<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Ransomware Group Infrastructure — API Reference

## DNS Analysis

```bash
# Forward lookup
dig +short domain.com A

# Reverse lookup
dig +short -x 1.2.3.4

# NS records
dig +short domain.com NS

# Full DNS record dump
dig domain.com ANY +noall +answer
```

## SecurityTrails API

```bash
# Domain details
curl -s "https://api.securitytrails.com/v1/domain/<DOMAIN>" -H "apikey: <KEY>"

# DNS history
curl -s "https://api.securitytrails.com/v1/history/<DOMAIN>/dns/a" -H "apikey: <KEY>"

# Reverse IP lookup
curl -s "https://api.securitytrails.com/v1/domains/list?ipv4=<IP>" -H "apikey: <KEY>"
```

## Certificate Transparency

```bash
# Search crt.sh for certificates
curl -s "https://crt.sh/?q=%25.domain.com&output=json" | jq '.'

# Extract cert from live server
echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -text
```

## Blockchain APIs

```bash
# Bitcoin address info
curl -s "https://blockchain.info/rawaddr/<BTC_ADDR>?limit=10"

# Transaction details
curl -s "https://blockchain.info/rawtx/<TX_HASH>"

# Check abuse reports
curl -s "https://www.bitcoinabuse.com/api/reports/check?address=<ADDR>&api_token=<TOKEN>"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `domain` | Domain to analyze | `suspicious.com` |
| `ip` | IP address to investigate | `185.220.101.1` |
| `btc_address` | Bitcoin wallet address | `bc1q...` |
| `host` | Host for TLS cert check | `c2.example.com` |
