Breach detection, SIM swap monitoring, infostealer exposure, domain lookalike scanning, and live threat intelligence — REST API, no monthly minimum, no commitments.
Unlike leading enterprise threat intelligence platforms that charge per API key and per user seat, RelayShield charges only for the calls you make. One API key, no seat fees, no per-user licensing.
Enter your email to get started. You'll be redirected to a secure checkout to save a card. Your API key arrives by email instantly.
No monthly minimum · Pay only for calls made · Cancel anytime
register assets, sweep all registered assets against 2.1M+ IOC corpus, list or remove. Webhook push alerts fire automatically when new IOCs match your registered assetsexploit-chatter: detect pre-publication CVE PoC discussion in criminal channels before NVD/KEV publication, with EPSS score and KEV status. actor-lookup: track a threat actor or malware campaign (e.g. LummaC2, APT29) — returns IOC count, IOC breakdown by type, MITRE ATT&CK group info, aliases, and techniques🤗 Try the Agentic Attack Surface live on Hugging Face — no signup required to explore the MCP schema. Space · announcement post
RelayShield's edge is OSINT threat hunting most vendors can't reach — our own collection pipeline runs continuous, verified monitoring across 122 active criminal Telegram channels (infostealer markets, credential dumps, breach announcements), not a static feed subscription. That's layered with 3.2M+ indicators aggregated from 17 authoritative external sources (abuse.ch, Spamhaus, AbuseIPDB, AlienVault OTX, PhishTank, CISA KEV, MITRE ATT&CK/ATLAS, and more). Emails, domains, IPs, hashes, phone numbers, and wallet addresses — 24–72 hours ahead of public breach databases.
All 26 metered endpoints included. Both TI subscription tiers cover unlimited access to all metered API endpoints above — breach, SIM swap, infostealer, domain, OAuth & token exposure, supply chain, session hijack detection, crypto asset surface, asset intel monitoring, threat actor intelligence, CVE × identity risk correlation, domain identity risk scoring, bulk IOC enrichment, IOC pivot, brand monitoring, bulk identity risk, agent framework exploit monitoring, MCP registry risk, prompt-injection breach detection, certificate expiry risk, and passive DNS/IP reputation — in addition to the Threat Intelligence IOC and CVE feeds. No per-endpoint add-ons. One subscription, full access.
| MSP — $499/mo | MSSP — $999/mo | |
|---|---|---|
| Calls / month | 10,000 | Unlimited |
| IOC types | Email · Phone · Domain · Wallet | |
| Intel sources | Criminal Telegram channels, ThreatFox, URLhaus, CISA KEV, Feodo Tracker, AbuseIPDB, MalwareBazaar, PhishTank, Emerging Threats, AlienVault OTX | |
| Lead time vs HIBP | 24–72 hours | |
| Rate limit | ~333 calls/day | None |
| Support | Standard email | Priority + SLA |
| Best for | SOC teams, SOAR playbooks, incident response | MSSPs with continuous multi-client monitoring |
Look up CISA Known Exploited Vulnerabilities by CVE ID or keyword — cross-referenced for active ransomware campaign activity. Included on all TI subscription tiers.
{"cve_id": "CVE-2024-1234"}
{"keyword": "apache"}
Pull our IOC corpus with your SIEM's built-in TAXII client or MISP instance — no custom integration work, both require a TI subscription and support incremental pulls via added_after + pagination. Or configure a destination once and have real-time findings pushed to you as they fire.
Turn any wallet scan, domain check, or vendor sweep result into a persistent, shareable URL. Generation requires a subscription; viewing the resulting link is public with no login required — paste it into a client ticket or incident report.
report_id and public share_url for the summary you submit.# Breach check curl -X POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/metered/breach \ -H "X-RS-API-KEY: rs_live_your_key_here" \ -H "Content-Type: application/json" \ -d '{"email": "user@example.com"}' # Response { "ok": true, "data": { "email": "user@example.com", "breach_count": 3, "breaches": [{ "name": "LinkedIn", "breach_date": "2021-06-22", ... }] } }
Copy-paste to run immediately. No SDK required — standard library only.
import urllib.request, json API_KEY = "rs_live_your_key_here" BASE = "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod" def rs_post(path, payload): data = json.dumps(payload).encode() req = urllib.request.Request( f"{BASE}{path}", data=data, headers={"Content-Type": "application/json", "X-RS-API-KEY": API_KEY}, ) with urllib.request.urlopen(req, timeout=10) as r: return json.loads(r.read()) email = "user@example.com" breach = rs_post("/v1/metered/breach", {"email": email}) print(f"Breaches: {breach.get('breach_count', 0)}") if breach.get("breach_count", 0) > 0: stealer = rs_post("/v1/metered/infostealer", {"email": email}) print(f"Infostealer exposure: {stealer.get('exposed', False)}") if stealer.get("exposed"): print(f" Markets: {stealer.get('markets', [])}") print(" ACTION: credential reset + session revocation")
MCP registry-risk and prompt-injection-breach checks, plus a mandatory pre-execution gate, packaged natively for the agent frameworks you're already building on.
n8n-nodes-relayshield is verified and available directly on n8n Cloud — search for it on the canvas, no manual install needed.
Featured in n8n's official template gallery
“Check new-hire identity risk and provision Google Workspace accounts with RelayShield” — HR webhook → parallel breach/infostealer checks → Google Workspace provisioning → Notion + Slack. creators.n8n.io/workflows/17255
“Nice work! You could extend this to trigger when an employee is deactivated in your HR system — run breach + infostealer checks on offboarding, then log to Notion or alert Slack if their credentials are circulating.”
— n8n community member, on the RelayShield breach monitoring workflow template
Used in SOAR playbooks, SIEM enrichment pipelines, MSP onboarding/offboarding automations, and incident response triage workflows. Tell us what you're building.