<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing Ransomware Threat Intelligence — API Reference

## abuse.ch API Endpoints

| Endpoint | Method | Description |
|----------|--------|-------------|
| `bazaar.abuse.ch/export/json/recent/` | GET | Recent malware samples |
| `threatfox-api.abuse.ch/api/v1/` | POST | IOC search by tag |
| `urlhaus-api.abuse.ch/v1/urls/recent/` | GET | Recent malicious URLs |
| `feodotracker.abuse.ch/downloads/` | GET | Botnet C2 blocklists |

## MISP REST API

```bash
# Search events by tag
curl -sk "https://<MISP>/events/restSearch" \
  -H "Authorization: <API_KEY>" \
  -d '{"tags": ["ransomware"], "limit": 25}'

# Add IOC attribute
curl -sk "https://<MISP>/attributes/add/<EVENT_ID>" \
  -H "Authorization: <API_KEY>" \
  -d '{"type": "ip-dst", "value": "1.2.3.4", "category": "Network activity"}'

# Export STIX2 bundle
curl -sk "https://<MISP>/events/restSearch" \
  -H "Authorization: <API_KEY>" \
  -d '{"returnFormat": "stix2", "tags": ["ransomware"]}'
```

## Shodan API

```bash
# Search for exposed RDP
curl -s "https://api.shodan.io/shodan/host/search?key=<KEY>&query=port:3389+org:<ORG>"

# Check specific IP
curl -s "https://api.shodan.io/shodan/host/<IP>?key=<KEY>"
```

## VirusTotal API

```bash
# Check file hash
curl -s "https://www.virustotal.com/api/v3/files/<SHA256>" \
  -H "x-apikey: <VT_KEY>"

# Search for ransomware samples
curl -s "https://www.virustotal.com/api/v3/intelligence/search?query=tag:ransomware" \
  -H "x-apikey: <VT_KEY>"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `feed` | CTI feed identifier | `abuse_ch_bazaar` |
| `group` | Ransomware group name | `lockbit` |
| `sector` | Industry sector | `healthcare` |
| `ioc_type` | Indicator type | `sha256`, `ip-dst`, `domain` |
