Threat Intelligence & Public Signals API Documentation

POSThttps://www.brainiac.software/api/v1/threat-intelligence/public-threat-feed-aggregate$0.05 USDC

Aggregate public threat feeds

Aggregate caller-supplied and verified key-free public threat feeds (CISA KEV, OpenPhish, capped PhishTank). URLhaus/ThreatFox require auth and are not queried. Feed hits are not confirmed malice.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied OpenPhish-style row"
    },
    {
      "id": "F2",
      "feed": "cisa-kev",
      "type": "cve",
      "value": "CVE-2024-1234",
      "observedAt": "2026-10-01T00:00:00.000Z",
      "source": "Caller-supplied KEV-style row"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 2,
  "feedCount": 2,
  "items": [
    {
      "id": "feed-openphish",
      "detector": "public-threat-feed-aggregate",
      "title": "Aggregated openphish feed rows",
      "observedFacts": [
        "1 row(s) from openphish",
        "No stale timestamps detected among dated rows."
      ],
      "inferredThreat": "Feed aggregation surfaces publicly reported indicators; individual rows are not confirmed malice.",
      "confidence": "low",
      "relatedIds": [
        "F1"
      ],
      "reasons": [
        "feed_present"
      ],
      "evidence": [
        {
          "subject": "F1",
          "fact": "url=http://paypa1-secure.example/login",
          "inference": "Copied from public/caller feed with source attribution.",
          "confidence": "medium",
          "source": "Caller-supplied OpenPhish-style row",
          "observedAt": "2026-11-04T18:00:00.000Z"
        }
      ],
      "source": "Caller-supplied OpenPhish-style row",
      "status": "signal",
      "confirmedMalicious": false
    },
    {
      "id": "feed-cisa_kev",
      "detector": "public-threat-feed-aggregate",
      "title": "Aggregated cisa-kev feed rows",
      "observedFacts": [
        "1 row(s) from cisa-kev",
        "1 stale by >30d"
      ],
      "inferredThreat": "Feed aggregation surfaces publicly reported indicators; individual rows are not confirmed malice.",
      "confidence": "low",
      "relatedIds": [
        "F2"
      ],
      "reasons": [
        "feed_present",
        "stale_rows"
      ],
      "evidence": [
        {
          "subject": "F2",
          "fact": "cve=CVE-2024-1234",
          "inference": "Copied from public/caller feed with source attribution.",
          "confidence": "medium",
          "source": "Caller-supplied KEV-style row",
          "observedAt": "2026-10-01T00:00:00.000Z"
        }
      ],
      "source": "Caller-supplied KEV-style row",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [
    {
      "kind": "observation",
      "code": "source_status",
      "subject": "urlhaus",
      "detail": "URLhaus: AUTH_REQUIRED — URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted."
    }
  ],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/public-threat-feed-aggregate" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied OpenPhish-style row"
    },
    {
      "id": "F2",
      "feed": "cisa-kev",
      "type": "cve",
      "value": "CVE-2024-1234",
      "observedAt": "2026-10-01T00:00:00.000Z",
      "source": "Caller-supplied KEV-style row"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/ioc-context-enrich$0.04 USDC

Enrich IoC context

Enrich supplied IPs, domains, URLs, and hashes using caller context plus optional public DNS/feeds. A single weak feed hit is never classified as malicious.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "indicators": [
    {
      "id": "I1",
      "type": "domain",
      "value": "paypa1-secure.example",
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "paypa1-secure.example",
      "registrar": "Example Registrar",
      "ips": [
        "198.51.100.10"
      ],
      "createdAt": "2026-10-20T00:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "enrich-I1",
      "detector": "ioc-context-enrich",
      "title": "IoC context enrichment",
      "observedFacts": [
        "type=domain",
        "value=paypa1-secure.example",
        "Matched 1 public/caller feed row(s): openphish",
        "Public/caller DNS A answers: 198.51.100.10",
        "Registration/DNS metadata present from RDAP or caller."
      ],
      "inferredThreat": "Corroborated public/caller context can support investigation; not a confirmed malicious verdict.",
      "confidence": "medium",
      "relatedIds": [
        "I1",
        "F1",
        "D1"
      ],
      "reasons": [
        "feed_hit",
        "dns_context",
        "registration_context"
      ],
      "evidence": [
        {
          "subject": "F1",
          "fact": "openphish:http://paypa1-secure.example/login",
          "source": "Caller-supplied",
          "observedAt": "2026-11-04T18:00:00.000Z",
          "confidence": "medium"
        },
        {
          "subject": "D1",
          "fact": "registrar=Example Registrar; ips=198.51.100.10",
          "source": "Caller-supplied",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/ioc-context-enrich" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "indicators": [
    {
      "id": "I1",
      "type": "domain",
      "value": "paypa1-secure.example",
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "paypa1-secure.example",
      "registrar": "Example Registrar",
      "ips": [
        "198.51.100.10"
      ],
      "createdAt": "2026-10-20T00:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/domain-threat-history$0.04 USDC

Analyze domain threat history

Analyze publicly accessible domain history and DNS/RDAP context from caller fields and optional key-free public lookups. History attributes alone are not malice.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "domains": [
    {
      "id": "D1",
      "domain": "brand-login.example",
      "registrar": "Cheap Domains LLC",
      "createdAt": "2026-10-28T00:00:00.000Z",
      "nameservers": [
        "ns1.example.net",
        "ns2.example.net"
      ],
      "ips": [
        "198.51.100.20"
      ],
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "domain",
      "value": "brand-login.example",
      "observedAt": "2026-11-03T12:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "domhist-D1",
      "detector": "domain-threat-history",
      "title": "Domain history risk indicators",
      "status": "signal",
      "observedFacts": [
        "domain=brand-login.example",
        "createdAt=2026-10-28T00:00:00.000Z",
        "Domain registration age under 30 days.",
        "NS=ns1.example.net, ns2.example.net",
        "A=198.51.100.20",
        "registrar=Cheap Domains LLC",
        "Appears in 1 feed row(s)."
      ],
      "inferredThreat": "Public domain history can support risk review; a single weak attribute is not malice.",
      "confidence": "medium",
      "relatedIds": [
        "D1",
        "F1"
      ],
      "reasons": [
        "registration_date",
        "recently_registered",
        "nameservers_present",
        "dns_answers",
        "registrar_present",
        "feed_overlap"
      ],
      "evidence": [
        {
          "subject": "D1",
          "fact": "domain=brand-login.example; createdAt=2026-10-28T00:00:00.000Z; Domain registration age under 30 days.; NS=ns1.example.net, ns2.example.net; A=198.51.100.20; registrar=Cheap Domains LLC; Appears in 1 feed row(s).",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "F1",
          "fact": "openphish hit",
          "source": "Caller-supplied",
          "observedAt": "2026-11-03T12:00:00.000Z",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/domain-threat-history" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "domains": [
    {
      "id": "D1",
      "domain": "brand-login.example",
      "registrar": "Cheap Domains LLC",
      "createdAt": "2026-10-28T00:00:00.000Z",
      "nameservers": [
        "ns1.example.net",
        "ns2.example.net"
      ],
      "ips": [
        "198.51.100.20"
      ],
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "domain",
      "value": "brand-login.example",
      "observedAt": "2026-11-03T12:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/certificate-threat-cluster$0.04 USDC

Cluster certificate relationships

Identify relationships between domains using caller-supplied certificates and optional public crt.sh data. Shared certificate attributes are linkage evidence, not confirmed abuse.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "certificates": [
    {
      "id": "C1",
      "domain": "a.phish.example",
      "commonName": "a.phish.example",
      "issuer": "Let's Encrypt",
      "fingerprintSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sans": [
        "a.phish.example"
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "C2",
      "domain": "b.phish.example",
      "commonName": "b.phish.example",
      "issuer": "Let's Encrypt",
      "fingerprintSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sans": [
        "b.phish.example"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 2,
  "items": [
    {
      "id": "ct-fp_aaaaaaaaaaaaaaaa",
      "detector": "certificate-threat-cluster",
      "title": "Certificate fingerprint cluster",
      "observedFacts": [
        "2 certificate row(s)",
        "2 related name(s): a.phish.example, b.phish.example"
      ],
      "inferredThreat": "Shared certificate attributes can link infrastructure; linkage is not confirmed phishing/malware.",
      "confidence": "low",
      "relatedIds": [
        "C1",
        "C2"
      ],
      "reasons": [
        "shared_fingerprint",
        "multi_domain"
      ],
      "evidence": [
        {
          "subject": "C1",
          "fact": "cn=a.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "C2",
          "fact": "cn=b.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…",
          "source": "Caller-supplied",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied certificates and/or public crt.sh",
      "status": "signal",
      "confirmedMalicious": false
    },
    {
      "id": "ct-san_phish_example",
      "detector": "certificate-threat-cluster",
      "title": "SAN/root certificate name cluster",
      "observedFacts": [
        "2 certificate row(s)",
        "2 related name(s): a.phish.example, b.phish.example"
      ],
      "inferredThreat": "Shared certificate attributes can link infrastructure; linkage is not confirmed phishing/malware.",
      "confidence": "low",
      "relatedIds": [
        "C1",
        "C2"
      ],
      "reasons": [
        "shared_san_root",
        "multi_domain"
      ],
      "evidence": [
        {
          "subject": "C1",
          "fact": "cn=a.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "C2",
          "fact": "cn=b.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…",
          "source": "Caller-supplied",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied certificates and/or public crt.sh",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/certificate-threat-cluster" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "certificates": [
    {
      "id": "C1",
      "domain": "a.phish.example",
      "commonName": "a.phish.example",
      "issuer": "Let's Encrypt",
      "fingerprintSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sans": [
        "a.phish.example"
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "C2",
      "domain": "b.phish.example",
      "commonName": "b.phish.example",
      "issuer": "Let's Encrypt",
      "fingerprintSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "sans": [
        "b.phish.example"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/typosquatting-domain-detect$0.03 USDC

Detect typosquat domains

Identify domains resembling supplied brand or company domains using local string/keyboard heuristics. Resemblance alone is not confirmed phishing.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brands": [
    {
      "id": "B1",
      "brand": "paypal",
      "domains": [
        "paypal.com"
      ],
      "source": "Caller-supplied"
    }
  ],
  "candidates": [
    "paypa1.com",
    "paypal.com",
    "totally-unrelated.example"
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "typo-paypal_com_paypa1_com",
      "detector": "typosquatting-domain-detect",
      "title": "Possible typosquat / lookalike domain",
      "status": "signal",
      "observedFacts": [
        "brand=paypal.com",
        "candidate=paypa1.com",
        "similarity=0.83",
        "reason=high_string_similarity",
        "reason=homoglyphish_digits"
      ],
      "inferredThreat": "Lookalike domains can support phishing; resemblance alone is not confirmed abuse.",
      "confidence": "medium",
      "relatedIds": [
        "B1"
      ],
      "reasons": [
        "high_string_similarity",
        "homoglyphish_digits"
      ],
      "evidence": [
        {
          "subject": "paypa1.com",
          "fact": "Compared to paypal.com; similarity=0.83",
          "inference": "Local string/keyboard heuristics only.",
          "confidence": "medium",
          "source": "Caller-supplied"
        }
      ],
      "source": "Caller-supplied",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/typosquatting-domain-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brands": [
    {
      "id": "B1",
      "brand": "paypal",
      "domains": [
        "paypal.com"
      ],
      "source": "Caller-supplied"
    }
  ],
  "candidates": [
    "paypa1.com",
    "paypal.com",
    "totally-unrelated.example"
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/phishing-infrastructure-cluster$0.04 USDC

Cluster phishing infrastructure

Group related phishing domains and infrastructure using caller evidence and optional public phishing feeds. Clusters are relationship hypotheses, not confirmed campaigns.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://login-a.example/x",
      "observedAt": "2026-11-04T12:00:00.000Z",
      "source": "Caller-supplied"
    },
    {
      "id": "F2",
      "feed": "openphish",
      "type": "url",
      "value": "http://login-b.example/y",
      "observedAt": "2026-11-04T13:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "login-a.example",
      "ips": [
        "198.51.100.50"
      ],
      "asn": "AS64500",
      "registrar": "Example Reg",
      "source": "Caller-supplied"
    },
    {
      "id": "D2",
      "domain": "login-b.example",
      "ips": [
        "198.51.100.50"
      ],
      "asn": "AS64500",
      "registrar": "Example Reg",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 3,
  "items": [
    {
      "id": "phish-shared_ip_198_51_100_50",
      "detector": "phishing-infrastructure-cluster",
      "title": "Phishing domains sharing IP",
      "observedFacts": [
        "2 domains share shared_ip=198.51.100.50",
        "examples=login-a.example, login-b.example"
      ],
      "inferredThreat": "Shared infrastructure can indicate related phishing campaigns; clustering is not confirmation.",
      "confidence": "low",
      "relatedIds": [
        "F1",
        "F2",
        "D1",
        "D2"
      ],
      "reasons": [
        "shared_ip",
        "multi_domain"
      ],
      "evidence": [
        {
          "subject": "F1",
          "fact": "domain=login-a.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "F2",
          "fact": "domain=login-b.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "D1",
          "fact": "domain=login-a.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "D2",
          "fact": "domain=login-b.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied domains/feeds plus optional public phishing feeds",
      "status": "signal",
      "confirmedMalicious": false
    },
    {
      "id": "phish-shared_asn_as64500",
      "detector": "phishing-infrastructure-cluster",
      "title": "Phishing domains sharing ASN",
      "observedFacts": [
        "2 domains share shared_asn=AS64500",
        "examples=login-a.example, login-b.example"
      ],
      "inferredThreat": "Shared infrastructure can indicate related phishing campaigns; clustering is not confirmation.",
      "confidence": "low",
      "relatedIds": [
        "F1",
        "F2",
        "D1",
        "D2"
      ],
      "reasons": [
        "shared_asn",
        "multi_domain"
      ],
      "evidence": [
        {
          "subject": "F1",
          "fact": "domain=login-a.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "F2",
          "fact": "domain=login-b.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "D1",
          "fact": "domain=login-a.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "D2",
          "fact": "domain=login-b.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied domains/feeds plus optional public phishing feeds",
      "status": "signal",
      "confirmedMalicious": false
    },
    {
      "id": "phish-shared_registrar_example_reg",
      "detector": "phishing-infrastructure-cluster",
      "title": "Phishing domains sharing registrar",
      "observedFacts": [
        "2 domains share shared_registrar=Example Reg",
        "examples=login-a.example, login-b.example"
      ],
      "inferredThreat": "Shared infrastructure can indicate related phishing campaigns; clustering is not confirmation.",
      "confidence": "low",
      "relatedIds": [
        "F1",
        "F2",
        "D1",
        "D2"
      ],
      "reasons": [
        "shared_registrar",
        "multi_domain"
      ],
      "evidence": [
        {
          "subject": "F1",
          "fact": "domain=login-a.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "F2",
          "fact": "domain=login-b.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "D1",
          "fact": "domain=login-a.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        },
        {
          "subject": "D2",
          "fact": "domain=login-b.example",
          "source": "Caller-supplied",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied domains/feeds plus optional public phishing feeds",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/phishing-infrastructure-cluster" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://login-a.example/x",
      "observedAt": "2026-11-04T12:00:00.000Z",
      "source": "Caller-supplied"
    },
    {
      "id": "F2",
      "feed": "openphish",
      "type": "url",
      "value": "http://login-b.example/y",
      "observedAt": "2026-11-04T13:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "login-a.example",
      "ips": [
        "198.51.100.50"
      ],
      "asn": "AS64500",
      "registrar": "Example Reg",
      "source": "Caller-supplied"
    },
    {
      "id": "D2",
      "domain": "login-b.example",
      "ips": [
        "198.51.100.50"
      ],
      "asn": "AS64500",
      "registrar": "Example Reg",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/exposed-service-risk-analyze$0.04 USDC

Analyze exposed service risk

Analyze caller-supplied external service inventory and scan results for exposure risk. Never initiates intrusive network scanning.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "services": [
    {
      "id": "S1",
      "host": "db.example",
      "ip": "198.51.100.60",
      "port": 27017,
      "protocol": "tcp",
      "service": "mongodb",
      "exposure": "public",
      "banner": "MongoDB without authentication",
      "cveIds": [
        "CVE-2024-1234"
      ],
      "source": "Caller-supplied inventory"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "cisa-kev",
      "type": "cve",
      "value": "CVE-2024-1234",
      "observedAt": "2026-09-01T00:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "svc-S1",
      "detector": "exposed-service-risk-analyze",
      "title": "Exposed service risk indicators",
      "status": "signal",
      "observedFacts": [
        "host=db.example",
        "port=27017/tcp",
        "service=mongodb",
        "exposure=public",
        "Public exposure on commonly abused port 27017.",
        "Public exposure of service mongodb.",
        "Caller-linked CVE(s): CVE-2024-1234",
        "KEV overlap: CVE-2024-1234",
        "Banner contains authentication-risk wording."
      ],
      "inferredThreat": "Publicly exposed risky services can expand attack surface; inventory analysis is not an exploit or scan result.",
      "confidence": "medium",
      "relatedIds": [
        "S1"
      ],
      "reasons": [
        "risky_public_port",
        "risky_public_service",
        "cve_linked",
        "kev_overlap",
        "banner_risk_words"
      ],
      "evidence": [
        {
          "subject": "S1",
          "fact": "host=db.example; port=27017/tcp; service=mongodb; exposure=public; Public exposure on commonly abused port 27017.; Public exposure of service mongodb.; Caller-linked CVE(s): CVE-2024-1234; KEV overlap: CVE-2024-1234; Banner contains authentication-risk wording.",
          "inference": "No intrusive scanning performed; evidence is from caller inventory and optional KEV overlap.",
          "confidence": "medium",
          "source": "Caller-supplied inventory"
        }
      ],
      "source": "Caller-supplied inventory",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [
    {
      "kind": "conflict",
      "code": "exposed_service",
      "subject": "S1",
      "detail": "Exposure indicators: risky_public_port, risky_public_service, cve_linked, kev_overlap, banner_risk_words (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/exposed-service-risk-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "services": [
    {
      "id": "S1",
      "host": "db.example",
      "ip": "198.51.100.60",
      "port": 27017,
      "protocol": "tcp",
      "service": "mongodb",
      "exposure": "public",
      "banner": "MongoDB without authentication",
      "cveIds": [
        "CVE-2024-1234"
      ],
      "source": "Caller-supplied inventory"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "cisa-kev",
      "type": "cve",
      "value": "CVE-2024-1234",
      "observedAt": "2026-09-01T00:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/threat-intelligence/threat-indicator-confidence-score$0.03 USDC

Score threat-indicator confidence

Calculate explainable confidence scores for supplied threat indicators using multi-source corroboration. Single weak signals are capped and never claimed as confirmed malice.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`indicators`	No	array; Array
`feeds`	No	array; Array
`domains`	No	array; Array
`certificates`	No	array; Array
`services`	No	array; Array
`brands`	No	array; Array
`candidates`	No	array; Array
`asOf`	No	string
`fetchCisaKev`	No	boolean
`fetchOpenPhish`	No	boolean
`fetchPhishTank`	No	boolean
`fetchCrtSh`	No	boolean
`fetchRdap`	No	boolean
`publicDns`	No	boolean
`staleDays`	No	number
`crtShQuery`	No	string

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "indicators": [
    {
      "id": "I1",
      "type": "domain",
      "value": "paypa1-secure.example",
      "labels": [
        "phish"
      ],
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied"
    },
    {
      "id": "F2",
      "feed": "phishtank",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T17:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "paypa1-secure.example",
      "createdAt": "2026-10-20T00:00:00.000Z",
      "ips": [
        "198.51.100.10"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "score-I1",
      "detector": "threat-indicator-confidence-score",
      "title": "Threat indicator confidence score",
      "status": "signal",
      "observedFacts": [
        "score=70",
        "band=high",
        "multi_feed_corroboration:35",
        "recent_registration:15",
        "dns_rdap_context:10",
        "caller_malicious_label:10"
      ],
      "inferredThreat": "Explainable confidence for investigation priority only; not a confirmed malicious verdict.",
      "confidence": "high",
      "relatedIds": [
        "I1",
        "F1",
        "F2"
      ],
      "reasons": [
        "multi_feed_corroboration",
        "recent_registration",
        "dns_rdap_context",
        "caller_malicious_label"
      ],
      "evidence": [
        {
          "subject": "I1",
          "fact": "Listed by 2 independent feeds: openphish, phishtank.",
          "inference": "Contribution 35 points.",
          "confidence": "high",
          "source": "Caller-supplied"
        },
        {
          "subject": "I1",
          "fact": "Domain registration age under 30 days.",
          "inference": "Contribution 15 points.",
          "confidence": "high",
          "source": "Caller-supplied"
        },
        {
          "subject": "I1",
          "fact": "DNS/RDAP context available.",
          "inference": "Contribution 10 points.",
          "confidence": "high",
          "source": "Caller-supplied"
        },
        {
          "subject": "I1",
          "fact": "Caller supplied a malicious-category label.",
          "inference": "Contribution 10 points.",
          "confidence": "high",
          "source": "Caller-supplied"
        }
      ],
      "source": "Caller-supplied",
      "confirmedMalicious": false,
      "score": 70,
      "scoreBand": "high",
      "components": [
        {
          "code": "multi_feed_corroboration",
          "points": 35,
          "detail": "Listed by 2 independent feeds: openphish, phishtank."
        },
        {
          "code": "recent_registration",
          "points": 15,
          "detail": "Domain registration age under 30 days."
        },
        {
          "code": "dns_rdap_context",
          "points": 10,
          "detail": "DNS/RDAP context available."
        },
        {
          "code": "caller_malicious_label",
          "points": 10,
          "detail": "Caller supplied a malicious-category label."
        }
      ]
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "intrusiveScanPerformed": false,
  "singleWeakSignalMaliciousClaimed": false,
  "publicFetchesUsed": false,
  "publicDnsQueried": false,
  "sourceStatuses": [
    {
      "id": "urlhaus",
      "name": "URLhaus",
      "url": "https://urlhaus.abuse.ch/",
      "status": "AUTH_REQUIRED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.",
      "authenticated": false
    },
    {
      "id": "cisa-kev",
      "name": "CISA KEV",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCisaKev=true to load the free CISA KEV catalogue.",
      "authenticated": false
    },
    {
      "id": "openphish",
      "name": "OpenPhish community feed",
      "url": "https://openphish.com/feed.txt",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchOpenPhish=true to load the free OpenPhish community feed.",
      "authenticated": false
    },
    {
      "id": "phishtank",
      "name": "PhishTank online-valid CSV",
      "url": "https://data.phishtank.com/data/online-valid.csv",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).",
      "authenticated": false
    },
    {
      "id": "rdap",
      "name": "RDAP",
      "url": "https://rdap.org/domain/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchRdap=true to query public RDAP for supplied domains.",
      "authenticated": false
    },
    {
      "id": "crtsh",
      "name": "crt.sh Certificate Transparency",
      "url": "https://crt.sh/",
      "status": "SKIPPED",
      "retrievedAt": "2026-11-04T21:00:00.000Z",
      "itemCount": 0,
      "detail": "Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).",
      "authenticated": false
    }
  ],
  "findings": [],
  "limitations": [
    "Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.",
    "URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.",
    "No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.",
    "A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.",
    "No paid threat-intel provider is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/threat-indicator-confidence-score" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "indicators": [
    {
      "id": "I1",
      "type": "domain",
      "value": "paypa1-secure.example",
      "labels": [
        "phish"
      ],
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied"
    },
    {
      "id": "F2",
      "feed": "phishtank",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T17:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "paypa1-secure.example",
      "createdAt": "2026-10-20T00:00:00.000Z",
      "ips": [
        "198.51.100.10"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON