Developer Tools

Threat Intelligence API API

The Threat Intelligence API returns URL, domain and IP reputation as clean JSON.

5 actionsLive JSON1,000 free creditsMCP-ready

🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.

The primary url_check endpoint returns a target's type, a malicious flag, a verdict (clean, suspicious or malicious), a 0-100 score and per-feed source detail, and you can check domain and IP reputation, look up a scan and batch many targets. It is built for security, trust-and-safety and anti-abuse workflows that need a fast reputation signal without integrating each threat feed separately. One ReefAPI key, one shared credit pool, the standard envelope.

Live example

Real request and response JSON

Captured from the indexed primary action, url_check, on Jul 18, 2026, 5:19 PM UTC.

Captured request

{
  "method": "POST",
  "url": "https://api.reefapi.com/threat-intel/v1/url_check",
  "headers": {
    "x-api-key": "$REEF_KEY",
    "content-type": "application/json"
  },
  "body": {
    "url": "https://github.com/"
  }
}

Captured response

{
  "ok": true,
  "meta": {
    "api": "threat-intel",
    "endpoint": "url_check",
    "mode": "live",
    "latency_ms": 1285.5,
    "record_count": 1,
    "bytes": 7167451,
    "cache_hit": false,
    "method": "open_feed_aggregation_bare_dc",
    "verdict": "clean",
    "score": 0,
    "feeds_checked": [
      "urlhaus_csv",
      "urlhaus_hosts",
      "threatfox"
    ]
  },
  "data": {
    "target": "https://github.com/",
    "type": "url",
    "host": "github.com",
    "malicious": false,
    "verdict": "clean",
    "score": 0,
    "dedicated_signals": 0,
    "shared_hosting": true,
    "sources": [
      {
        "source": "urlhaus",
        "type": "hosts_flagged_content",
        "match": "host",
        "shared_hosting": true,
        "dedicated": false,
        "weight": 0,
        "malware_urls": 56,
        "active_malware_urls": 21,
        "in_hostfile": false,
        "note": "this is a multi-tenant host; the flagged content lives at specific paths — the domain itself is not condemned",
        "sample": "https://github.com/dm-7926/dz-nvd/raw/main/udm-m.bat"
      }
    ],
    "threat_types": [
      "malware_download"
    ],
    "malware": [],
    "flags": [],
    "checked_sources": [
      "urlhaus",
      "openphish",
      "threatfox"
    ]
  }
}

Actions

What the Threat Intelligence API API does

Action	Description	Concrete use case	Key params
url_check	Is a URL malicious? Checks the URLHaus malware-URL feed + OpenPhish phishing feed (exact + variants) + its host across ThreatFox/URLHaus-hosts/Feodo/SSLBL + risk flags → verdict.	Ops teams call url_check to get is a URL malicious? Checks the URLHaus malware-URL feed + OpenPhish phishing feed (exact + va….	url
domain_reputation	Domain reputation: URLHaus host listing + active malware URLs + OpenPhish phishing + ThreatFox domain IOCs + urlscan scan-history count + risk flags → consolidated verdict.	Developer tools call domain_reputation to get domain reputation.	domain
ip_reputation	IP abuse signals: Feodo botnet-C2 + SSLBL botnet-C2 + ThreatFox IP IOCs + URLHaus IP-hosted malware + Spamhaus DROP hijacked-netblock → verdict + score (all keyless).	Validation workflows call ip_reputation to get iP abuse signals.	ip
scan_lookup	urlscan.io public scan history + per-scan verdict for a domain/IP (server, IP, country, TLS age, page title, malicious-flag). Open source — no key.	Data-quality teams call scan_lookup to get urlscan.io public scan history + per-scan verdict for a domain/IP (server, IP, country, TLS a….	domain, search_field, limit
batch	Check up to 20 mixed indicators (URL/domain/IP, auto-routed) in one call.	Ops teams call batch to check up to 20 mixed indicators (URL/domain/IP, auto-routed) in one call..	targets

Code samples

Call url_check from your stack

curl -X POST https://api.reefapi.com/threat-intel/v1/url_check \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"https://github.com/"}'

import requests

r = requests.post(
    "https://api.reefapi.com/threat-intel/v1/url_check",
    headers={"x-api-key": REEF_KEY},
    json={
  "url": "https://github.com/"
},
)
print(r.json()["data"])

const res = await fetch("https://api.reefapi.com/threat-intel/v1/url_check", {
  method: "POST",
  headers: {
    "x-api-key": process.env.REEF_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({
  "url": "https://github.com/"
}),
});
const { ok, data, meta, error } = await res.json();

MCP one-liner

Ask your MCP-connected assistant: call reefapi.threat-intel.url_check with {"url":"https://github.com/"}.

Use cases

Who uses this API and why

Anti-abuse systems call url_check to block malicious links in user-generated content in real time.
Trust-and-safety teams use ip_reputation to score traffic and flag known-bad addresses.
Security tools use batch to screen a list of domains against multiple threat feeds at once.

FAQ

Questions developers ask before integrating

What is the Threat Intelligence API API?

Threat Intelligence API API is a ReefAPI endpoint group for threat intelligence api It returns live JSON through POST requests under /threat-intel/v1.

Is the Threat Intelligence API API free to try?

Yes. ReefAPI starts with 1,000 free credits, no card required. Threat Intelligence API calls use the same shared credit balance as every other ReefAPI engine.

Do I need a Threat Intelligence API login or account?

No login to Threat Intelligence API is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.

How fresh is the Threat Intelligence API data?

The page example is captured from a live url_check call, and production requests fetch live data through ReefAPI rather than a static sample.

How many credits does the Threat Intelligence API API use?

Threat Intelligence API actions currently cost 1 credit per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.

Can I call Threat Intelligence API from an AI assistant or MCP client?

Yes. Connect ReefAPI once through MCP and your assistant can call threat-intel actions with the same key, credit pool and JSON envelope used by normal REST requests.

Is the Threat Intelligence API API a Threat Intelligence API scraper?

It is the managed alternative to a DIY Threat Intelligence API scraper. Instead of building and maintaining your own scraper — proxies, headless browsers, captcha and constant breakage — you call one ReefAPI endpoint and get the same threat intelligence api back as clean JSON.

Why does my Threat Intelligence API scraper keep getting blocked?

Most Threat Intelligence API scrapers break on anti-bot defenses, rate limits and IP bans that need rotating residential proxies and browser fingerprinting to clear. ReefAPI handles all of that for you — no proxies, no captchas, no maintenance — and returns live JSON. Blocked or failed calls are free.

docs / threat-intel

Threat Intelligence API

base /threat-intel/v15 endpoints

post/threat-intel/v1/url_check1 credit

Is a URL malicious? Checks the URLHaus malware-URL feed + OpenPhish phishing feed (exact + variants) + its host across ThreatFox/URLHaus-hosts/Feodo/SSLBL + risk flags → verdict.

Parameter		Allowed / range	Description
url	required	—	The full URL to check (http/https). Matched against the URLHaus malware-URL feed AND the OpenPhish phishing feed (exact + http/https + trailing-slash variants), plus its host against every host/IOC feed.

Try in playground →

post/threat-intel/v1/domain_reputation1 credit

Domain reputation: URLHaus host listing + active malware URLs + OpenPhish phishing + ThreatFox domain IOCs + urlscan scan-history count + risk flags → consolidated verdict.

Parameter		Allowed / range	Description
domain	required	—	Domain/host to check (a bare host like example.com; a full URL or leading www. is accepted and normalized). Checked against URLHaus hosts, ThreatFox domain IOCs, and urlscan scan history.

Try in playground →

post/threat-intel/v1/ip_reputation1 credit

IP abuse signals: Feodo botnet-C2 + SSLBL botnet-C2 + ThreatFox IP IOCs + URLHaus IP-hosted malware + Spamhaus DROP hijacked-netblock → verdict + score (all keyless).

Parameter		Allowed / range	Description
ip	required	—	IPv4/IPv6 address to check against Feodo botnet-C2, SSLBL botnet-C2, ThreatFox IP IOCs, URLHaus IP-hosted malware, and Spamhaus DROP hijacked netblocks (all keyless open feeds).

Try in playground →

post/threat-intel/v1/scan_lookup1 credit

urlscan.io public scan history + per-scan verdict for a domain/IP (server, IP, country, TLS age, page title, malicious-flag). Open source — no key.

Parameter		Allowed / range	Description
domain	required	—	Domain (or a URL — its host is used) to pull urlscan.io public scan history + per-scan verdict for. Use search_field to switch the query axis.
search_field = domain	optional	domain · page · ip	Which urlscan axis to query. 'domain' (default) is broadest; 'page' is the landing domain only; 'ip' searches by contacted IP.
limit = 20	optional	1–100	Max scan-history records to return (1-100, default 20). Clamped to 100.

Try in playground →

post/threat-intel/v1/batch1 credit

Check up to 20 mixed indicators (URL/domain/IP, auto-routed) in one call.

Parameter		Allowed / range	Description
targets	required	—	List of indicators to check in one call (max 20); each may be a URL, domain, or IP — the type is auto-detected and routed to the right feeds.

Try in playground →

Example request · url_check

curl -X POST https://api.reefapi.com/threat-intel/v1/url_check \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"https://github.com/"}'

Response shape

{
  "ok": true,
  "data": { /* the result */ },
  "meta": {
    "latency_ms": 240,
    "record_count": 12,
    "completeness_pct": 100
  },
  "error": null
}