Free Cybersecurity & Threat Intel APIs

Real-time IP geolocation and ASN inspector resolving country, city, coordinates, and ISP details.

Open-source blocklist checking 136,000+ disposable and temporary email domains instantly.

Free remote MCP server and REST API for DNS and email security with 45 tools. Analyzes SPF, DKIM, DMARC, BIMI, DNSSEC, and WHOIS with zero authentication.

Multi-antivirus scan aggregator analyzing suspicious files, domains, and IP addresses

Search engine for internet-connected servers, IoT devices, and open ports

Check if personal email addresses or passwords have been leaked in data breaches

Automated sandbox analyzing website DOMs, network requests, and safety scores

Central IP address blacklist reporting malicious traffic, attacks, and brute-force

Google Safe Browsing: detect malicious URLs, malware, and deceptive websites

Malware sample database and hash lookup for reverse engineers and analysts

Database tracking malicious websites and URLs distributing malware and trojans

Open Threat Exchange: community intelligence on malware indicators and IPs

Threat intelligence engine scanning exposed IP ports and network vulnerabilities

Internet background noise scanner analyzing mass scanners and benign crawler traffic

Bug bounty and vulnerability disclosure platform for ethical hackers

Comprehensive domain DNS history, WHOIS records, and reverse IP lookup

Fraud detection engine analyzing e-commerce transactions and chargeback risks

Real-time phishing indicators feed, malicious URL analysis, and IP blacklists

Official US National Vulnerability Database (NVD) CVE catalog and CVSS scores

Community threat intelligence platform analyzing IOCs, hashes, and malware domains

Predict malicious email reputation, spam likelihood, and disposable address check

Provides access to the 2026 US retirement and tax figures, including contribution limits for various retirement accounts, phase-outs, federal tax brackets, social security figures, and Medicare premiums. Each piece of data is sourced from official IRS and government publications and available in a free JSON format.

FishFish is an automated service designed to quickly detect and mitigate phishing threats before they can be exploited for malicious purposes. It provides a streamlined solution for identifying harmful resources efficiently.

The CVEDB API provides a quick and efficient way to look up information about vulnerabilities associated with specific CVE-IDs or CPE23 strings. It allows users to access detailed data on vulnerabilities, including summaries, scores, and references to further resources.

This API provides security verification to protect websites from malicious bots. It displays a challenge page while validating that the user is not a bot, ensuring secure access to the site.

A read-only API that returns evidence-backed device lifecycle and support records, including separate OS and security dates and provenance metadata. It also provides CSV exports and embeddable SVG status badges.

The Dymo API provides a comprehensive solution for businesses by integrating security, AI, marketing, and analytics into a single platform. It allows users to validate data, detect malicious activity, and enhance marketing strategies while gaining insights into customer behavior.

Provides access to the largest public database of food banks in the UK, including details about their locations and the items they need donated. Users can retrieve this data in various formats such as JSON, GeoJSON, XML, or YAML, facilitating numerous applications in addressing food insecurity.

IpQuery is a versatile API that provides essential information about an IP address, including geolocation data and VPN detection capabilities. It is designed for developers, enabling them to filter and utilize data points critical for enhancing application security and personalization.

Comprehensive IP address intelligence API providing geolocation, security analysis, and network information. Features include real-time IP geolocation, advanced threat detection, VPN detection, email validation, and risk scoring for fraud prevention.

The InternetDB API enables fast lookups of open ports for specific IP addresses, providing insights into the devices using those addresses. It also includes vulnerability metadata to help users assess potential security risks associated with the IPs.

The Mercado Bitcoin API provides a comprehensive interface for accessing cryptocurrency market data, managing user accounts, and executing trades. It supports functionalities including retrieving market data such as order books, trades, and candles, as well as facilitating deposits and withdrawals for digital currencies and Brazilian Real.

Phish.in provides a JSON API for accessing an extensive archive of live Phish audience recordings. It supports various functionalities including retrieving data on shows, songs, venues, and playlists, with options for sorting and pagination.

Malware execution and analysis

Provide malware datasets and threat intelligence feeds

Malware Archive / file sourcing

Detonates files and URLs in instrumented VMs and returns behaviour, IOCs and ATT&CK

IP/domain/URL reputation

Scan URLs in a sandboxed browser and search past scans by domain, IP, ASN, JARM or favicon hash

Open security blocklist of 219,000+ disposable and temporary email domains rebuilt every 30 minutes from honeypot sensors and community threat feeds.