<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Analyzing Ransomware Payment Infrastructure — API Reference

## Blockchain.info API (BTC)

```bash
# Address summary
curl -s "https://blockchain.info/rawaddr/$ADDR"

# Single transaction
curl -s "https://blockchain.info/rawtx/$TX_HASH"

# Current BTC price
curl -s "https://blockchain.info/ticker" | jq '.USD.last'
```

## Blockchair API (Multi-Chain)

```bash
# BTC address dashboard
curl -s "https://api.blockchair.com/bitcoin/dashboards/address/$ADDR"

# Transaction details
curl -s "https://api.blockchair.com/bitcoin/dashboards/transaction/$TX_HASH"

# ETH address (for Tornado Cash monitoring)
curl -s "https://api.blockchair.com/ethereum/dashboards/address/$ADDR"
```

## Ransomwhere API

```bash
# All known payments
curl -s "https://api.ransomwhe.re/transactions"

# By ransomware group
curl -s "https://api.ransomwhe.re/group"

# By specific family
curl -s "https://api.ransomwhe.re/family/LockBit"
```

## OFAC SDN List

```bash
# Download CSV
curl -s "https://www.treasury.gov/ofac/downloads/sdn.csv" -o sdn.csv

# Search for crypto address
grep -i "$WALLET" sdn.csv

# Online search
# https://sanctionssearch.ofac.treas.gov/
```

## BTC Address Patterns

| Type | Pattern | Example Prefix |
|------|---------|---------------|
| P2PKH | `[13][a-km-zA-HJ-NP-Z1-9]{25,34}` | `1A1zP5...` |
| P2SH | `3[a-km-zA-HJ-NP-Z1-9]{25,34}` | `3J98t1...` |
| Bech32 | `bc1[a-z0-9]{39,59}` | `bc1qw5...` |
| Taproot | `bc1p[a-z0-9]{58}` | `bc1pmz...` |

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `wallet_address` | Cryptocurrency address | `bc1q...` |
| `tx_hash` | Transaction hash | `abc123...` |
| `family` | Ransomware family name | `LockBit` |
| `blockchain` | Target blockchain | `bitcoin`, `monero` |
