Mirage public API

Read-only JSON access to live honeypot threat intelligence. Every endpoint below works anonymously; no key is needed.

OpenAPI 3.1 document Daily feed on GitHub

On this page

Quick start

curl -s 'https://mirage.offseq.com/api/intel/summary?days=1'

Base URL https://mirage.offseq.com. Responses are JSON unless noted. Timestamps are unix seconds; counts cover the requested days window.

Access tiers

Anonymous and free accounts get redacted output: attacker addresses are masked to /16 networks and honeypot identity is never shown. Look-back windows are capped at 7 days.

Premium adds full attacker IPs, the locked cluster and campaign drill-downs, AI analysis and 365-day windows. Signed-in requests carry the mirage_session session cookie set when you sign in on Mirage. Premium is granted on request: sales@offseq.com.

Rate limits

Fixed one-minute windows per bucket, counted per account or, for anonymous callers, per client IP (an IPv6 /64). Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; a 429 carries Retry-After.

Bucket	Anonymous	Free	Premium
`intel`	120/min	120/min	600/min
`exposure`	60/min	120/min	600/min
`phish`	60/min	120/min	600/min
`analytics`	30/min	120/min	600/min
`radar`	30/min	120/min	600/min
`ioc`	30/min	120/min	600/min
`ref`	30/min	120/min	600/min
`feeds`	600/min	600/min	600/min

Attacks

Live honeypot attack telemetry: totals, the redacted event stream, top lists, per-CVE and per-network context.

GET`/api/intel/summary`

Global attack summary. Event, attacker and KEV totals plus the severity split for the window.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 1

curl -s 'https://mirage.offseq.com/api/intel/summary'

Example response (application/json)

{
  "window_days": 1,
  "totals": {
    "events": 976268,
    "distinct_ips": 7881,
    "kev_hits": 182,
    "countries": 104,
    "honeytokens": 949,
    "kev_cves": 7
  },
  "loot": {
    "honeytoken_triggers": 949,
    "credential_reuse": 4,
    "beacons": 15,
    "oob_callbacks": 0
  },
  "severity_breakdown": [
    {
      "severity": "medium",
      "hits": 529995
    },
    {
      "severity": "critical",
      "hits": 1159
    }
  ]
}

Rate-limit bucket intel

GET`/api/intel/recent`

Recent attack events. The redacted event stream, newest first. Attacker IPs are masked to /16 (src_ip_masked); premium callers also receive src_ip. Page with before.

Parameter	Description
limit	Maximum rows returned. query · default 50
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 1
before	Opaque `ts:event_id` cursor: pass `next_cursor` from the previous page. query
country	ISO 3166-1 alpha-2 source country, e.g. `CN`. query
asn	ASN number or organisation substring. query
service	Targeted service substring, e.g. `ssh`. query
tool	Attacker tool substring, e.g. `masscan`. query
mitre	ATT&CK technique id, e.g. `T1110`. query
cve	CVE id, exact or prefix. query
user_agent	User-agent / scanner substring. query
severities	Comma-separated severities: info, low, medium, high, critical. query
kev_only	Only events exploiting a CISA KEV CVE. query · default False
honey_only	Only events that touched a honeytoken. query · default False
bucket_start	Window floor, unix seconds. query
bucket_end	Window ceiling, unix seconds. query

curl -s 'https://mirage.offseq.com/api/intel/recent'

Example response (application/json)

{
  "results": [
    {
      "event_id": "d-93da4828edc4bdb338c0bfbabdd63b97",
      "session_id": "1be73b3175144ab980c84ba9f134637c",
      "ts": 1792958406.16,
      "event_type": "sslvpn_login_attempt",
      "severity": "medium",
      "severity_rank": 2,
      "product": "Citrix NetScaler Gateway",
      "service": "https",
      "kev": false,
      "mitre": [
        "T1110"
      ],
      "mitre_primary": "T1110",
      "mitre_primary_name": "Brute Force",
      "tags": [
        "citrix",
        "netscaler",
        "sslvpn"
      ],
      "src_ip_masked": "203.0.113.x",
      "country": "CH",
      "asn": 64500,
      "as_org": "HOSTING",
      "as_name": "EXAMPLE HOSTING S.R.L.",
      "method": "POST",
      "path": "/cgi/login",
      "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
      "request_sha256": "d0fc93745b2601f929bd4a18d7763e597996c3722146de68ec90a1eedaa24955",
      "ja4": "t13i190900_9dc949149365_e7c285222651",
      "tool": "browser",
      "automated": false,
      "iocs": [
        {
          "type": "cred_access",
          "value": "admin:admin123",
          "technique": "T1110"
        }
      ],
      "honeytoken": false,
      "lat": 46.8,
      "lon": 8.2
    }
  ],
  "next_cursor": "1792958406.16:d-93da4828edc4bdb338c0bfbabdd63b97"
}

Rate-limit bucket intel

GET`/api/intel/map`

Attack origin points. Recent attacks as source coordinates (country centroids) for plotting.

Parameter	Description
limit	Maximum rows returned. query · default 300
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 1

curl -s 'https://mirage.offseq.com/api/intel/map'

Example response (application/json)

{
  "results": [
    {
      "lat": 46.8,
      "lon": 8.2,
      "severity": "medium",
      "country": "CH",
      "cve_id": null,
      "kev": false,
      "ts": 1792958406.16
    }
  ]
}

Rate-limit bucket intel

GET`/api/intel/timeline`

Attack volume over time. Hits, distinct attackers and KEV hits per bucket: hourly up to 2 days, daily beyond.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/intel/timeline'

Example response (application/json)

{
  "granularity": "hour",
  "results": [
    {
      "bucket": 1792785600.0,
      "hits": 47860,
      "distinct_ips": 3098,
      "kev_hits": 39
    }
  ]
}

Rate-limit bucket intel

GET`/api/intel/top/{dimension}`

Top values for a dimension. Ranked counts for one dimension. cves rows carry the OWASP Top 10 category; techniques rows carry the ATT&CK name.

Parameter	Description
dimension	Dimension to rank. path · required · cves \| countries \| asns \| techniques \| products \| services \| tools \| user_agents \| paths
limit	Maximum rows returned. query · default 15
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/intel/top/cves'

Example response (application/json)

{
  "dimension": "countries",
  "results": [
    {
      "key": "US",
      "hits": 184960
    },
    {
      "key": "SG",
      "hits": 107715
    }
  ]
}

Rate-limit bucket intel

GET`/api/intel/iocs`

Recent indicators. Indicators extracted from recent attacks (credentials tried, download URLs, hashes), newest first.

Parameter	Description
limit	Maximum rows returned. query · default 50
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7
before	Opaque `ts:event_id` cursor: pass `next_cursor` from the previous page. query

curl -s 'https://mirage.offseq.com/api/intel/iocs'

Example response (application/json)

{
  "results": [
    {
      "ts": 1792958416.3,
      "src_ip_masked": "198.51.x.x",
      "country": "HK",
      "severity": "medium",
      "iocs": [
        {
          "type": "cred_access",
          "value": "camera:P@ssw0rd123",
          "technique": "T1110"
        }
      ]
    }
  ],
  "next_cursor": "1792958416.3:d-db11987bf2021c6429927c6187fa1678"
}

Rate-limit bucket intel

GET`/api/intel/cve/{cve_id}`

Honeypot context for a CVE. What the sensor fleet captured for one CVE: hits, attackers, sessions, top countries, networks, techniques, products and request paths.

Parameter	Description
cve_id	CVE id, e.g. `CVE-2024-4577`. path · required
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 90

curl -s 'https://mirage.offseq.com/api/intel/cve/CVE-2024-4577'

Example response (application/json)

{
  "cve_id": "CVE-2024-4577",
  "window_days": 7,
  "captured": {
    "hits": 387,
    "distinct_ips": 41,
    "sessions": 120,
    "kev": true,
    "first_seen": 1792281721.86,
    "last_seen": 1792957636.41
  },
  "countries": [
    {
      "key": "US",
      "hits": 210
    }
  ],
  "asns": [
    {
      "key": "AS64500",
      "hits": 150
    }
  ],
  "mitre": [
    {
      "key": "T1190",
      "hits": 387
    }
  ],
  "products": [],
  "top_paths": [
    {
      "key": "/php-cgi/php-cgi.exe",
      "hits": 300
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577"
}

Rate-limit bucket intel

GET`/api/intel/entity/{kind}/{value}`

Profile of a network, country or /16. Aggregate profile for one ASN, source country or attacker /16: volume, timeline, CVEs, techniques, services and sample /16 networks. Never a raw IP.

Parameter	Description
kind	Entity kind. path · required · asn \| country \| net
value	`AS14061` / `14061`, an ISO-2 country code, or a /16 such as `203.0.x.x`. path · required
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 90

curl -s 'https://mirage.offseq.com/api/intel/entity/asn/AS14061'

Example response (application/json)

{
  "kind": "asn",
  "value": "AS64500",
  "window_days": 7,
  "source": "daily",
  "captured": {
    "hits": 307355,
    "distinct_ips": 1406,
    "kev_hits": 391,
    "first_seen": 1792281721.86,
    "last_seen": 1792957636.41
  },
  "timeline": [
    {
      "bucket": 1792368000,
      "hits": 16684
    }
  ],
  "sample_nets": [
    "203.0.x.x",
    "198.51.x.x"
  ],
  "cves": [
    {
      "key": "CVE-2024-4577",
      "hits": 387
    }
  ],
  "mitre": [
    {
      "key": "T1110",
      "hits": 212337
    }
  ],
  "services": [
    {
      "key": "vnc",
      "hits": 175704
    }
  ],
  "countries": [
    {
      "key": "US",
      "hits": 184960
    }
  ],
  "org": "Example Hosting LLC"
}

Rate-limit bucket intel

GET`/api/intel/session/{session_id}`

One attacker session. Redacted events of one session. Anonymous callers get the first 5 events and no verdict; signed-in callers get the full session and its AI verdict.

Parameter	Description
session_id	Session id from an event's `session_id`. path · required

curl -s 'https://mirage.offseq.com/api/intel/session/session_id'

Example response (application/json)

{
  "session_id": "1be73b3175144ab980c84ba9f134637c",
  "events": [
    {
      "event_id": "d-93da4828edc4bdb338c0bfbabdd63b97",
      "session_id": "1be73b3175144ab980c84ba9f134637c",
      "ts": 1792958406.16,
      "event_type": "sslvpn_login_attempt",
      "severity": "medium",
      "severity_rank": 2,
      "product": "Citrix NetScaler Gateway",
      "service": "https",
      "kev": false,
      "mitre": [
        "T1110"
      ],
      "mitre_primary": "T1110",
      "mitre_primary_name": "Brute Force",
      "tags": [
        "citrix",
        "netscaler",
        "sslvpn"
      ],
      "src_ip_masked": "203.0.113.x",
      "country": "CH",
      "asn": 64500,
      "as_org": "HOSTING",
      "as_name": "EXAMPLE HOSTING S.R.L.",
      "method": "POST",
      "path": "/cgi/login",
      "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
      "request_sha256": "d0fc93745b2601f929bd4a18d7763e597996c3722146de68ec90a1eedaa24955",
      "ja4": "t13i190900_9dc949149365_e7c285222651",
      "tool": "browser",
      "automated": false,
      "iocs": [
        {
          "type": "cred_access",
          "value": "admin:admin123",
          "technique": "T1110"
        }
      ],
      "honeytoken": false,
      "lat": 46.8,
      "lon": 8.2
    }
  ],
  "verdict": null,
  "total_events": 12,
  "truncated": true
}

Rate-limit bucket intel

GET`/api/ioc`

Look up an indicator. Classify a pasted hash, URL, domain, IP, CVE, JA4 or IOC value and report what the fleet captured of it: hits, attackers, matched indicators, CVEs, techniques, services and networks. IPs in values are masked to /16 unless the caller is premium; an IP the free public lists carry comes back in full with published, and a masked address (203.0.x.x) counts its /16. found: false when unseen.

Parameter	Description
q	The indicator, 3-512 characters, e.g. `CVE-2024-4577` or `203.0.113.7`. query · required
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/ioc'

Example response (application/json)

{
  "kind": "url",
  "window_days": 30,
  "found": true,
  "query": "http://203.0.x.x/bins/x86",
  "hits": 412,
  "capped": false,
  "first_seen": 1792281721.86,
  "last_seen": 1792957636.41,
  "distinct_ips": 37,
  "matches": [
    {
      "type": "download_url",
      "value": "http://203.0.x.x/bins/x86",
      "technique": "T1105",
      "hits": 412
    }
  ],
  "cves": [
    {
      "key": "CVE-2023-1389",
      "hits": 120,
      "kev": true
    }
  ],
  "techniques": [
    {
      "key": "T1105",
      "hits": 412,
      "name": "Ingress Tool Transfer"
    }
  ],
  "services": [
    {
      "key": "http",
      "hits": 412
    }
  ],
  "countries": [
    {
      "key": "NL",
      "hits": 200
    }
  ],
  "asns": [
    {
      "asn": 64500,
      "key": "EXAMPLE HOSTING",
      "name": "Example Hosting B.V.",
      "category": "hosting",
      "hits": 300
    }
  ],
  "sample_nets": [
    "198.51.x.x"
  ]
}

Rate-limit bucket ioc

Actors

Precomputed attacker clusters and campaigns, the infrastructure graph and the observed ATT&CK layer.

GET`/api/intel/clusters`

Attacker clusters. Behavioural actor clusters (shared tool, technique and network). Premium unlocks sample_ips, cves and ai_summary; other callers see locked: true.

Parameter	Description
limit	Maximum rows returned. query · default 50

curl -s 'https://mirage.offseq.com/api/intel/clusters'

Example response (application/json)

{
  "results": [
    {
      "cluster_id": "2998bbbd6ea1",
      "signature": {
        "tool": "unknown",
        "mitre": "T1110",
        "asorg": "Example Hosting GmbH",
        "asn": 64500,
        "mitre_name": "Brute Force"
      },
      "events": 6549666,
      "sessions": 6548573,
      "distinct_ips": 100,
      "countries": [
        "DE",
        "GB",
        "US"
      ],
      "max_severity": "high",
      "first_seen": 1791745548.09,
      "last_seen": 1792958142.43,
      "name": "Hosted Brute-Force Harvester",
      "locked": true
    }
  ],
  "gating": {
    "tier": "anon",
    "authed": false,
    "locked": true
  }
}

Rate-limit bucket analytics

GET`/api/intel/campaigns`

Attack campaigns. Campaigns: one indicator seen across many sensors and attackers. Premium unlocks the shared indicator (key) and sample_ips.

Parameter	Description
limit	Maximum rows returned. query · default 50

curl -s 'https://mirage.offseq.com/api/intel/campaigns'

Example response (application/json)

{
  "results": [
    {
      "campaign_id": "4de4a8c7d41c",
      "ioc_type": "download_url",
      "sensor_count": 5,
      "distinct_ips": 32,
      "countries": [
        "BR",
        "CN",
        "DE"
      ],
      "events": 205,
      "first_seen": 1792736517.91,
      "last_seen": 1792948792.62,
      "locked": true
    }
  ],
  "gating": {
    "tier": "anon",
    "authed": false,
    "locked": true
  }
}

Rate-limit bucket analytics

GET`/api/intel/graph`

Infrastructure graph. Nodes (masked attacker /16s, tools, indicators) and weighted edges linking them.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/intel/graph'

Example response (application/json)

{
  "nodes": [
    {
      "id": "ip:203.0.x.x",
      "label": "203.0.x.x",
      "type": "actor",
      "weight": 44,
      "severity": "medium"
    },
    {
      "id": "tool:browser",
      "label": "browser",
      "type": "tool",
      "weight": 155
    }
  ],
  "edges": [
    {
      "source": "ip:203.0.x.x",
      "target": "tool:browser"
    }
  ],
  "window_days": 7
}

Rate-limit bucket analytics

GET`/api/intel/navigator`

ATT&CK Navigator layer. Observed techniques as a MITRE ATT&CK Navigator layer, scored by hit count. Load it straight into the Navigator.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/intel/navigator'

Example response (application/json)

{
  "name": "OffSeq Mirage – observed ATT&CK",
  "versions": {
    "attack": "20",
    "navigator": "5.2.0",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Honeypot-observed techniques, last 7d",
  "techniques": [
    {
      "techniqueID": "T1110",
      "score": 6065184,
      "comment": "6065184 hits (OffSeq honeypots)"
    }
  ]
}

Rate-limit bucket analytics

Exposure

Internet-exposure findings: exposed services and CVEs seen by internet-wide scanning.

GET`/api/exposure/summary`

Exposure summary. Findings, exposed hosts, services, CVEs and KEV hits, with the top exposed services.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/exposure/summary'

Example response (application/json)

{
  "window_days": 7,
  "totals": {
    "findings": 5447,
    "exposed_hosts": 2702,
    "services": 38,
    "cves": 160,
    "kev_hits": 100,
    "gov_hosts": 9,
    "countries": 27
  },
  "severity_breakdown": [
    {
      "severity": "critical",
      "hits": 305
    }
  ],
  "top_services": [
    {
      "service": "http",
      "hits": 3635,
      "hosts": 1911,
      "max_severity_rank": 4,
      "kev": true
    }
  ],
  "gating": {
    "tier": "anon",
    "authed": false,
    "premium": false
  }
}

Rate-limit bucket exposure

GET`/api/exposure/services`

Exposed services. Services ranked by exposed hosts.

Parameter	Description
limit	Maximum rows returned. query · default 20
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/exposure/services'

Example response (application/json)

{
  "results": [
    {
      "key": "http",
      "hits": 3635,
      "hosts": 1911,
      "max_severity_rank": 4,
      "kev": true
    }
  ]
}

Rate-limit bucket exposure

GET`/api/exposure/cves`

Exposed CVEs. CVEs found on exposed hosts, with CVSS, EPSS, KEV and the affected services.

Parameter	Description
limit	Maximum rows returned. query · default 20
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/exposure/cves'

Example response (application/json)

{
  "window_days": 7,
  "results": [
    {
      "cve": "CVE-2019-11043",
      "exposed_hosts": 12,
      "cvss": 9.8,
      "cvss_source": "nvd",
      "epss": 0.99748,
      "max_severity_rank": 4,
      "kev": true,
      "services": [
        "nginx"
      ]
    }
  ]
}

Rate-limit bucket exposure

GET`/api/exposure/service`

One exposed service. Hosts, severity split, CVEs and countries for one service.

Parameter	Description
name	Service name, e.g. `grafana`. query · required
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/exposure/service'

Example response (application/json)

{
  "service": "grafana",
  "hosts": 62,
  "hits": 98,
  "kev": false,
  "window_days": 7,
  "severity_breakdown": [
    {
      "severity": "high",
      "hits": 20
    }
  ],
  "cves": [],
  "countries": [
    {
      "key": "DE",
      "hits": 14
    }
  ],
  "gating": {
    "tier": "anon",
    "authed": false,
    "premium": false
  }
}

Rate-limit bucket exposure

GET`/api/exposure/timeline`

Exposure findings over time. Findings, distinct hosts and KEV hits per bucket.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/exposure/timeline'

Example response (application/json)

{
  "granularity": "hour",
  "results": [
    {
      "bucket": 1792785600.0,
      "hits": 7,
      "distinct_ips": 5,
      "distinct_hosts": 5,
      "kev_hits": 2
    }
  ]
}

Rate-limit bucket exposure

Phishing

Phishing-plane aggregates: impersonated brands, volume over time.

GET`/api/phish/summary`

Phishing summary. Scans, domains, URLs, brands and samples, with severity and attack-type splits.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/phish/summary'

Example response (application/json)

{
  "window_days": 7,
  "totals": {
    "scans": 2,
    "distinct_ips": 1,
    "distinct_domains": 4,
    "distinct_urls": 3,
    "brands": 1,
    "samples": 1
  },
  "severity_breakdown": [
    {
      "severity": "critical",
      "hits": 2
    }
  ],
  "attack_types": [
    {
      "key": "phishing",
      "hits": 2
    }
  ],
  "gating": {
    "tier": "anon",
    "authed": false,
    "premium": false
  }
}

Rate-limit bucket phish

GET`/api/phish/brands`

Impersonated brands. Brands ranked by phishing lures.

Parameter	Description
limit	Maximum rows returned. query · default 20
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/phish/brands'

Example response (application/json)

{
  "results": [
    {
      "key": "Google",
      "hits": 1,
      "distinct_ips": 1
    }
  ]
}

Rate-limit bucket phish

GET`/api/phish/timeline`

Phishing volume over time. Lures per bucket.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 7

curl -s 'https://mirage.offseq.com/api/phish/timeline'

Example response (application/json)

{
  "granularity": "hour",
  "results": [
    {
      "bucket": 1792785600.0,
      "hits": 2
    }
  ],
  "gating": {
    "tier": "anon",
    "authed": false,
    "premium": false
  }
}

Rate-limit bucket phish

GET`/api/phish/map`

Phishing origin points. Phishing sources as country-centroid coordinates.

Parameter	Description
days	Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium. query · default 30

curl -s 'https://mirage.offseq.com/api/phish/map'

Example response (application/json)

{
  "window_days": 30,
  "results": [
    {
      "country": "US",
      "lat": 37.1,
      "lon": -95.7,
      "hits": 2,
      "senders": 1
    }
  ]
}

Rate-limit bucket phish

Enrichment

CVE enrichment from OffSeq Radar plus KEV, EPSS and CVSS.

GET`/api/radar/cve/{cve_id}`

CVE enrichment. OffSeq Radar record (title, CVSS, EPSS, KEV, vendor, references) plus the reference record (KEV entry, EPSS, CVSS, ATT&CK mapping, CWEs). Premium adds the AI analysis.

Parameter	Description
cve_id	CVE id, e.g. `CVE-2021-44228`. path · required

curl -s 'https://mirage.offseq.com/api/radar/cve/CVE-2021-44228'

Example response (application/json)

{
  "cve": {
    "cve_id": "CVE-2021-44228",
    "title": "Apache Log4j2 Remote Code Execution Vulnerability",
    "cvss": 10.0,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "severity": "critical",
    "cwes": [
      "CWE-20",
      "CWE-400",
      "CWE-502"
    ],
    "vendor": "Apache",
    "product": "Log4j2",
    "published": "2021-12-10T00:00:00.000Z",
    "known_exploited": true,
    "epss": 0.99999,
    "cvss_source": "nvd",
    "references": [
      {
        "title": null,
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
        "type": "advisory"
      }
    ]
  },
  "premium": false,
  "ref": {
    "cve_id": "CVE-2021-44228",
    "kev": {
      "added": "2021-12-10",
      "ransomware": true
    },
    "epss": {
      "score": 0.99999,
      "percentile": 1.0
    },
    "cvss": {
      "score": 10.0,
      "version": "3.1"
    }
  }
}

Rate-limit bucket radar

Reference

Static reference data (ATT&CK, CWE, CAPEC, OWASP, KEV, ASN, country, IANA ports). No honeypot data.

GET`/api/ref/sources`

Reference datasets and versions. Every reference dataset with its licence and attribution notice, and the loaded versions.

curl -s 'https://mirage.offseq.com/api/ref/sources'

Example response (application/json)

{
  "sources": [
    {
      "id": "attack",
      "title": "MITRE ATT&CK® (Enterprise, ICS, Mobile)",
      "homepage": "https://attack.mitre.org/",
      "licence": "MITRE ATT&CK Terms of Use"
    }
  ],
  "versions": {
    "attack": {
      "version": "20.0",
      "built": "2026-10-24T17:51:07Z"
    }
  }
}

Rate-limit bucket ref

GET`/api/ref/technique/{tid}`

ATT&CK technique. Technique with tactics, mitigations, detections, groups, D3FEND and NIST 800-53 mappings.

Parameter	Description
tid	Technique id, e.g. `T1110` or `T1110.001`. path · required

curl -s 'https://mirage.offseq.com/api/ref/technique/T1110'

Example response (application/json)

{
  "id": "T1110",
  "name": "Brute Force",
  "domain": "enterprise",
  "url": "https://attack.mitre.org/techniques/T1110/",
  "is_subtechnique": false,
  "tactics": [
    {
      "id": "TA0006",
      "shortname": "credential-access",
      "name": "Credential Access"
    }
  ],
  "mitigations": [
    {
      "id": "M1032",
      "name": "Multi-factor Authentication"
    }
  ]
}

Rate-limit bucket ref

GET`/api/ref/attack/matrix`

ATT&CK matrix. Tactic columns with their technique ids, and an id→name map.

Parameter	Description
domain	ATT&CK domain. query · default enterprise

curl -s 'https://mirage.offseq.com/api/ref/attack/matrix'

Example response (application/json)

{
  "domain": "enterprise",
  "version": "20.0",
  "tactics": [
    {
      "id": "TA0043",
      "shortname": "reconnaissance",
      "name": "Reconnaissance",
      "techniques": [
        "T1589"
      ]
    }
  ],
  "names": {
    "T1589": "Gather Victim Identity Information"
  }
}

Rate-limit bucket ref

GET`/api/ref/cwe/{cid}`

CWE weakness. Weakness with OWASP mapping, Top 25 rank, parent and related CAPEC patterns.

Parameter	Description
cid	CWE id, e.g. `CWE-79` or `79`. path · required

curl -s 'https://mirage.offseq.com/api/ref/cwe/CWE-79'

Example response (application/json)

{
  "id": "CWE-79",
  "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
  "short_name": "Cross-site Scripting",
  "abstraction": "Base",
  "top25": {
    "year": "2025",
    "rank": 1
  },
  "owasp": {
    "top10-2025": {
      "id": "A05",
      "name": "Injection"
    }
  }
}

Rate-limit bucket ref

GET`/api/ref/capec/{cid}`

CAPEC attack pattern. Attack pattern with severity, related CWEs and ATT&CK techniques.

Parameter	Description
cid	CAPEC id, e.g. `CAPEC-66` or `66`. path · required

curl -s 'https://mirage.offseq.com/api/ref/capec/CAPEC-66'

Example response (application/json)

{
  "id": "CAPEC-66",
  "name": "SQL Injection",
  "abstraction": "Standard",
  "severity": "High",
  "cwes": [
    "CWE-89",
    "CWE-1286"
  ],
  "attack": [],
  "url": "https://capec.mitre.org/data/definitions/66.html"
}

Rate-limit bucket ref

GET`/api/ref/owasp`

OWASP Top 10 lists. OWASP Top 10 2021, 2025 and API Security 2023 categories with their CWE ids.

Parameter	Description
list	One list only: `top10-2021`, `top10-2025` or `api-2023`. query

curl -s 'https://mirage.offseq.com/api/ref/owasp'

Example response (application/json)

{
  "top10-2025": [
    {
      "id": "A01",
      "name": "Broken Access Control",
      "cwes": [
        22,
        23,
        35
      ],
      "url": "https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/"
    }
  ]
}

Rate-limit bucket ref

GET`/api/ref/cve/{cve_id}`

CVE reference record. KEV entry, EPSS, CVSS, ATT&CK mapping and CWEs for a CVE.

Parameter	Description
cve_id	CVE id, e.g. `CVE-2021-44228`. path · required

curl -s 'https://mirage.offseq.com/api/ref/cve/CVE-2021-44228'

Example response (application/json)

{
  "cve_id": "CVE-2021-44228",
  "kev": {
    "added": "2021-12-10",
    "due": "2021-12-24",
    "ransomware": true,
    "vendor": "Apache",
    "product": "Log4j2"
  },
  "epss": {
    "score": 0.99999,
    "percentile": 1.0
  },
  "cvss": {
    "score": 10.0,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "version": "3.1"
  },
  "attack": {
    "class": "Code Execution",
    "exploitation": [
      {
        "id": "T1190",
        "name": "Exploit Public-Facing Application"
      }
    ]
  }
}

Rate-limit bucket ref

GET`/api/ref/asn/{asn}`

Autonomous system. ASN handle, name, country and category.

Parameter	Description
asn	ASN, e.g. `AS14061` or `14061`. path · required

curl -s 'https://mirage.offseq.com/api/ref/asn/AS14061'

Example response (application/json)

{
  "asn": 14061,
  "handle": "DIGITALOCEAN-ASN",
  "name": "DigitalOcean LLC",
  "country": "US",
  "category": "hosting"
}

Rate-limit bucket ref

GET`/api/ref/country/{cc}`

Country. ISO codes, region and flag.

Parameter	Description
cc	ISO 3166-1 alpha-2 code, e.g. `LV`. path · required

curl -s 'https://mirage.offseq.com/api/ref/country/LV'

Example response (application/json)

{
  "code": "LV",
  "name": "Latvia",
  "alpha3": "LVA",
  "numeric": "428",
  "region": "Europe",
  "subregion": "Northern Europe",
  "flag": "🇱🇻"
}

Rate-limit bucket ref

GET`/api/ref/port/{port}`

IANA port. IANA service name for a port.

Parameter	Description
port	Port number, e.g. `22`. path · required
proto	Transport protocol. query · default tcp

curl -s 'https://mirage.offseq.com/api/ref/port/22'

Example response (application/json)

{
  "service": "ssh",
  "description": "The Secure Shell (SSH) Protocol"
}

Rate-limit bucket ref

POST`/api/ref/batch`

Batch reference lookup. Compact records for up to 200 ids per kind in one call, keyed by the requested id. Unknown ids are omitted. Read-only.

curl -s -X POST 'https://mirage.offseq.com/api/ref/batch' -H 'content-type: application/json' -d '{"techniques": ["T1110"], "cves": ["CVE-2021-44228"], "asns": ["14061"], "ports": [22]}'

Example response (application/json)

{
  "techniques": {
    "T1110": {
      "id": "T1110",
      "name": "Brute Force"
    }
  },
  "cwes": {},
  "cves": {
    "CVE-2021-44228": {
      "cve_id": "CVE-2021-44228"
    }
  },
  "asns": {
    "14061": {
      "asn": 14061,
      "name": "DigitalOcean LLC"
    }
  },
  "ports": {
    "22": {
      "service": "ssh"
    }
  }
}

Rate-limit bucket ref

Feeds

Daily-aggregated, edge-cached feeds as JSON, CSV and STIX 2.1. Counts only, no attacker IPs.

GET`/feed/cves.json`

CVE corpus (JSON). Every CVE observed exploited or exposed, with status, counts, CVSS, EPSS and KEV.

curl -s 'https://mirage.offseq.com/feed/cves.json'

Example response (application/json)

[
  {
    "cve": "CVE-2024-4577",
    "status": "exploited",
    "honeypot_attacks": 1752,
    "attacker_sources": 110,
    "exposed_hosts": 0,
    "cvss": 9.8,
    "cvss_source": "nvd",
    "epss": 0.99987,
    "kev": true,
    "last_seen": "2026-10-24T21:02:00Z",
    "url": "https://mirage.offseq.com/cve/CVE-2024-4577"
  }
]

Rate-limit bucket feeds

GET`/feed/cves.csv`

CVE corpus (CSV). The CVE corpus rows as CSV.

curl -s 'https://mirage.offseq.com/feed/cves.csv'

Example response (text/csv)

cve,status,honeypot_attacks,attacker_sources,exposed_hosts,cvss,epss,kev,last_seen,url
CVE-2024-4577,exploited,1752,110,0,9.8,0.99987,True,2026-10-24T21:02:00Z,https://mirage.offseq.com/cve/CVE-2024-4577

Rate-limit bucket feeds

GET`/feed/cves.stix`

CVE corpus (STIX 2.1). A STIX 2.1 bundle of vulnerability objects with x_offseq_* counts. No attacker IPs.

curl -s 'https://mirage.offseq.com/feed/cves.stix'

Example response (application/stix+json)

{
  "type": "bundle",
  "id": "bundle--a19be3d5-fcca-548c-8ee8-d26d788cdb4d",
  "objects": [
    {
      "type": "vulnerability",
      "spec_version": "2.1",
      "id": "vulnerability--4bd4d9d1-8e23-55fd-afd6-62e6058c0972",
      "name": "CVE-2024-4577",
      "x_offseq_status": "exploited",
      "x_offseq_honeypot_attacks": 1752
    }
  ]
}

Rate-limit bucket feeds

GET`/feed/asns.json`

Attacker networks (JSON). Top attacker ASNs by observed volume.

curl -s 'https://mirage.offseq.com/feed/asns.json'

Example response (application/json)

[
  {
    "asn": 64500,
    "org": "Example Hosting GmbH",
    "attacks": 2328127,
    "attacker_sources": 151,
    "last_seen": "2026-10-25T19:44:15Z",
    "url": "https://mirage.offseq.com/asn/AS64500"
  }
]

Rate-limit bucket feeds

GET`/feed/asns.csv`

Attacker networks (CSV). The attacker-network rows as CSV.

curl -s 'https://mirage.offseq.com/feed/asns.csv'

Example response (text/csv)

asn,org,attacks,attacker_sources,last_seen,url
64500,Example Hosting GmbH,2328127,151,2026-10-25T19:44:15Z,https://mirage.offseq.com/asn/AS64500

Rate-limit bucket feeds

GET`/feed/services.json`

Services (JSON). Per-service (protocol/port) attack volume.

curl -s 'https://mirage.offseq.com/feed/services.json'

Example response (application/json)

[
  {
    "service": "vnc",
    "attacks": 3866137,
    "attacker_sources": 1381,
    "last_seen": "2026-10-25T19:44:15Z",
    "url": "https://mirage.offseq.com/service/vnc"
  }
]

Rate-limit bucket feeds

Status

Service readiness and data freshness.

GET`/api/health`

Readiness and freshness. ok is false (HTTP 503) when a hard dependency is down; degraded flags a stalled pipeline, data_age_s is the age of the newest event.

curl -s 'https://mirage.offseq.com/api/health'

Example response (application/json)

{
  "ok": true,
  "degraded": false,
  "stale": [],
  "ts": 1792958413,
  "lake_configured": true,
  "data_age_s": 7.8,
  "feed": {
    "day": "2026-10-24",
    "age_s": 5098.9
  }
}

Bulk data & licence

For bulk use, prefer the edge-cached downloadable feeds or the daily snapshots on GitHub over polling the live endpoints. Data is published under CC BY 4.0: attribute OffSeq Cybersecurity.

Mirage public API

Quick start

Access tiers

Rate limits

Attacks

GET/api/intel/summary

GET/api/intel/recent

GET/api/intel/map

GET/api/intel/timeline

GET/api/intel/top/{dimension}

GET/api/intel/iocs

GET/api/intel/cve/{cve_id}

GET/api/intel/entity/{kind}/{value}

GET/api/intel/session/{session_id}

GET/api/ioc

Actors

GET/api/intel/clusters

GET/api/intel/campaigns

GET/api/intel/graph

GET/api/intel/navigator

Exposure

GET/api/exposure/summary

GET/api/exposure/services

GET/api/exposure/cves

GET/api/exposure/service

GET/api/exposure/timeline

Phishing

GET/api/phish/summary

GET/api/phish/brands

GET/api/phish/timeline

GET/api/phish/map

Enrichment

GET/api/radar/cve/{cve_id}

Reference

GET/api/ref/sources

GET/api/ref/technique/{tid}

GET/api/ref/attack/matrix

GET/api/ref/cwe/{cid}

GET/api/ref/capec/{cid}

GET/api/ref/owasp

GET/api/ref/cve/{cve_id}

GET/api/ref/asn/{asn}

GET/api/ref/country/{cc}

GET/api/ref/port/{port}

POST/api/ref/batch

Feeds

GET/feed/cves.json

GET/feed/cves.csv

GET/feed/cves.stix

GET/feed/asns.json

GET/feed/asns.csv

GET/feed/services.json

Status

GET/api/health

Bulk data & licence

GET`/api/intel/summary`

GET`/api/intel/recent`

GET`/api/intel/map`

GET`/api/intel/timeline`

GET`/api/intel/top/{dimension}`

GET`/api/intel/iocs`

GET`/api/intel/cve/{cve_id}`

GET`/api/intel/entity/{kind}/{value}`

GET`/api/intel/session/{session_id}`

GET`/api/ioc`

GET`/api/intel/clusters`

GET`/api/intel/campaigns`

GET`/api/intel/graph`

GET`/api/intel/navigator`

GET`/api/exposure/summary`

GET`/api/exposure/services`

GET`/api/exposure/cves`

GET`/api/exposure/service`

GET`/api/exposure/timeline`

GET`/api/phish/summary`

GET`/api/phish/brands`

GET`/api/phish/timeline`

GET`/api/phish/map`

GET`/api/radar/cve/{cve_id}`

GET`/api/ref/sources`

GET`/api/ref/technique/{tid}`

GET`/api/ref/attack/matrix`

GET`/api/ref/cwe/{cid}`

GET`/api/ref/capec/{cid}`

GET`/api/ref/owasp`

GET`/api/ref/cve/{cve_id}`

GET`/api/ref/asn/{asn}`

GET`/api/ref/country/{cc}`

GET`/api/ref/port/{port}`

POST`/api/ref/batch`

GET`/feed/cves.json`

GET`/feed/cves.csv`

GET`/feed/cves.stix`

GET`/feed/asns.json`

GET`/feed/asns.csv`

GET`/feed/services.json`

GET`/api/health`