Threat-intel data feeds & public API
Free, machine-readable OffSeq honeypot and internet-exposure intelligence — the same data behind this site's pages, as downloadable feeds and a public read API. Attribution appreciated.
Downloadable feeds
Aggregate figures only: counts, validated CVE/ASN/service identifiers and observation times. No attacker IP addresses, credentials or sensor identities are ever included — see the methodology for how the data is collected and redacted.
| Feed | Format | Endpoint |
|---|---|---|
| CVE corpus | JSON | https://mirage.offseq.com/feed/cves.json Every CVE OffSeq observes exploited or exposed, with counts + status. |
| CVE corpus | CSV | https://mirage.offseq.com/feed/cves.csv The same rows as CSV. |
| CVE corpus | STIX 2.1 | https://mirage.offseq.com/feed/cves.stix A STIX bundle of vulnerability objects (no attacker IPs). |
| Attacker networks | JSON | https://mirage.offseq.com/feed/asns.json Top attacker ASNs by observed volume. |
| Attacker networks | CSV | https://mirage.offseq.com/feed/asns.csv The same rows as CSV. |
| Services | JSON | https://mirage.offseq.com/feed/services.json Per-service (protocol/port) attack volume. |
Example: curl -s https://mirage.offseq.com/feed/cves.json
Public read API
Live JSON endpoints (anonymous, redacted, rate-limited). Reveal-level detail — raw attacker IPs, sensor identity — requires an authenticated premium account.
https://mirage.offseq.com/api/intel/summary — Live global attack summary.
https://mirage.offseq.com/api/intel/top/cves — Top exploited CVEs (also countries, asns, techniques, services).
https://mirage.offseq.com/api/intel/cve/{id} — Per-CVE honeypot context.
https://mirage.offseq.com/api/exposure/cves — Internet-exposure CVE footprint.
https://mirage.offseq.com/api/radar/cve/{id} — CVE enrichment (CVSS/EPSS/KEV, references).
License
This data is published under CC BY 4.0. You may reuse it, including commercially, with attribution to OffSeq Cybersecurity and a link back to this page.
Need higher volume, historical depth, or unredacted feeds? Contact OffSeq or open the live console.