# Threat Intelligence & Public Signals API

> Aggregate verified key-free public threat feeds, enrich IoCs, analyze domain history, cluster certificate and phishing infrastructure, detect typosquats, review exposed-service inventory, and score indicator confidence—without API keys, paid providers, or intrusive scanning.

- Product: https://www.brainiac.software/api/threat-intelligence
- Docs: https://www.brainiac.software/api/threat-intelligence/docs
- OpenAPI: https://www.brainiac.software/api/threat-intelligence/openapi.json
- Contact: support@brainiac.software (https://www.brainiac.software/contact)

## Operations

- POST /api/v1/threat-intelligence/public-threat-feed-aggregate — $0.05 USDC — Aggregate public threat feeds: Aggregate caller-supplied and verified key-free public threat feeds (CISA KEV, OpenPhish, capped PhishTank). URLhaus/ThreatFox require auth and are not queried. Feed hits are not confirmed malice. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-public-threat-feed-aggregate
- POST /api/v1/threat-intelligence/ioc-context-enrich — $0.04 USDC — Enrich IoC context: Enrich supplied IPs, domains, URLs, and hashes using caller context plus optional public DNS/feeds. A single weak feed hit is never classified as malicious. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-ioc-context-enrich
- POST /api/v1/threat-intelligence/domain-threat-history — $0.04 USDC — Analyze domain threat history: Analyze publicly accessible domain history and DNS/RDAP context from caller fields and optional key-free public lookups. History attributes alone are not malice. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-domain-threat-history
- POST /api/v1/threat-intelligence/certificate-threat-cluster — $0.04 USDC — Cluster certificate relationships: Identify relationships between domains using caller-supplied certificates and optional public crt.sh data. Shared certificate attributes are linkage evidence, not confirmed abuse. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-certificate-threat-cluster
- POST /api/v1/threat-intelligence/typosquatting-domain-detect — $0.03 USDC — Detect typosquat domains: Identify domains resembling supplied brand or company domains using local string/keyboard heuristics. Resemblance alone is not confirmed phishing. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-typosquatting-domain-detect
- POST /api/v1/threat-intelligence/phishing-infrastructure-cluster — $0.04 USDC — Cluster phishing infrastructure: Group related phishing domains and infrastructure using caller evidence and optional public phishing feeds. Clusters are relationship hypotheses, not confirmed campaigns. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-phishing-infrastructure-cluster
- POST /api/v1/threat-intelligence/exposed-service-risk-analyze — $0.04 USDC — Analyze exposed service risk: Analyze caller-supplied external service inventory and scan results for exposure risk. Never initiates intrusive network scanning. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-exposed-service-risk-analyze
- POST /api/v1/threat-intelligence/threat-indicator-confidence-score — $0.03 USDC — Score threat-indicator confidence: Calculate explainable confidence scores for supplied threat indicators using multi-source corroboration. Single weak signals are capped and never claimed as confirmed malice. Docs: https://www.brainiac.software/api/threat-intelligence/docs#threat-intelligence-threat-indicator-confidence-score