Correlate breach, session, SIM swap and domain signals for one identity

Runs the breach and stolen-session checks for the supplied email (always), plus SIM swap when a phone is supplied and a domain lookalike sweep when a domain is supplied, then matches the resulting signal set against the same coordinated-attack-chain table the WhatsApp monitor uses in the background -- on demand, for any identity, in one call. A chain match (for example breach + SIM swap within the same identity) is a materially higher-confidence finding than either signal alone: attackers commonly combine credential theft with a SIM swap to intercept SMS 2FA.

Billing. $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

Note. Each sub-check keeps its own failure behaviour -- a SIM swap check the carrier could not answer, or a session-risk query that failed, is reported as checked: false rather than folded into 'not present'. Only smishing_to_sim_swap and breach_otp_intercept can never fire here: both require an SMS or OTP event observed inside a monitored conversation, which this endpoint has no way to check for an arbitrary identity.