API Documentation

CVE Search

Search the live NIST NVD CVE database by keyword, CVE ID or severity.

curl "https://cyber.encse.com/api/cve?severity=CRITICAL&lastDays=7"

Response: { total, page, limit, lastDays, vulnerabilities: [{ id, description, cvssScore, severity, cweIds, references, ... }] }

⚠ Proxies services.nvd.nist.gov. Subject to NVD's own rate limits upstream — a 429 here can mean NVD itself is throttling.

CISA Known Exploited Vulnerabilities

Live CISA KEV catalog — vulnerabilities confirmed as actively exploited, with federal remediation due dates.

curl "https://cyber.encse.com/api/cisa-kev?days=30&limit=50"

Response: { total, filtered, catalogVersion, dateReleased, vulnerabilities: [{ cveID, vendorProject, dateAdded, dueDate, ... }] }

IOC Lookup

Check an IP, domain, URL or file hash against URLhaus and MalwareBazaar (abuse.ch) threat feeds.

curl "https://cyber.encse.com/api/ioc-lookup?q=185.220.101.45"

Response: { indicator, type, verdict: "malicious"|"clean"|"unknown", sourcesQueried, sourcesAnswered, scanned_at, sources: [{ source, ok, reason?, ... }] }

⚠ abuse.ch made API keys mandatory for URLhaus and MalwareBazaar. Without ABUSECH_AUTH_KEY configured server-side, feeds return ok:false and the verdict is "unknown" — never "clean". Treat "clean" as "not listed by the feeds that answered", not as proof an indicator is safe.

IP Reputation

Geolocation, ASN/ISP, proxy/VPN/Tor detection and AbuseIPDB abuse score for a public IP.

curl "https://cyber.encse.com/api/ip-reputation?ip=1.1.1.1"

Response: { ip, riskLevel: "UNKNOWN"|"LOW"|"MEDIUM"|"HIGH", riskFlags: [], sourcesQueried, sourcesAnswered, geo: {...}, abuse: {...}|null, abuseipdbEnabled, geoTransport }

⚠ riskLevel is "UNKNOWN" when sourcesAnswered is 0 — never "LOW". Treat "LOW" as "no flags raised by the sources that answered", not as proof an address is safe. AbuseIPDB scoring is opt-in server-side (requires the site operator's own API key) — abuse will be null when disabled. geoTransport reports whether the upstream geolocation lookup used HTTPS: ip-api.com only serves TLS on its paid tier, so without IPAPI_PRO_KEY that lookup travels in cleartext between this server and ip-api.

DNS Lookup

Query DNS records via Cloudflare DNS-over-HTTPS.

curl "https://cyber.encse.com/api/dns?domain=cloudflare.com&types=A,MX,TXT"

Response: { domain, results: { [type]: [{ name, type, TTL, data }] }, errors, timestamp }

SPF Checker

Validate an SPF record, parse mechanisms and check the RFC 7208 10-lookup limit.

curl "https://cyber.encse.com/api/spf?domain=google.com"

Response: { domain, found, record, analysis: { mechanisms, lookupCount, policy, valid }, warnings }

DMARC Checker

Parse DMARC policy, alignment mode, subdomain policy and reporting URIs.

curl "https://cyber.encse.com/api/dmarc?domain=google.com"

Response: { domain, found, record, analysis: { policy, percentage, spfAlignment, dkimAlignment, reportingUris }, warnings, recommendations }

DKIM Checker

Retrieve and validate a DKIM public key record for a domain and selector.

curl "https://cyber.encse.com/api/dkim?domain=google.com&selector=google"

Response: { host, found, tags: { v, k, p, ... }, warnings, info, keyType }

Security Header Checker

Fetch a URL and grade its HTTP security headers (CSP, HSTS, X-Frame-Options, etc.).

curl "https://cyber.encse.com/api/headers?url=https://github.com"

Response: { url, finalUrl, statusCode, checks: {...}, total, passed, warned, failed, score, grade, allHeaders }

⚠ Redirects are followed one hop at a time and every hop is re-validated against the private-address guard. A warned header scores half credit, so the letter grade reflects partial configuration rather than all-or-nothing.

SSL / TLS Checker

Perform a real TLS handshake against a host and return certificate, protocol and cipher details.

curl "https://cyber.encse.com/api/ssl?host=github.com"

Response: { host, port, subject, issuer, validFrom, validTo, daysLeft, protocol, cipher, authorized, fingerprint }

WHOIS / RDAP Lookup

Query RDAP registration data for a domain or IP address, with automatic registry fallback.

curl "https://cyber.encse.com/api/whois?q=google.com"

Response: { type: "domain"|"ip", registrar|org, registered, expiration|country, nameservers|startAddress, ... }

Port Scanner

Real TCP connect-scan of 22 common ports against a public host. Private/loopback addresses are blocked.

curl "https://cyber.encse.com/api/port-scan?host=scanme.nmap.org"

Response: { host, scanned, open, results: [{ port, service, state }], riskFlags: [{ port, service, risk }] }

⚠ Only scan hosts you own or have explicit permission to scan. Takes up to ~10s per port batch.

Ransomware Tracker Proxy

Proxies ransomware.live for group profiles and recent leak-site victim posts.

curl "https://cyber.encse.com/api/ransomware?resource=recentvictims"

Response: Passthrough of ransomware.live's JSON response for the requested resource.

⚠ Fully dependent on ransomware.live's third-party API — if it's down or has changed shape, this endpoint returns a 502 with an error message rather than fabricated data.