API-first domain exploit monitoring

Sell and consume real browser-based malware scans through one OpenAPI bridge.

ExploitShield combines verified-domain onboarding, API-credit billing, sandboxed crawler scans, MITM artifact capture, threat intelligence enrichment, PDF evidence reports, and connector downloads into one commercial API exchange.

Explore API examples Download connectors Public dashboard

$0.25

one API credit

1 scan

per credit

34 ZIPs

connector packages

16+

detection mechanisms

public scans

public domains

dossiers

Open full public scan dashboard6 live dossiers

vicostone.comavailable

oSoGi33mCOtAgirx

trotons.comavailable

aLSrV3eyQI9fBk2

abv.bgavailable

fhAskphEGGHrBKh9

dw.comavailable

zmxENqKtmqzeRsul

bloomberg.comavailable

2B4swVstDrzSpXRs

zohocorpin.comavailable

KH6uEpITb19IPk4o

API surface

Designed for products, portals, billing systems, and security teams.

The public API model separates client API keys from internal shared secrets. Customers get domain-scoped access, credit accounting, scan queueing, dashboards, reports, billing, cases, entitlement checks, and connector metadata.

GET	/v1/admin/links	Admin Links
GET	/v1/admin/onboarding	Admin Onboarding
GET	/v1/admin/queue	Admin Queue
GET	/v1/billing/blockonomics/callback	Blockonomics Callback
GET	/v1/billing/order/{order_id}	Wordpress Billing Order Compat
POST	/v1/customer/billing	Customer Billing
POST	/v1/customer/dashboard	Customer threat dashboard
POST	/v1/customer/entitlement	Customer Entitlement
POST	/v1/customer/jobs	Customer Jobs
GET	/v1/customer/me	Customer Me
POST	/v1/customer/report	Customer Report
POST	/v1/customer/scan	Customer Scan
GET	/v1/onboarding/{compat_path}	Wordpress Onboarding Compat Get
POST	/v1/onboarding/{compat_path}	Wordpress Onboarding Compat Post
GET	/v1/openapi-health	Openapi Health
GET	/v1/packages/{package}/download	Package Download
GET	/v1/packages/{package}/manifest	Package Manifest
GET	/v1/plugin/{compat_path}	Wordpress Plugin Compat Get
POST	/v1/plugin/{compat_path}	Wordpress Plugin Compat Post
GET	/v1/public/stats	Public Stats
POST	/v1/public/free-scan	Queue Public Free Scan
GET	/v1/public/free-scan/{scan_id}	Public Scan Status
GET	/v1/public/free-scans	Search Public Scans
GET	/v1/public/free-scan-stats	Public Scan Statistics
POST	/v1/site/admin-summary	Site Admin Summary
POST	/v1/site/analyst	Site Analyst
POST	/v1/site/api-keys	Site Api Keys
POST	/v1/site/billing	Site Billing
POST	/v1/site/cases	Site Cases
POST	/v1/site/cases/action	Site Cases Action
POST	/v1/site/dashboard	Signed site threat dashboard
POST	/v1/site/entitlement	Site Entitlement
POST	/v1/site/jobs	Site Jobs
POST	/v1/site/onboarding	Site Onboarding
POST	/v1/site/report	Site Report
POST	/v1/site/scan	Site Scan
POST	/v1/site/security	Site Security
POST	/v1/site/verification	Site Verification
POST	/v1/whmcs/v1/{compat_path}	Whmcs Compat

Code samples

Copy a request, spend a credit, queue a scan.

These examples use a customer API key. They do not require Lovable shared secrets, Flask internal HMAC secrets, or server-only bridge credentials.

curl -X POST https://web-md5.site/v1/customer/scan \
  -H "Authorization: Bearer es_live_YOUR_CUSTOMER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"request_id":"7c8cd0d6-4f0f-4f7d-91a9-4203da71fdc0","profile":"maximum_detection"}'

Threat detection mechanisms

Explain the scanner without making the user read raw crawler logs.

Every mechanism has a reason, an evidence output, and a dashboard benefit. The API Exchange page makes those benefits understandable before showing the raw reference docs.

Domain verification

DNS TXT primary verification, .well-known file verification, HTML meta fallback, and manual blocked-hosting fallback keep scans scoped to owned domains.

API credits

One API credit equals one complete crawler scan, so product teams can sell one-off, monthly, and agency monitoring plans without confusing metering.

Sandboxed crawling

Each scan launches an isolated browser workflow that observes the site like a real visitor without relying on a simple HTTP fetch.

MITM artifact capture

Scripts, HTML, PHP-like bodies, iframes, redirects, content-type mismatches, and downloaded bodies become structured evidence.

Script hashing

Captured script bodies are SHA-256 hashed for deduplication, lineage, historical diffing, external enrichment, and PDF evidence tables.

Redirect intelligence

Redirect chains are expanded, graphed, diffed, and scored for newly appeared hops, hostile redirectors, and suspicious campaign infrastructure.

DNS intelligence

Domain, subdomain, sinkhole, resolver, IP, PTR, ASN, and malware-DNS results are normalized into domain profiles and threat cards.

WHOIS/RDAP intelligence

Domain age, registrar, nameserver, registration changes, and young-domain risk add context to suspicious infrastructure.

Antivirus engines

Captured script-like artifacts can be scanned by configured engines including ClamAV, Defender, Emsisoft, CatchPulse, Dr.Web, Avast, ESET, Kaspersky, and eScan.

Snort IDS

Captured bodies can be checked against configured Snort rules and surfaced as IDS evidence in reports and dashboards.

Hybrid Analysis

Client domains and script hashes can be enriched with external sandbox intelligence where configured.

SecLookup enrichment

Domain and redirect-domain reputation lookups add a compact malicious/non-malicious signal to the overall verdict.

Historical diffing

New domains, changed redirects, changed scripts, and threat deltas are compared against previous crawls for temporal context.

Threat-first reports

Dashboards and PDFs lead with confirmed detections, summary cards, pivots, and analyst notes before raw technical evidence.

Analyst notes

SOC notes can be attached to exact detected indicators and published into customer-facing WordPress, WHMCS, Lovable, and API views.

Connector ecosystem

WordPress, WHMCS, cPanel, Plesk, DirectAdmin, aaPanel, HestiaCP, InterWorx, Webmin, and SDK adapters use the same API model.

Scan workflow

From API request to customer-ready threat intelligence.

The customer sees progress; the integration receives durable job references; the dashboard and PDF report update after ingestion.

Authenticate

Validate API key, host scope, entitlement, allowed profiles, and remaining credits.

Debit and queue

Spend one API credit and create a durable scan job reference for the verified domain.

Capture

Run isolated browser crawl, MITM body capture, redirects, frame tree, script lineage, and mismatch detection.

Enrich

Apply DNS, WHOIS/RDAP, SecLookup, AV engines, Snort IDS, Hybrid Analysis, and historical diffing.

Publish

Expose threat dashboard, cases, analyst notes, PDF reports, connector responses, and API payloads.

Evidence coverage model

Browser telemetry92%

MITM script bodies88%

DNS/RDAP intelligence80%

AV/IDS consensus74%

Historical drift69%

Signals are fused into risk, confidence, novelty, evidence completeness, and customer-facing priority. The dashboard can lead with confirmed threats while keeping the full technical dossier available for analysts.

Connector exchange

Every current ZIP download in one searchable catalog.

WordPress, WHMCS, hosting-panel connectors, billing-system modules, and SDK packages are served from the existing Lovable public downloads folder, using the same /downloads/*.zip URLs already used by the integration.

ZIP package

WordPress Plugin

WordPress onboarding, domain verification, API-credit billing, scan requests, threat dashboard, PDF reports, SOC notes, and update notices.

exploitshield-domain-monitor.zipDownload

ZIP package

WHMCS Module

Client-area monitoring, admin controls, API-credit accounting, scan launch, report download, support workflow, and reseller-ready billing.

exploitshield-whmcs-module.zipDownload

ZIP package

cPanel Plugin

Hosting-panel domain verification, run-scan controls, rich threat cards, diagnostics, and API bridge settings.

exploitshield-cpanel-plugin.zipDownload

ZIP package

Plesk Extension

Plesk-native monitoring panel with threat cards, scan controls, diagnostics, and report links.

exploitshield-plesk-extension.zipDownload

ZIP package

PHP SDK

Thin PHP adapter for account, scan, report, credits, cases, and connector catalog flows.

exploitshield-sdk-php.zipDownload

ZIP package

Python SDK

Python client adapter for API keys, credit checks, scan queueing, report retrieval, and status polling.

exploitshield-sdk-python.zipDownload

ZIP package

Perl SDK

Perl integration layer for legacy hosting, billing panels, and lightweight automation.

exploitshield-sdk-perl.zipDownload

ZIP package

DirectAdmin Plugin

DirectAdmin control-panel connector for verified-domain scan workflows.

exploitshield-directadmin-plugin.zipDownload

ZIP package

DirectAdmin WHMCS

WHMCS provisioning bridge for DirectAdmin-backed hosting businesses.

exploitshield-directadmin-whmcs.zipDownload

ZIP package

aaPanel Add-on

aaPanel connector package for ExploitShield FastAPI/OpenAPI workflows.

exploitshield-aapanel-addon.zipDownload

ZIP package

aaPanel WHMCS

WHMCS module variant for aaPanel hosting-provider workflows.

exploitshield-aapanel-whmcs.zipDownload

ZIP package

ApisCP Add-on

ApisCP connector for customer-visible scan requests and report access.

exploitshield-apiscp-addon.zipDownload

ZIP package

BILLmanager Integration

BILLmanager billing/resale integration for credit-backed monitoring plans.

exploitshield-billmanager-integration.zipDownload

ZIP package

Blesta Add-on

Blesta service-panel integration for API-credit-backed scan products.

exploitshield-blesta-addon.zipDownload

ZIP package

Clientexec Snapin

Clientexec snap-in for service ordering, scan visibility, and reporting.

exploitshield-clientexec-snapin.zipDownload

ZIP package

CWP Add-on

Control Web Panel add-on for connected ExploitShield monitoring.

exploitshield-cwp-addon.zipDownload

ZIP package

CyberPanel Add-on

CyberPanel connector for verified-domain scans and threat reports.

exploitshield-cyberpanel-addon.zipDownload

ZIP package

CyberPanel WHMCS

WHMCS bridge package for CyberPanel hosting workflows.

exploitshield-cyberpanel-whmcs.zipDownload

ZIP package

Enhance WHMCS

Enhance platform provisioning module for resale and client monitoring.

exploitshield-enhance-whmcs.zipDownload

ZIP package

FOSSBilling Extension

FOSSBilling extension for credit-backed ExploitShield service plans.

exploitshield-fossbilling-extension.zipDownload

ZIP package

HestiaCP Add-on

HestiaCP connector for panel-native website monitoring flows.

exploitshield-hestiacp-addon.zipDownload

ZIP package

HestiaCP WHMCS

WHMCS provisioning module for HestiaCP services.

exploitshield-hestiacp-whmcs.zipDownload

ZIP package

HostBill Module

HostBill module for packaged website security monitoring products.

exploitshield-hostbill-module.zipDownload

ZIP package

InterWorx Plugin

InterWorx plugin package for panel-level customer scan controls.

exploitshield-interworx-plugin.zipDownload

ZIP package

InterWorx WHMCS

WHMCS module for InterWorx-backed hosting providers.

exploitshield-interworx-whmcs.zipDownload

ZIP package

ISPConfig Add-on

ISPConfig connector for domain monitoring workflows.

exploitshield-ispconfig-addon.zipDownload

ZIP package

ispmanager Module

ispmanager add-on for connected ExploitShield services.

exploitshield-ispmanager-module.zipDownload

ZIP package

ispmanager WHMCS

WHMCS provisioning module for ispmanager environments.

exploitshield-ispmanager-whmcs.zipDownload

ZIP package

OpenPanel Add-on

OpenPanel connector for FastAPI/OpenAPI-backed monitoring.

exploitshield-openpanel-addon.zipDownload

ZIP package

RunCloud Integration

RunCloud integration package for connected customer domains.

exploitshield-runcloud-integration.zipDownload

ZIP package

SolidCP Integration

SolidCP integration for Windows hosting operations.

exploitshield-solidcp-integration.zipDownload

ZIP package

Virtualmin/Webmin Module

Virtualmin and Webmin connector for account-level monitoring.

exploitshield-virtualmin-webmin-module.zipDownload

ZIP package

Virtualmin/Webmin WHMCS

WHMCS module for Virtualmin/Webmin hosting stacks.

exploitshield-virtualmin-webmin-whmcs.zipDownload

ZIP package

WISECP Add-on

WISECP integration for commercial website-monitoring products.

exploitshield-wisecp-addon.zipDownload

API credit pricing

Simple enough for self-service. Structured enough for agencies.

The model stays consistent across Lovable, WordPress, WHMCS, hosting panels, and direct FastAPI/OpenAPI usage.

Starter

1 API Credit

$0.25

One verified-domain crawl scan with dashboard output and report availability.

Manage credits

Pro Monitoring

100 API Credits

$25/mo

Recurring monitoring capacity for businesses, developers, and security operators.

Manage credits

Agency

1,000 API Credits

$250/mo

Multi-client monitoring for agencies, MSSPs, hosting companies, and resellers.

Manage credits

Deep reference

Endpoint-by-endpoint technical documentation remains available.

The existing detailed examples, request/response notes, errors, and multi-language reference stay below the modern API Exchange overview for advanced implementers.

FastAPI / OpenAPI

Connect your systems to the ExploitShield API

Generate a customer API key from your verified dashboard, then call domain-scoped dashboard, scan, report, billing, and entitlement endpoints through the same web-md5.site gateway used by the portal. Public integration endpoints also expose connector catalogs, release manifests, QA reports, and certification metadata for SDKs, plugins, and hosting-panel add-ons. One accepted scan consumes one API credit.

Auth

Bearer API key

Docs

OpenAPI UI

Limit

8 KB signed JSON

Customer API

Integration ecosystem

Platform health

Public telemetry

Customer bearer key

Customer Dashboard

POST /v1/customer/dashboard

Fetch the API-key owner's domain-scoped threat dashboard, including expanded MITM artifacts, content-type mismatches, runtime script injections, iframe/frame evidence, redirect graph context, script lineage, historical script/redirect diffs, and artifact risk scores when available. The host/link/account are inferred from the API key.

Group

Customer API

Audience

Customers using their own API keys and API credits

Auth model

Customer bearer key

Request fields

Required

Authorization: Bearer es_live_...

Optional

severitysourcekindquerypagepage_size

Practical test

1.Use the bearer key for the target domain.
2.Render data.rich_threat_cards before raw evidence tables for the threat-first view.
3.Apply filters only as request JSON.
4.The API key decides the host scope; do not send host/link_id.

Success response shape

okdata.countsdata.findingsdata.rich_threat_cardsdata.evidence_tablesdata.technical_summarydata.visualizations

rich_threat_cards[]

These cards are the recommended first render target for threat-first dashboards. They summarize expanded MITM artifact capture, MIME mismatches, runtime script injection, iframe and frame evidence, script lineage, script/redirect history changes, and artifact risk scoring before clients inspect raw evidence tables.

idStable card id such as expanded_mitm, content_type_mismatch, runtime_injection, frame_tree, script_lineage, script_redirect_diff, or artifact_risk_scoring.

titleHuman-readable dashboard card title.

countDomain-scoped number of retained records for this evidence family.

severityHighest or inferred card severity: Critical, High, Medium, Low, Informational, or Clean.

scoreHighest artifact risk score when scoring data is available.

top_indicators[]Top URLs, scripts, frames, artifacts, hashes, or labels for pivoting.

severity_breakdown[]Counts grouped by severity, risk level, or classification.

sample_rows[]Small client-safe evidence samples with local paths, secrets, raw bodies, and commands removed.

Common errors

- 401 invalid_api_key
- 403 api_key_scope_denied or entitlement_required

Python sample

import requests

headers = {"Authorization": "Bearer es_live_YOUR_CUSTOMER_API_KEY"}
payload = {
  "severity": "High",
  "source": "Snort IDS",
  "kind": "confirmed",
  "query": "redirect",
  "page": 1,
  "page_size": 20
}
response = requests.post("https://web-md5.site/v1/customer/dashboard", headers={**headers, "Content-Type": "application/json"}, json=payload, timeout=45)
print(response.status_code, response.headers.get("content-type"))
if response.headers.get("content-type", "").startswith("application/pdf"):
    open("exploitshield-report.pdf", "wb").write(response.content)
else:
    print(response.text[:2000])

For signed routes, generate a fresh timestamp and nonce for every retry. Never expose server-side API secrets in browser JavaScript.