RelayShield - Threat Intelligence & Identity Security API

RelayShield is a threat intelligence and identity security API built for MSPs, MSSPs, and security engineering teams that need actionable signal - not just data.

The platform combines a live IOC corpus of 2.0M+ indicators (sourced from 20+ threat intelligence feeds and 37+ criminal Telegram channels) with real-time identity monitoring across six attack surfaces: credential breach, infostealer malware exposure, SIM swap / carrier-layer fraud, domain lookalike / typosquat detection, OAuth supply chain compromise, and active session hijack detection.

Key capabilities:

• Threat Intelligence: Query 2M+ indicators by IP, domain, URL, or hash. Bulk enrichment (100 IOCs per call), IOC pivot for lateral infrastructure discovery, trending threats, and MITRE ATT&CK threat actor profiles with related-actor attribution.
• Identity Risk: Domain security credit score (0-100, grade A-F) across 6 dimensions. Bulk identity risk scoring for up to 10 domains with per-agent identity signals - built for AI governance and MSP client sweeps.
• Early Warning Intelligence: CVE proof-of-concept chatter detected in criminal channels 24-72 hours before NVD publication. CISA KEV corpus (1,600+ actively exploited CVEs) with ransomware campaign flagging and tech stack targeting alerts.
• Third-Party Risk: Vendor domain breach and infostealer composite risk scoring for supply chain visibility.
• Brand Protection: Scan the full IOC corpus for brand name patterns - phishing domains, malware C2, and dark web mentions.
• STIX/TAXII 2.1: Direct feed into Splunk, Microsoft Sentinel, Elastic, and QRadar.
• MISP: Structured event export compatible with MISP instances, OpenCTI, and other threat-intel platforms.

All endpoints available as metered pay-per-call ($0.10-$2.00/call) or flat-rate TI subscription ($499/mo for 10,000 calls, $999/mo unlimited). Self-serve signup at api.relayshield.net/developers. No AWS Metering Service integration required.