# Threat Intel Gateway
> Real-time IP threat intelligence filtering at the edge

## About
Threat Intel Gateway is an edge security platform that evaluates every incoming request against 18 threat intelligence sources in real-time. It provides IP reputation scoring, geo-blocking, rate limiting, honeypot detection, and a comprehensive investigation dashboard.

## Public API
Base URL: https://threatintel.furkandanis.com/api/v1

### Endpoints
- GET /api/v1/check?ip={ip} — IP reputation lookup (requires API key)
- GET /api/v1/feed/blocklist — Plain text blocklist export
- GET /api/v1/feed/csv — CSV threat feed
- GET /api/v1/feed/json — JSON threat feed
- GET /api/v1/feed/cef — CEF format for SIEM
- GET /api/v1/feed/syslog — Syslog format for SIEM
- GET /api/v1/badge?ip={ip} — SVG reputation badge (no auth)

### Authentication
API key required (X-API-Key header). Format: ti_<64hex>
Daily rate limit per key. Badge endpoint is public.

### Threat Levels
- 0 CLEAN (score < 25)
- 1 SUSPICIOUS (score 25-59)
- 2 MALICIOUS (score 60-89)
- 3 CRITICAL (score >= 90)

## Documentation
- API Docs: https://threatintel.furkandanis.com/docs
- OpenAPI Spec: https://threatintel.furkandanis.com/openapi.json

## Contact
Author: Furkan Danis — https://furkandanis.com