Enrich IoC context API

Enrich supplied IPs, domains, URLs, and hashes using caller context plus optional public DNS/feeds. A single weak feed hit is never classified as malicious.

The Enrich IoC context operation is part of the Threat Intelligence & Public Signals API on BRAINIAC.software. Enrich supplied IPs, domains, URLs, and hashes using caller context plus optional public DNS/feeds. A single weak feed hit is never classified as malicious. It is exposed as POST /api/v1/threat-intelligence/ioc-context-enrich and priced at $0.04 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied indicators, feeds, domains, certificates, and service inventory CISA Known Exploited Vulnerabilities catalogue when fetchCisaKev is requested OpenPhish community feed when fetchOpenPhish is requested PhishTank online-valid CSV (capped) when fetchPhishTank is requested Public DNS when publicDns is requested Public RDAP when fetchRdap is requested crt.sh Certificate Transparency when fetchCrtSh is requested Limitations: URLhaus and ThreatFox require authentication and are not queried. A single weak feed hit is never classified as confirmed malice. No intrusive network scanning is performed. Public sources may be stale, conflicting, truncated, or unavailable; statuses are reported. No paid threat-intel provider is used and no API key is required. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Aggregate public threat feeds, Analyze domain threat history, Cluster certificate relationships, Detect typosquat domains. Open the group documentation for the full request schema, field notes, and response examples before integrating.

POST$0.04 USDC
/api/v1/threat-intelligence/ioc-context-enrich

Example request

curl -i -X POST "https://www.brainiac.software/api/v1/threat-intelligence/ioc-context-enrich" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "indicators": [
    {
      "id": "I1",
      "type": "domain",
      "value": "paypa1-secure.example",
      "source": "Caller-supplied"
    }
  ],
  "feeds": [
    {
      "id": "F1",
      "feed": "openphish",
      "type": "url",
      "value": "http://paypa1-secure.example/login",
      "observedAt": "2026-11-04T18:00:00.000Z",
      "source": "Caller-supplied"
    }
  ],
  "domains": [
    {
      "id": "D1",
      "domain": "paypa1-secure.example",
      "registrar": "Example Registrar",
      "ips": [
        "198.51.100.10"
      ],
      "createdAt": "2026-10-20T00:00:00.000Z",
      "source": "Caller-supplied"
    }
  ]
}
JSON

An unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.

FAQ

  • Do I need an API key? No. Pay the listed USDC amount with x402.
  • What network? Base (eip155:8453), USDC.
  • Is this an official determination? No. Results are for human review against the cited sources.

Related APIs

Threat Intelligence & Public Signals APIFull docsHow it works