25 Services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com

Scores a domain's probability of being an active or upcoming cyberattack target using a 6-signal correlation model covering breach, infostealer, ransomware, session, CVE, and threat-actor targeting history.

Checks up to 10 vendor domains simultaneously for combined breach, infostealer, and dark-web exposure, returning a composite risk score per vendor.

Scans a domain for typosquats, homoglyphs, and phishing lookalike registrations that may be impersonating a brand.

Checks whether API keys or tokens associated with a domain — used by non-human identities such as AI agents, service accounts, or CI/CD pipelines — have been exposed in criminal infostealer logs.

Checks whether a domain appears on a ransomware group's victim or leak-site list and whether pre-ransomware credential harvesting was detected beforehand.

Scans public GitHub/GitLab repositories associated with a domain to detect exposed API keys, tokens, and credentials committed in source code.

Checks whether a given phone number has recently had its SIM swapped, returning the carrier, swap status, and timestamp of the swap event.

Screen up to 10 wallet addresses across EVM, Solana, TON, or Bitcoin chains in one call for known scam, exploit, drainer, or sanctions association, returning per-address risk level and flags.

Checks a declared technology stack against actively-exploited CVEs from CISA's Known Exploited Vulnerabilities (KEV) catalog and high-EPSS-score vulnerabilities to surface critical security risks.

Assesses a given MCP server URL for supply-chain and registry risk, flagging unverified publishers, known-malicious servers, and other trust signals before an agent connects.

Checks whether an email address has OAuth-connected app credentials exposed in known SaaS breaches across GitHub, Slack, Notion, Zapier, and 30+ other high-risk OAuth-capable apps, returning matched apps and direct revoke-access links.

Scans a blockchain wallet address for risk flags and returns a risk level assessment (e.g. LOW/MEDIUM/HIGH) along with detailed risk indicators.

Returns a graded identity risk score for a domain, covering breach exposure, CVE exposure, infostealer density, ransomware exposure, session exposure, and threat actor targeting dimensions.

Analyzes a crypto token's smart contract for security risks including honeypots, mintable supply, and other critical or warning flags.

Checks whether an email address has an active stolen session cookie circulating in a criminal archive, signaling an account takeover via AiTM/session-hijacking attack.

Checks whether a domain's AI/LLM provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) have been harvested by infostealer malware and exposed in criminal stealer logs.

Score up to 10 organizational domains with up to 5 agent/employee emails each for combined breach, infostealer, session, and CVE risk in a single API call.

Correlates an email address against criminal breach and infostealer corpora to surface linked phone numbers, domains, and other identifiers tied to the same compromised identity.

Analyzes an NFT contract for security risks, returning risk level, risk flags, and collection metadata for a given contract address and chain.

Checks whether a given email address has been found in infostealer malware logs or credential theft datasets

Submits a file URL for asynchronous security scanning and returns an analysis ID to poll for results

Submits a URL for asynchronous security analysis, returning an analysis ID to poll for phishing/malicious content results

Assesses the risk level of an EVM wallet address, returning risk flags and a risk level classification (e.g. LOW, MEDIUM, HIGH).

Checks whether an email address has appeared in known data breaches, returning breach details and count

Checks whether an email address tied to an AI agent session has active stolen sessions or credential exposures from prompt-injection-driven breaches that could enable account takeover.