Overview#

The Threat Intelligence Aggregator is a security-focused API that enables rapid threat assessment by cross-referencing targets against aggregated threat intelligence databases. Built for security teams, incident responders, and compliance professionals, this tool consolidates threat data from multiple sources to provide actionable intelligence on IPs, domains, file hashes, and other indicators of compromise.

This API is ideal for organizations that need real-time threat visibility without managing multiple third-party integrations. Whether you're conducting incident response, performing due diligence on external entities, or automating security workflows, the Threat Intelligence Aggregator delivers comprehensive threat context in a single API call.

Key capabilities include rapid threat lookups, multi-source threat correlation, and detailed risk assessment data—all accessible through a simple, RESTful interface designed for integration into SOAR platforms, security dashboards, and automated response systems.

Usage#

Sample Request#

json

{
  "target": "192.168.1.100"
}

Sample Response#

json

{
  "target": "192.168.1.100",
  "threat_status": "high_risk",
  "findings": [
    {
      "source": "abusech",
      "threat_type": "malware_c2",
      "confidence": 95,
      "last_seen": "2024-01-15T10:30:00Z"
    },
    {
      "source": "otx",
      "threat_type": "botnet",
      "confidence": 87,
      "last_seen": "2024-01-14T22:15:00Z"
    }
  ],
  "risk_score": 9.2,
  "recommendations": [
    "Block at firewall perimeter",
    "Investigate network connections",
    "Review logs for command execution"
  ],
  "aggregated_at": "2024-01-16T08:45:22Z"
}

Endpoints#

POST /check-threat#

Analyzes a target against aggregated threat intelligence sources to identify known threats and security risks.

Method: POST

Path: /check-threat

Description: Submits a target (IP address, domain, file hash, or URL) for threat assessment. The API queries multiple threat intelligence feeds and returns consolidated findings with risk scoring and remediation recommendations.

Request Parameters:

NameTypeRequiredDescriptiontargetstringYesThe indicator to check: IP address, domain name, file hash (MD5/SHA1/SHA256), or URL

Response Schema:

FieldTypeDescriptiontargetstringThe checked indicatorthreat_statusstringOverall threat assessment: clean, low_risk, medium_risk, high_risk, critical_riskfindingsarrayArray of threat findings from individual sourcesfindings[].sourcestringThreat intelligence source (e.g., abusech, otx, abuseipdb)findings[].threat_typestringClassification of threat detectedfindings[].confidenceintegerConfidence score 0-100findings[].last_seenstringISO 8601 timestamp of most recent observationrisk_scorenumberAggregated risk score 0-10recommendationsarrayList of recommended remediation actionsaggregated_atstringISO 8601 timestamp of aggregation time

HTTP Status Codes:

• 200 OK — Threat check completed successfully
• 422 Unprocessable Entity — Invalid request body or malformed target parameter

Pricing#

PlanCalls/DayCalls/MonthPriceFree550FreeDeveloper20500$39/moProfessional2005,000$99/moEnterprise100,0001,000,000$299/mo

About#

ToolWeb.in — 200+ security APIs, CISSP & CISM, platforms: Pay-per-run, API Gateway, MCP Server, OpenClaw, RapidAPI, YouTube.

• 🌐 toolweb.in
• 🔌 portal.toolweb.in
• 🤖 hub.toolweb.in
• 🐾 toolweb.in/openclaw/
• 🚀 rapidapi.com/user/mkrishna477
• 📺 youtube.com/@toolweb-009

References#

• Kong Route: https://api.mkkpro.com/security/threat-intel-aggregator
• API Docs: https://api.mkkpro.com:8009/docs