Threat Intelligence API

Real-time attack data from the ScannerSend honeypot network. Community-fed, machine-readable.

Pricing

Public
Free
Aggregate stats endpoint
No API key required
60 requests/hour
Dashboard access
View Dashboard
Community
Free / with key
Attack data (masked IPs)
Wallet addresses
Blocklist (masked IPs)
300 requests/hour
Request Free Key
Professional
$49 / month
Full unmasked IPs
Bulk export
Real-time SSE feed
3,000 requests/hour
Webhook notifications
Subscribe — $49/mo
or $499/year (save 15%)

Authentication

Pass your API key via header or query parameter:

curl -H "X-API-Key: ss_comm_your_key_here" \
  https://scannersend.org/api/v1/threat/attacks

Rate Limits

TierRequests/HourHeader
Public60X-RateLimit-Remaining
Community300
Professional3,000

Endpoints

GET/api/v1/threat/statsPUBLIC

Aggregate threat intelligence stats. No authentication required.

GET/api/v1/threat/attacksCOMMUNITYPRO

Recent attacks. Community: masked IPs. Professional: full IPs + headers.

limitintMax 500, default 50
offsetintPagination offset
categorystrFilter by attack category
sinceISO 8601Only attacks after timestamp
GET/api/v1/threat/walletsCOMMUNITY

Crypto wallet addresses from killed mining processes.

GET/api/v1/threat/blocklistCOMMUNITYPRO

Banned IPs with threat scores. Community: masked. Pro: full IPs.

GET/api/v1/threat/feedPRO

Server-Sent Events real-time feed. Full unmasked attack data live.

POST/api/v1/node/reportNODES

Submit attack data from a deployed ScannerSend honeypot node.

Deploy a Honeypot Node

Join the network. Free. Any Linux VPS. 5 minutes.

curl -sS https://scannersend.org/node-setup.sh | sudo bash

Each node deploys CryptoAnnihilator + web/SSH honeypots + auto-reporter. "Every siege teaches every keep."

Legal

All data collected from attackers connecting to ScannerSend honeypot infrastructure. Professional tier for defensive use only. Redistribution requires written permission.

ScannerSend — Source