Ten free threat-intel APIs compared

Coeus can read ten API-connected sources. All ten have a usable free tier; none of them are interchangeable. This is what each one actually answers, what it costs you in requests, and where it goes quiet.

Every figure below was checked against the source's own documentation on 2026-09-07, with live unauthenticated probes where a keyless mode exists. Free tiers move. The date is the promise, not the number.

The short version#

Source	Answers for	Keyless	Free limit enforced by the queue
VirusTotal	IP, domain, URL, hash	no	4/min, 500/day
AbuseIPDB	IP	no	30/min, 1,000/day
urlscan.io	domain, IP, URL, hash	reads, low quota	30/min search, 1,000/day
Shodan	IP (domain with a key)	no	60/min, 1,000/day
OTX	IP, domain, URL, hash, CVE	no	60/min, 10,000/day
GreyNoise	IPv4	~10/day	50/day
IPinfo	IP	yes, fewer fields	60/min, 1,500/day
abuse.ch	URL, domain, IP, hash	no, since 2025-06-30	30/min, 2,000/day
NVD	CVE	yes	5 per 30 s (50 with a key)
crt.sh	domain	yes	4/min, 200/day

Reputation, from a crowd#

VirusTotal is the one everybody reaches for, and its free tier is the tightest here: four requests a minute. The verdict comes from last_analysis_stats — one malicious engine is enough to mark it malicious, three or more is treated as high confidence. What VirusTotal is best at is not the score but the metadata around it: as_owner and country for an address, registrar and creation_date for a domain, the suggested threat label for a file. Use it as the second opinion, not the first request.

VirusTotal

Answers for

IP, domain, URL, hash

What it offered

Multi-engine reputation, file metadata and threat labels.

AlienVault OTX is crowd-sourced in a different way: its unit is the pulse, a curated collection published by a researcher. Three or more pulses reads as malicious, one or two as suspicious, zero as unknown — never as clean. That is the honest mapping, and it is worth internalising: an absence of pulses says nothing at all. OTX is the only source here that answers for every type Coeus enriches, CVE included.

AbuseIPDB does one thing very well. abuseConfidenceScore runs 0–100 from community reports; Coeus reads 75 and above as malicious, 25–74 as suspicious. An unreported address returns 200 with a score of zero, never a 404, so "not reported" and "not found" are distinguishable — which they are not everywhere. The usageType and isp fields are quietly useful for telling a hosting provider from a residential range.

Descriptive, not judgemental#

Shodan does not tell you whether something is bad. It tells you what is listening. The adapter marks a host suspicious only when vulns is non-empty or the tags include malware, compromised, honeypot or c2; otherwise it returns unknown with facts. When this was first written Coeus fell back to Shodan's keyless InternetDB. It no longer does: on 16 September 2026 we removed that mode, because InternetDB's terms rule out commercial products that charge money. Coeus no longer has a paid tier, and its current tools do not ship keyed API adapters. At the time of this comparison, Shodan needed a key, and free "dev" keys typically carried no query credits.

IPinfo always returns unknown, by design. It is geolocation and ASN ownership: org (as AS15169 Google LLC, which the adapter splits), hostname, city, region, country. The keyless mode works and is generous. It is the fastest way to answer "whose address is this" without spending a VirusTotal request.

crt.sh is certificate transparency, no auth, domain only. It answers "what else has this organisation issued certificates for", which is the single best passive way to find subdomains. The verdict is always unknown; the value is in the facts — certificate count, newest not_before, distinct issuers, a sample of unique names, and whether a wildcard exists. Its informal limit is about five requests a minute, so the queue is set to four and you should expect the occasional 502.

Curated feeds#

abuse.ch — URLhaus, MalwareBazaar and ThreatFox behind one Auth-Key — is the highest signal-to-noise source on this list, because it is not a score but a curated list of things that are known bad. Any hit is treated as malicious. Since 2025-06-30 every call without a key returns 401, so the free key from auth.abuse.ch is mandatory. Coeus fans a single trace out by type: a URL goes to URLhaus, a domain or IP to URLhaus plus ThreatFox, a hash to MalwareBazaar plus ThreatFox, and the strongest hit wins.

GreyNoise Community answers one question with unusual precision: is this address part of the internet's background scanning noise? classification: benign is a real "clean" — the RIOT data set is common business services — and it is the only clean verdict Coeus takes at face value. The quota is small and the documentation disagrees with itself (100/day on one page, 50/week on another), so the queue enforces 50/day and shows the meter.

Scans and CVEs#

urlscan.io works keyless for reads at a much lower quota, which is enough for the occasional domain check. Its verdict comes from the newest five results: any with verdicts.overall.malicious marks it malicious. The screenshot of the newest scan is often the fastest way to identify a phishing kit by eye. Submitting a new scan is a separate action in Coeus, never automatic, and it always shows the visibility choice — public, unlisted or private — because submitting a customer URL publicly is a data-loss incident, not a read.

NVD is the only CVE source, and it works without a key at five requests per rolling 30 seconds. A key raises that to fifty. The mapping is the one place Coeus reaches beyond "malicious/clean": presence in CISA's KEV catalogue (cisaExploitAdd) or a base score of 9 or more reads as malicious, 7 or more as suspicious. Everything else is unknown with the CVSS vector, the vulnerability status and the CWE ids as facts.

How consensus works#

With several sources answering, Coeus shows a consensus bar rather than a single number. Sources that cannot express malice — IPinfo, crt.sh, Shodan without vulns — contribute facts and never a verdict, so they cannot dilute one. Among the rest, the strongest verdict is shown with the count behind it, so "malicious 2 of 4" and "malicious 4 of 4" are different sentences. No source is weighted above another by fiat; you can see which said what.

Getting the keys#

All ten are free to start and none require a card. The per-source walkthrough — where the key lives on each site, exactly which endpoints Coeus calls, and what the adapter reads from the response — is in the API keys doc, and the comparison table carries the same figures with a "Get a key" link each.

The keys stay in this browser: where your API keys live explains what that means in practice, including the ranges Coeus refuses to send anywhere.