List of keyless (zero-auth) public CTI and infostealer API endpoints for rapid triage + open-source Python script to query them
Source Reddit ThreatIntel
Discussion
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
r/threatintel (opens in a new tab)u/Traditional_Bear54920 points0 comments
Hey r/threatintel,
When doing quick domain exposure checks or IOC triage on a clean workstation without my usual commercial API keys configured, I rely heavily on public CTI endpoints that don't require registration or bearer tokens.
I compiled my go-to list of keyless REST/socket sources below in case it helps other analysts, along with a small MIT-licensed Python stdlib script I wrote to query them concurrently:
### 1. Infostealer & Credential Exposure (Keyless)
- **Hudson Rock Cavalier (`cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain`):** Great for separating corporate credential leaks caused by client-side infostealers (RedLine, Lumma, Vidar, Raccoon) vs third-party database breaches. Returns infected employee/user counts and stolen login URLs without an API key.
- **HaveIBeenPwned v3 (`haveibeenpwned.com/api/v3/breaches` & `api.pwnedpasswords.com/range/`):** The general breaches list and k-Anonymity SHA-1 password range endpoints are completely free and keyless.
### 2. Infrastructure, BGP & Passive Recon
- **Shodan InternetDB (`internetdb.shodan.io/{ip}`):** Free, instant JSON lookup for open ports, CPEs, hostnames, tags, and known CVEs on any IP.
- **RIPE Stat Data API (`stat.ripe.net/data/prefix-overview/data.json`):** Keyless ASN, holder name, and BGP CIDR prefix lookups.
- **crt.sh (`crt.sh/?q={domain}&output=json`):** Certificate Transparency logs for passive subdomain discovery.
- **Cloudflare DoH (`cloudflare-dns.com/dns-query`):** RFC 8484 DNS-over-HTTPS for checking MX, TXT, SPF, and `_dmarc` spoofing policies.
### 3. Vulnerability & Botnet C2 Feeds
- **FIRST.org EPSS (`api.first.org/data/v1/epss`):** 30-day exploitation probability score and percentile for any CVE.
- **CISA KEV JSON (`cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json`):** Active exploitation confirmation.
- **Abuse.ch ThreatFox & Feodo Tracker:** Free JSON/CSV feeds for active C2 IPs and malware SHA-256 hashes.
To avoid querying these manually across 10 tabs, I bundled them into a zero-dependency Python CLI script (pure standard library, no commercial product/company, just MIT open-source):
https://github.com/prox0959/CyberCodex
What other keyless/free CTI endpoints are you all using in your daily triage workflows? I'd love to add more community-recommended sources to the list.