Directory
105,841 agents from 4 public sources
Showing 1–18, most evidence first; contradicted and not yet assessed last · names and descriptions as their source publishes them
- SiteCheck Web Intelio.github.bck-stack/sitecheck-web-intel · api.webintel-api.workers.dev129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402Livechecked Evidence 2/4MCPWebsiteMCP Registry
- SiteCheck Web Intelapi.webintel-api.workers.devShodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with the host. Data is from Shodan's last scan, so it can be days old; an IP with no data returns empty lists with known=false.Livechecked Evidence 1/4x402x402 Bazaar7 payers
- SiteCheck Web Intelapi.webintel-api.workers.devOne CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE weakness IDs and up to 5 reference URLs. It does not say whether the CVE is being exploited (use cisa-known-exploits or epss-exploit-score for that).Livechecked Evidence 1/4x402x402 Bazaar4 payers
- SiteCheck Web Intelapi.webintel-api.workers.devLists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the public breach catalogue, not a check of individual email addresses (that needs a paid key and is not offered here).Livechecked Evidence 1/4x402x402 Bazaar3 payers
- SiteCheck Web Intelapi.webintel-api.workers.devEPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percentile among all scored CVEs and the scoring date. EPSS predicts; it does not say an exploit exists (see cisa-known-exploits).Livechecked Evidence 1/4x402x402 Bazaar3 payers
- SiteCheck Web Intelapi.webintel-api.workers.devChecks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not listed means not in SURBL's current lists, not that the domain is safe.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devSearches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devChecks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat type, tags, reporter and URLhaus reference.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devFor a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed with their name servers. A lookalike with no name servers may still be registered without DNS, and this is not a trademark or phishing verdict.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devChecks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware family, country, AS and first and last seen dates. Covers only the C2 servers this feed tracks.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devSpamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts, DROP hijacked ranges, PBL end-user ranges) or a domain against the Domain Block List (spam, phishing, malware, botnet C&C, abused legitimate domains). Returns listed yes/no, every return code with the list it means, and Spamhaus's lookup link. Point-in-time answer.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devLooks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware family), first/last seen, reporter, origin country, delivery method, tags, download count and code-signing info. Metadata only; the sample itself is never downloaded.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devLooks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id, verification flag and validity. Absence means PhishTank has no record of this exact URL, not that it is safe.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devChecks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns the date added and the malware reason from the list. Only certificates this list tracks are covered.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devCisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner, location, email volume magnitude (daily, monthly and last 30 days), the /24 network's average magnitude and how many neighbouring addresses in that /24 Talos rates untrusted, poor, neutral or favorable.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devCISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, required action and ransomware-use flag. Without it: catalog size, release date and the newest additions (up to 50). Listing means exploitation was reported, not a risk score.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devChecks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL or any URL on the same host is listed, the feed size and up to 5 example URLs. Not listed does not mean safe; the feed is short and changes fast.Livechecked Evidence 1/4x402x402 Bazaar2 payers
- SiteCheck Web Intelapi.webintel-api.workers.devVulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mapped to its CPE with match=cpe), counts by severity, average and maximum CVSS score, CVEs per week, top CWE weaknesses and the highest-scored CVEs with score, severity, vector, date and description.Livechecked Evidence 1/4x402x402 Bazaar2 payers