Costs one request of the monthly quota.'
      operationId: getRansomwareSectorVictims
      parameters:
      - name: sector
        in: query
        description: Sector name (required; normalised through the sector taxonomy).
        required: false
        schema:
          type: string
        example: healthcare
      responses:
        '200':
          description: '`{sector, name, riskLevel, attacksThisMonth, attacksThisYear, totalKnown, recentVictims[], topGroups[]}`'
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Missing `sector`
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: No victims cached for this sector
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
  /ransomware/stats:
    get:
      tags:
      - ransomware
      summary: Ransomware statistics
      description: 'The aggregate the sync job writes under `ransomware:stats`, returned as

        is — a free-form object whose keys follow the sync job, not this handler.

        Costs one request of the monthly quota.'
      operationId: getRansomwareStats
      responses:
        '200':
          description: Cached statistics object, shape owned by the sync job
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Statistics not cached yet
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
components:
  schemas:
    ErrorResponse:
      type: object
      description: Error response. Some handlers return only `error`.
      required:
      - error
      properties:
        error:
          type: string
          description: Error type
          example: Bad Request
        message:
          type:
          - string
          - 'null'
          description: Detailed error message (not always present)
          example: 'Missing required parameter: query'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-KEY
      description: Base64 encoded `apiKey:apiSecret`. Get your keys from https://ismalicious.com/app/account
    BasicAuth:
      type: http
      scheme: basic
      description: 'Username = apiKey, password = apiSecret. Legacy: any username, password = Base64(apiKey:apiSecret).'
    BearerAuth:
      type: http
      scheme: bearer
      description: '`Authorization: Bearer <token>` where token = Base64(apiKey:apiSecret) — the same credential as X-API-KEY.'
    sessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-authjs.session-token
      description: Authenticated browser session. The claim endpoint also requires a verified email in the database; organization API keys cannot claim watches.
x-refined-from:
- ismalicious-com-openapi.json
- ismalicious-com-openapi2.json