Leviathan OffSec // Exposure Intelligence API

Internet exposure intelligence,
queryable in under a second.

Loading live numbers from the production API... Enriched with ASN classification, IP type and a 0 to 100 risk score. Query by IP, ASN or port. No signup to see the numbers: the stats below are pulled from the production API as you read this.

Try it live

search something — results come straight from production, no key needed
shared demo key · 100 queries/day for everyone · when it's gone, get your own free key (10/day, private)

Live dataset

...
records
...
unique IPs
...
ASNs
...
critical tier
LIVE // production API
loading risk distribution...

Prefer a static overview? Download the 4-page dataset summary (PDF): coverage, risk segments, tier distribution, infrastructure classification, top operators. Aggregate stats only, no raw records.

Query it — curl examples 
curl https://hbz2jqz528.execute-api.ap-southeast-2.amazonaws.com/search/ip/143.203.33.139 \
  -H "x-api-key: YOUR_KEY"

curl .../search/asn/15169?limit=50   -H "x-api-key: YOUR_KEY"   # every Google IP we saw
curl .../search/port/6001?limit=100  -H "x-api-key: YOUR_KEY"   # X11 servers, risk scored
curl .../stats/risk-distribution                                # open, no key

Responses carry the full record: ports, ASN and org, product and version, hostnames, registered domain, city and state, TLS issuer and expiry, first and last seen, risk flags, risk score and tier. Pagination is a limit parameter, capped at 1,000.

What is in a record

IDENTITY

IP, ASN, org, ISP

4,776 autonomous systems observed. ASN type classified: hosting, ISP, education, enterprise, other.

SERVICE

Port, product, version

6,323 distinct ports. Service class and banner-derived product where the endpoint offered one.

RISK

Score 0 to 100, tier

Deterministic scoring across 17 risk classes: exposed admin surfaces, legacy protocols, crypto anomalies, known-bad service mixes.

CONTEXT

Geo, TLS, hostnames

City and state, registered domain, TLS issuer and expiry, SSL presence flag.

Pricing

Free
$0 / day
  • 10 queries a day
  • All three search endpoints
  • Full records, no fields withheld
Starter
$99 / month
  • 1,000 queries a day
  • IP, ASN and port search
  • Priority key support
Checkout
Bulk
$499 / month
  • Unlimited queries
  • Full-dataset export (CSV, Parquet)
  • Refreshed corpora as regions add
Start free
Method. Records come from our continuous exposure collection pipeline: licensed internet-scanning telemetry feeds, per-host correlation, and in-house enrichment with a 17-class risk engine. No credentials, no customer data, no PII. Exposure records describe what any internet scanner already sees. United States is live; Vietnam and China are in active collection. API v1.0.