<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Tracking Threat Actor Infrastructure

## SecurityTrails API

**Base URL:** `https://api.securitytrails.com/v1`

### Domain DNS History
```bash
curl -H "apikey: $ST_KEY" "https://api.securitytrails.com/v1/domain/evil.com/dns/a"
```

### Domain WHOIS
```bash
curl -H "apikey: $ST_KEY" "https://api.securitytrails.com/v1/domain/evil.com/whois"
```

### Reverse DNS by IP
```bash
curl -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domains/list" \
  -d '{"filter":{"ipv4":"1.2.3.4"}}'
```

### WHOIS Reverse (by registrant email)
```bash
curl -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domains/whois/user@example.com"
```

## Shodan API

### Host Lookup
```bash
curl "https://api.shodan.io/shodan/host/1.2.3.4?key=$SHODAN_KEY"
```

### Search by JARM
```bash
curl "https://api.shodan.io/shodan/host/search?key=$SHODAN_KEY&query=ssl.jarm:2ad2ad..."
```

### Search by Certificate
```bash
curl "https://api.shodan.io/shodan/host/search?key=$SHODAN_KEY&query=ssl.cert.subject.cn:evil.com"
```

## Censys API

### Host Search
```bash
curl -u "$CENSYS_ID:$CENSYS_SECRET" \
  "https://search.censys.io/api/v2/hosts/search?q=services.tls.certificates.leaf.names:evil.com"
```

## Certificate Transparency

### crt.sh
```bash
curl "https://crt.sh/?q=%.evil.com&output=json"
```

### Certstream (real-time monitoring)
```python
import certstream

def callback(message, context):
    if message["message_type"] == "certificate_update":
        domains = message["data"]["leaf_cert"]["all_domains"]
        for d in domains:
            if "evil" in d:
                print(f"[!] Suspicious cert: {d}")

certstream.listen_for_events(callback, url="wss://certstream.calidog.io/")
```

## JARM Fingerprinting

### Generate fingerprint
```bash
python -m jarm evil-c2.com
# Output: evil-c2.com,1.2.3.4,443,2ad2ad0002ad2ad00042d42d000000...
```

### Common C2 JARM Signatures
| Framework | JARM Hash (partial) |
|-----------|-------------------|
| Cobalt Strike | `07d14d16d21d21d07c42d41d00041d` |
| Metasploit | `07d14d16d21d21d00042d41d00041d` |
| Sliver | `2ad2ad0002ad2ad00042d42d000000` |

## Environment Variables

| Variable | Description |
|----------|-------------|
| `SECURITYTRAILS_KEY` | SecurityTrails API key |
| `SHODAN_API_KEY` | Shodan API key |
| `CENSYS_ID` | Censys API ID |
| `CENSYS_SECRET` | Censys API secret |
