Composite campaign scan across the threat-intel endpoints ($5.50 flat)

One $5.50 flat call that fans an indicator bundle (max 25 indicators: domains, urls, emails, wallets, phones, file URLs, kit/malware fingerprint IDs) across the applicable threat-intel endpoints in-process, then correlates: per-indicator results, kit families, malware families (Malpedia common names plus IOC-corpus attribution for known-malware domains/URLs), shared exfil hosts and shared kit fingerprints across indicators, an aggregate risk score, and corpus citations — packaged for campaign-level takedown intel. Subcalls run under a hard time budget; any truncation is reported via degraded:true, never silently dropped. Individual subcall failures are captured as endpoint-level errors, never crash the composite.

Billing. $5.50 in USDC per call over x402, on Base or Solana. No API key, no signup and no subscription. Send the request with no payment header, take the 402 challenge that comes back, pay it, and repeat the request. Only successful calls are charged.