All projects matching “threat”

Live feed of freshly-detected malicious addresses on Base — address-poisoning seeders caught via zero-value transfer sprays, updated continuously by our on-chain collector. Poll ?since=<unix> to ingest only new threats into your agent's blocklist. Deterministic, evidence-backed, machine-readable.

Is this domain malicious or named by ransomware? Domain threat check. $0.02 USDC on Base per call. Matches the hostname, parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed and looks up ransomware leak-site claims. Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat. Don't use this for many domains; use /v1/bulk-threat-check.

Live scored geopolitical threat feed: name, category, severity, coordinates, and source URL for every active tracked threat.

URL safety verdict: follows the redirect chain, detects homograph and punycode hostname tricks, and cross-references the destination host against the URLhaus threat feed. Returns safe, suspicious or malicious with reasons. Single-URL scope; domain-wide grading is /sitegrade and registration facts are /domain-intel.

IP threat intelligence from first-party honeypot observations (not scraped blocklists): was this IP seen scanning, brute-forcing or probing a live honeypot, which traps it triggered (credential stuffing, webshell, exploit scans, scrapers), bot category and confidence. Works for IPv4 and IPv6.

Recent IPs caught probing Polyform's honeypot paths (credential/vuln scanners) — Polyform's own first-party telemetry, not a repackaged public list. Returns up to 500 most-recent scanner IPs with first-seen. For blocklists and threat research. JSON.

Real-time crypto threat and risk intelligence for AI agents. Get up to 20 recent source-linked risk reports with risk scores, freshness, validation status and cached PG1 checks when available. Designed for automated triage and review. 0.01 USDC per snapshot on Base via x402; no API key or subscription required.

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

WalletTriage — real-time wallet risk check: dangerous ERC20 approvals cross-referenced with a live exploit threat feed. Returns risk_score (0-100), risk_level and actionable findings.

Three-node GO/NO-GO threat intelligence report for an x402 Payment Required payload and vendor metadata on Base mainnet (eip155:8453). $0.05 USDC per POST via the CDP facilitator. Unpaid requests return HTTP 402 with PAYMENT-REQUIRED; a JSON body without a payload object returns 400; payment settlement failures return 402.

Scan any OpenClaw SKILL.md for malware, prompt injection, exfiltration, and 37 other threat patterns. Returns risk score 0-100 and detailed findings.