Parse Ransomwatch results in python and create MDE IOC lists as you search.
https://ransomwatch.telemetry.ltd/
pip install validators
pip install tldextract
DNSTwist: https://github.com/jkerai1/DNSTwistToMDEIOC
JoeSandBox: https://github.com/jkerai1/JoeSandBoxToMDEBlockList
TLD: https://github.com/jkerai1/TLD-TABL-Block