<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Exploit Kit Infrastructure

## Shodan API

**Base URL:** `https://api.shodan.io/`

### Host Lookup
```bash
curl "https://api.shodan.io/shodan/host/IP?key=API_KEY"
```

### Search
```bash
curl "https://api.shodan.io/shodan/host/search?key=API_KEY&query=http.title:gate"
```

## SecurityTrails API

**Base URL:** `https://api.securitytrails.com/v1/`

### Domain Info
```bash
curl -H "APIKEY: KEY" https://api.securitytrails.com/v1/domain/example.com
```

### Subdomains
```bash
curl -H "APIKEY: KEY" https://api.securitytrails.com/v1/domain/example.com/subdomains
```

### DNS History
```bash
curl -H "APIKEY: KEY" https://api.securitytrails.com/v1/history/example.com/dns/a
```

## urlscan.io API

**Base URL:** `https://urlscan.io/api/v1/`

### Submit URL
```bash
curl -X POST -H "API-Key: KEY" -H "Content-Type: application/json" \
  https://urlscan.io/api/v1/scan/ \
  -d '{"url":"http://suspect.example/gate.php","visibility":"private"}'
```

### Get Result
```bash
curl https://urlscan.io/api/v1/result/SCAN_UUID/
```

### Search
```bash
curl "https://urlscan.io/api/v1/search/?q=domain:example.com"
```

## Certificate Transparency

### crt.sh Query
```bash
curl "https://crt.sh/?q=%.example.com&output=json"
```

## Key EK Indicators

| Exploit Kit | URL Pattern | HTTP Indicator |
|-------------|-------------|----------------|
| RIG | `/gate.php`, random params | Custom Server header |
| Magnitude | Base64 path segments | 302 redirect chains |
| Fallout | `/redirect.php` | Geo-filtered responses |
| Spelevo | Short `.php` paths | IE-specific targeting |
