Threat Intelligence API

The Threat Intelligence API provides real‑time access to data gathered by a continuously operating honeypot sensor network that monitors SSH, RDP, HTTP, SMB, and Telnet traffic. It records each incoming connection, classifies the activity, and assigns a reputation score between 0.0 and 1.0, while also indicating the risk level from none to critical. The service can resolve domain names to IPs and reports whether an address has previously engaged the honeypot sensors.

Developers and security teams can query the API for single IP or domain lookups to make immediate security decisions, or they can submit bulk CSV files to enrich large sets of indicators for log analysis, CI/CD pipelines, or fraud‑prevention workflows. The platform reports over 211 000 detected attacks and currently blocks more than 3 600 malicious IPs, with daily block counts exceeding 300.

The system is hosted on Render cloud infrastructure with a stated 100 % uptime, targeting SOC analysts, DevSecOps engineers, threat researchers, and anyone needing automated threat intelligence for operational or investigative purposes.