SiteCheck Web Intel

Checks and payment terms on this page refer to the endpoint above. Other listed endpoints have not been checked individually.

Base URLhttps://api.webintel-api.workers.dev/api

• GET/security/sslbl-abuse-certs—No price listedChecks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns the date added and the malware reason from the list. Only certificates this list tracks are covered.
• GET/search/website-content-crawler—No price listedReads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name: no crawling of other pages, no JavaScript rendering, so pages that build their text in the browser may come back short.
• GET/security/bimi-record-audit—No price listedReads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox providers). Checks the v=BIMI1 tag and that the URLs are https. It does not download the logo or validate the certificate.
• GET/security/cisa-known-exploits—No price listedCISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, required action and ransomware-use flag. Without it: catalog size, release date and the newest additions (up to 50). Listing means exploitation was reported, not a risk score.
• GET/security/urlhaus-malware—No price listedChecks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat type, tags, reporter and URLhaus reference.
• GET/security/asn-peers-upstream—No price listedFor an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with their IPv4 and IPv6 peer counts, and the top downstreams. Built from RIS route collector paths, so it is an observed view, not the contract.
• GET/security/domain-typosquatting—No price listedFor a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed with their name servers. A lookalike with no name servers may still be registered without DNS, and this is not a trademark or phishing verdict.
• GET/security/surbl-uri-lookup—No price listedChecks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not listed means not in SURBL's current lists, not that the domain is safe.
• GET/search/markdown-to-pdf-mcp—No price listednpm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish date, monthly and weekly downloads, and npm link. Lists packages as npm reports them; quality is not checked.
• GET/security/snmp-exposure—No price listedReports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string is tried, so default or public community access is not tested.
• GET/seo/linkedin-ad-library—No price listedLinkedIn Ad Library search (ads LinkedIn discloses publicly, including EU/EEA): up to 24 ads per page with ad id, advertiser, format (single image, video, carousel, document), creative type, tagline, ad text, links and detail link. Search by keyword and/or advertiser, optionally one country and a time window. From linkedin.com/ad-library via a residential proxy.
• GET/security/grey-noise-noise—No price listedGreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), its classification (benign, malicious, unknown), name and last-seen date. An address GreyNoise has not seen returns noise=false with a message; it is not a clean verdict.
• GET/search/google-search—No price listedOrganic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for the first page of results. Optional country and freshness filters. No ads or SERP features.
• GET/search/benzinga—No price listedLatest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tickers (e.g. AAPL,TSLA) and/or words in the headline/teaser. Newest first, up to 100 stories; no paging into older news, no full article text. Public, no key.
• GET/security/rdp-exposure-check—No price listedChecks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.
• GET/search/german-impressum—No price listedReads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and the notice text as Markdown. Values are read from the page as published; no check that the operator is correct.
• GET/security/whois-rdap—No price listedDomain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, status flags, nameservers and DNSSEC delegation flag. Registrant contact data is usually redacted by registries and is not returned.
• GET/security/ipsum-threat-level—No price listedChecks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is listed at all. A higher level means more feeds agree. Not listed means none of the aggregated feeds list it.
• GET/security/crtsh-transparency—No price listedSubdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date and how many listed certificates are still valid. Returns the first page only (up to 100 certificates) and lists at most 100 names; wildcard names are shown as *.domain.
• GET/search/wikimedia-commons-image—No price listedWikimedia Commons image search (MediaWiki API, public, no key): file title, direct image URL, size, MIME type, license, author and description for free-licensed files. Returns file metadata only, not image bytes.
• GET/security/security-headers—No price listedChecks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Returns present/missing headers with their values and a score out of 7. It does not judge the quality of the values.
• GET/security/robots-security-txt—No price listedReads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt is present, current or expired. Missing files are reported as absent, not as errors.
• GET/security/ntp-monlist-audit—No price listedReports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification check itself is not run, so this cannot say whether monlist is enabled.
• GET/security/referrer-policy-audit—No price listedReads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the URL it sends to other sites (strict, moderate or leaky). One GET; links on other pages can set their own policy.
• GET/search/europe-pmc-articles—No price listedEurope PMC literature search (public REST API, no key): PMID or source id, title, authors, journal, year, DOI, cited-by count and Europe PMC link. Covers life-science papers including preprints; abstracts are not included.

A dash means the listing gives no price or method. Copy buttons copy the full URL.

Showing 25 of 129 listed endpoints. Next endpoints First endpoints