# Threat Intelligence API — URL, domain and IP reputation from open threat feeds: URLHaus malware URLs, OpenPhish phishing feed, ThreatFox IOCs, Feodo botnet C2, SSLBL SSL blacklist, Spamhaus DROP hijacked netblocks and urlscan.io scan history (all keyless open sources, no API key required)

> Is a URL malicious? Checks the URLHaus malware-URL feed + OpenPhish phishing feed (exact + variants) + its host across ThreatFox/URLHaus-hosts/Feodo/SSLBL + risk flags → verdict.
> ReefAPI engine `threat-intel` · 5 endpoints · clean JSON, no scraping or browsers to manage.

## How to call
- **Endpoint:** `POST https://api.reefapi.com/threat-intel/v1/<action>` with a JSON body.
- **Auth:** header `x-api-key: <YOUR_REEFAPI_KEY>` — create one free (1,000 credits, no card): https://reefapi.com/signup
- **Response (every call):** `{ ok: boolean, data: ..., meta: { record_count, credits, ... }, error: { code, message } }` — branch on `ok`. Failed or blocked calls are free.
- **One key + one shared credit pool** across every ReefAPI API. Per-call credits are listed on each endpoint below.
- **Use it from an AI agent (MCP):** connect `https://api.reefapi.com/mcp` (remote streamable-http, `Authorization: Bearer <key>`) and your assistant can call these actions directly.

## Endpoints

### POST /threat-intel/v1/url_check — 1 credit
Is a URL malicious? Checks the URLHaus malware-URL feed + OpenPhish phishing feed (exact + variants) + its host across ThreatFox/URLHaus-hosts/Feodo/SSLBL + risk flags → verdict.

**Parameters:**
- `url` (string, required) — The full URL to check (http/https). Matched against the URLHaus malware-URL feed AND the OpenPhish phishing feed (exact + http/https + trailing-slash variants), plus its host against every host/IOC feed.

**Returns:** target, type, malicious (bool), verdict (clean|suspicious|malicious), score (0-100), sources[] (per-feed hit detail), threat_types[], malware[], flags[], checked_sources[]

**Example request body:**
```json
{
  "url": "https://github.com/"
}
```

### POST /threat-intel/v1/domain_reputation — 1 credit
Domain reputation: URLHaus host listing + active malware URLs + OpenPhish phishing + ThreatFox domain IOCs + urlscan scan-history count + risk flags → consolidated verdict.

**Parameters:**
- `domain` (string, required) — Domain/host to check (a bare host like example.com; a full URL or leading www. is accepted and normalized). Checked against URLHaus hosts, ThreatFox domain IOCs, and urlscan scan history.

**Returns:** target, type, malicious, verdict, score, sources[], malware_urls[], threat_types[], malware[], urlscan_scans, flags[], checked_sources[]

**Example request body:**
```json
{
  "domain": "github.com"
}
```

### POST /threat-intel/v1/ip_reputation — 1 credit
IP abuse signals: Feodo botnet-C2 + SSLBL botnet-C2 + ThreatFox IP IOCs + URLHaus IP-hosted malware + Spamhaus DROP hijacked-netblock → verdict + score (all keyless).

**Parameters:**
- `ip` (string, required) — IPv4/IPv6 address to check against Feodo botnet-C2, SSLBL botnet-C2, ThreatFox IP IOCs, URLHaus IP-hosted malware, and Spamhaus DROP hijacked netblocks (all keyless open feeds).

**Returns:** target, type, malicious, verdict, score, sources[], malware[], threat_types[], c2_ports[], checked_sources[]

**Example request body:**
```json
{
  "ip": "8.8.8.8"
}
```

### POST /threat-intel/v1/scan_lookup — 1 credit
urlscan.io public scan history + per-scan verdict for a domain/IP (server, IP, country, TLS age, page title, malicious-flag). Open source — no key.

**Parameters:**
- `domain` (string, required) — Domain (or a URL — its host is used) to pull urlscan.io public scan history + per-scan verdict for. Use search_field to switch the query axis.
- `search_field` (enum, optional, default "domain") — Which urlscan axis to query. 'domain' (default) is broadest; 'page' is the landing domain only; 'ip' searches by contacted IP. [one of: domain, page, ip]
- `limit` (integer, optional, default 20) — Max scan-history records to return (1-100, default 20). Clamped to 100.

**Returns:** target, query, total, scans[] (uuid, url, domain, ip, server, country, mime_type, title, tls_age_days, time, malicious, result_link), has_more, next_offset

**Example request body:**
```json
{
  "domain": "github.com"
}
```

### POST /threat-intel/v1/batch — 1 credit
Check up to 20 mixed indicators (URL/domain/IP, auto-routed) in one call.

**Parameters:**
- `targets` (array, required) — List of indicators to check in one call (max 20); each may be a URL, domain, or IP — the type is auto-detected and routed to the right feeds.

**Returns:** results[] (one reputation block per input, with ok/error + verdict), count, malicious_count, ok_count

**Example request body:**
```json
{
  "targets": [
    "https://github.com/",
    "github.com",
    "8.8.8.8"
  ]
}
```

## More
- Try it live, no code: https://reefapi.com/playground?engine=threat-intel
- Human docs page: https://reefapi.com/docs/threat-intel
- Every ReefAPI API in one file (for your AI): https://reefapi.com/llms-full.txt