api.webintel-api.workers.dev

• https://api.webintel-api.workers.dev/api/security/csp-evaluator-audit

  Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data: or http: script sources, a missing default-src or script-s…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/cve-details-feed

  Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mappe…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/cve-nvd-lookup

  One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE w…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/cymru-asn-lookup

  Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-ASN DNS service. Returns no origin when Cymru has no mappin…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/dkim-key-checker

  Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint (about 1024-bit vs 2048-bit RSA), and basic syntax (v=DKIM…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/dmarc-spf-dkim

  Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or for 8 common selectors (revoked keys and CNAME-delegated k…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/dns-caa-records

  Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild) and the incident-report address (iodef). Shows the records…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/dns-propagation

  Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer set and its lowest TTL. It shows cache and geo-DNS differe…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/dns-records

  DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as they resolve now, with TTLs; it does not walk the delegati…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/dnssec-validator

  DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. I…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/domain-typosquatting

  For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/email-disposable

  Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the domain is checked, never the mailbox, and a domain missing fro…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/epss-exploit-score

  EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percentile among all scored CVEs and the scoring date. EPSS predi…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/feodotracker-c2

  Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware family, country, AS and first and last seen dates. Covers only t…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/grey-noise-noise

  GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), its classification (benign, malicious, unknown), name and las…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/hibp-breach-check

  Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the public breach catalogue, not a check of individual email addre…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/ip-geolocation-asn

  IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPEstat. Location is an estimate (a block-level database), not…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/ipsum-threat-level

  Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is listed at all. A higher level means more feeds agree. Not li…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/jwt-token-inspector

  Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmetric HS algorithms, missing exp and a jku/x5u key reference.…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/malbazaar-samples

  Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware family), first/last seen, reporter, origin country, delive…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/mitre-attck-matrix

  Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one page per call; it does not return the whole matrix or a te…

  StellarOther

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/mta-sts-validator

  Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age). Reports whether the record and the policy are both prese…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/mx-server-test

  For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were seen open on each address. Passive and possibly old; no SMTP c…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/ntp-monlist-audit

  Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification check itself is not run, so this cannot say whether monlist…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/open-port-scanner

  Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). The record can be days old, and an address with no record ret…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/open-resolver-check

  Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a query, so it cannot say whether the server answers recursively…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/openphish-feed

  Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL or any URL on the same host is listed, the feed size and up…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/phishtank-check

  Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id, verification flag and validity. Absence means PhishTank h…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/rdp-exposure-check

  Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/referrer-policy-audit

  Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the URL it sends to other sites (strict, moderate or leaky). O…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/reverse-dns-ptr

  Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR names are checked. Many addresses have no PTR record; that …

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/robots-security-txt

  Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt is present, current or expired. Missing files are reported a…

  StellarWeb data

  n/a/ request

  2026-10-25

• https://api.webintel-api.workers.dev/api/security/security-headers

  Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/shodan-host-summary

  Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with the host. Data is from Shodan's last scan, so it can be da…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/smb-exposure-test

  Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the host data (not a live test). An address with no Shodan record …

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/snmp-exposure

  Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string is tried, so default or public community access is not teste…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/spameatingmonkey

  Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0.0.x return code; an unlisted one returns no record. Listing…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/spamhaus-zen

  Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts, DROP hijacked ranges, PBL end-user ranges) or a domain ag…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/ssh-banner-audit

  From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) list. This is passive and may be days old; it is not a live SS…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/ssl-cert-chain

  HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS versions, weak-cipher count, Heartbleed/POODLE/BEAST flags…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/sslbl-abuse-certs

  Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns the date added and the malware reason from the list. Only ce…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/subdomain-takeover

  For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPress), checks whether the target still resolves, and fetches t…

  StellarDeveloper tools

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/surbl-uri-lookup

  Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not listed means not in SURBL's current lists, not that the domain …

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/talos-ip-blacklist

  Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner, location, email volume magnitude (daily, monthly and last…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/threatfox-iocs

  Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Op…

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/tls-alpn-detector

  Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age. This is what the server announces, not a TLS ALPN negotia…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/tls-cipher-enum

  TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per protocol, weak suites (RC4, 3DES, NULL, EXPORT, DES, anonymou…

  StellarIdentity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/tor-exit-nodes

  Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: nickname, flags, country, first and last seen. Only exit IP…

  StellarOther

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/urlhaus-malware

  Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat …

  StellarSecurity

  n/a/ request

  2026-10-24

• https://api.webintel-api.workers.dev/api/security/vpn-proxy-detector

  Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). Returns whether the address falls in a listed VPN range and…

  StellarOther

  n/a/ request

  2026-10-24

By chain

One seller wallet, each chain read on its own. We never send a payment, so we never observe what a paid call returns. Unknown means we hold no reading, not that anything failed.

Unknown. Prices are decoded only for USDC on Base and Solana.