Nord Security

Nord Security Events API

The Events API from Nord Security — 36 operation(s) for events.

Documentation GitHub OpenAPI

Operations 36

GET /v1/events/combo-lists/{event-id} Retrieves combo list event details.

GET /v1/events/dark-web-forum-posts/{event-id} Retrieves dark web forum post event details.

GET /v1/events/dark-web-marketplace-posts/{event-id} Retrieves dark web marketplace post event details.

GET /v1/events/dark-web-ransomware-posts/{event-id} Retrieves dark web Ransomware post event details.

GET /v1/events/dark-web-telegram-posts/{event-id} Retrieves dark web Telegram post event details.

GET /v1/events/data-breaches/{event-id} Retrieves data breach event details.

GET /v1/events/domain-permutations/{event-id} Retrieves domain permutation event details.

GET /v1/events/malware-infections/{event-id} Retrieves malware infection event details.

GET /v1/events/open-ports/{event-id} Retrieves open port event details.

GET /v1/events/vulnerabilities/{event-id} Retrieves vulnerability event details.

PATCH /v1/events/{event-id}/is_resolved Resolves an event

GET /v2/events/attack-surface-dns-vulnerabilities/{event-id} Retrieves attack surface DNS vulnerability event details.

GET /v2/events/attack-surface-network-service-vulnerabilities/{event-id} Retrieves attack surface network service vulnerability event details.

GET /v2/events/attack-surface-web-application-vulnerabilities/{event-id} Retrieves attack surface web application vulnerability event details.

GET /v2/events/combo-lists/{event-id} Retrieves combo list event details.

GET /v2/events/dark-web-forum-posts/{event-id} Retrieves dark web forum post event details.

GET /v2/events/dark-web-marketplace-posts/{event-id} Retrieves dark web marketplace post event details.

GET /v2/events/dark-web-ransomware-posts/{event-id} Retrieves dark web Ransomware post event details.

GET /v2/events/dark-web-telegram-posts/{event-id} Retrieves dark web Telegram post event details.

GET /v2/events/data-breaches/{event-id} Retrieves data breach event details.

GET /v2/events/domain-permutations/{event-id} Retrieves domain permutation event details.

GET /v2/events/malware-infections/{event-id} Retrieves malware infection event details.

PATCH /v2/events/{event-id}/is_resolved Resolves an event

GET /v3/events/attack-surface-dns-vulnerabilities/{event-id} Retrieves attack surface DNS vulnerability event details.

GET /v3/events/attack-surface-network-service-vulnerabilities/{event-id} Retrieves attack surface network service vulnerability event details.

GET /v3/events/attack-surface-web-application-vulnerabilities/{event-id} Retrieves attack surface web application vulnerability event details.

GET /v3/events/combo-lists/{event-id} Retrieves combo list event details.

GET /v3/events/consumer-credentials/{event-id} Retrieves consumer credential event details.

GET /v3/events/dark-web-forum-posts/{event-id} Retrieves dark web forum post event details.

GET /v3/events/dark-web-marketplace-posts/{event-id} Retrieves dark web marketplace post event details.

GET /v3/events/dark-web-ransomware-posts/{event-id} Retrieves dark web Ransomware post event details.

GET /v3/events/dark-web-telegram-posts/{event-id} Retrieves dark web Telegram post event details.

GET /v3/events/data-breaches/{event-id} Retrieves data breach event details.

GET /v3/events/domain-permutations/{event-id} Retrieves domain permutation event details.

GET /v3/events/malware-infections/{event-id} Retrieves malware infection event details.

PATCH /v3/events/{event-id}/is_resolved Resolves an event

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/nord-security-events-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Nord Security Events API
  version: '3'
  contact:
    name: Vakaris Noreika
    email: vakaris.noreika@nordsec.com
  description: 'Operations tagged Events across 3 of this provider''s published API definitions: nord-security-nordstellar-platform-integration-api-v1-openapi.json, nord-security-nordstellar-platform-integration-api-v2-openapi.json, nord-security-nordstellar-platform-integration-api-v3-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://platform-integration-api.nordstellar.com
security:
- Bearer: []
tags:
- name: Events
paths:
  /v1/events/combo-lists/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves combo list event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Models.ComboList'
              example:
                id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: COMBO_LIST
                module: LEAKED_DATA
                risk_level: HIGH
                is_resolved: false
                date_added: '2020-05-01T08:06:32.000Z'
                asset:
                  type: EMAIL
                  value: test@example.com
                tags:
                - CREDENTIALS
                passwords:
                - password123
                - password456
                - password789
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/dark-web-forum-posts/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves dark web forum post event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Models.DarkWebForumPost'
              example:
                id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: DARK_WEB_FORUM_POST
                module: DARK_WEB_MONITORING
                risk_level: INFORMATIONAL
                is_resolved: false
                date_added: '2024-03-15T10:30:00.000Z'
                tags:
                - CREDIT_CARDS
                - MARKETPLACE
                - COMBO_LIST
                dark_web_monitoring_rule_name: Company Credentials Monitor
                forum_name: DarkMarket
                forum_title: Credential Marketplace
                forum_section: Data Leaks
                author: anonymous_seller
                posted_at: '2024-03-14T22:15:00.000Z'
                scraped_at: '2024-03-15T01:00:00.000Z'
                url: https://darkmarket.example/thread/12345
                content: Selling fresh credentials from recent database breach. DM for details.
                query: example AND tags:CREDIT_CARDS
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/dark-web-marketplace-posts/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves dark web marketplace post event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DarkWebMarketplace.DarkWebMarketplacePost'
              example:
                id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: DARK_WEB_MARKETPLACE_POST
                module: DARK_WEB_MONITORING
                risk_level: INFORMATIONAL
                is_resolved: false
                date_added: '2024-03-15T10:30:00.000Z'
                tags:
                - CREDIT_CARDS
                - MARKETPLACE
                - COMBO_LIST
                dark_web_monitoring_rule_name: Company Credentials Monitor
                marketplace_title: Credential Marketplace
                site_domain_name: 'example.com '
                site_subdomain_url: https://example.com /malware_logs
                price: 10.00$
                marketplace_type: Logs
                author: co####er [platinum]
                posted_at: '2024-03-14T22:15:00.000Z'
                scraped_at: '2024-03-15T01:00:00.000Z'
                url: https://darkmarket.example/thread/12345
                content: 'Stealer: lumma Country: Punjab ISP: Pakistan Telecommunication Company Limited Links: animoto.com.'
                query: example AND tags:CREDIT_CARDS
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/dark-web-ransomware-posts/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves dark web Ransomware post event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DarkWebRansomware.DarkWebRansomwarePost'
              example:
                id: 9e4e5325-c399-433d-a803-fdde187681f6
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: DARK_WEB_RANSOMWARE_POST
                module: DARK_WEB_MONITORING
                risk_level: INFORMATIONAL
                is_resolved: false
                date_added: '2024-03-15T10:30:00.000Z'
                tags:
                - RANSOMWARE
                - MISSING_DOMAIN
                dark_web_monitoring_rule_name: Company Credentials Monitor
                ransomware_title: Company targeted in ransomware attack by Akira
                author: Akira
                posted_at: '2024-03-14T22:15:00.000Z'
                scraped_at: '2024-03-15T01:00:00.000Z'
                url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/
                victim_information:
                  company_name: Company name
                  website: https://www.example.com
                  industry: Public Safety
                  country:
                    name: United States
                    iso2: US
                  company_type: Public Company
                  company_size: 51-200 employees
                  revenue_range: $15,000,000.00 - $25,000,000.00
                  address_location: Davenport, Iowa 12345, US
                  socials:
                  - type: Facebook
                    url: https://www.facebook.com/examplecompany
                query: example AND tags:CREDIT_CARDS
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/dark-web-telegram-posts/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves dark web Telegram post event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Models.DarkWebTelegramPost'
              example:
                id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: DARK_WEB_TELEGRAM_POST
                module: DARK_WEB_MONITORING
                risk_level: INFORMATIONAL
                is_resolved: false
                date_added: '2024-03-15T10:30:00.000Z'
                tags:
                - CREDIT_CARDS
                - MARKETPLACE
                - COMBO_LIST
                dark_web_monitoring_rule_name: Company Credentials Monitor
                channel_name: DataLeaksChannel
                channel_title: Data Leaks & Breaches
                author: anonymous_seller
                posted_at: '2024-03-14T22:15:00.000Z'
                scraped_at: '2024-03-15T01:00:00.000Z'
                url: https://t.me/DataLeaksChannel/12345
                content: Selling fresh credentials from recent database breach. DM for details.
                query: example AND tags:CREDIT_CARDS
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/data-breaches/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves data breach event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataBreach.DataBreach'
              example:
                id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: DATA_BREACH
                module: LEAKED_DATA
                risk_level: HIGH
                is_resolved: false
                date_added: '2020-05-01T08:06:32.000Z'
                official_breach_date: '2020-01-01T08:00:00.000Z'
                asset:
                  type: EMAIL
                  value: test@example.com
                tags:
                - CREDENTIALS
                - PII
                data_keys: country,email,password
                description: Example.com experienced a data breach. Breach happened on the 1st of May 2020
                data_breach_type: IDENTIFIED
                data_points:
                - data_key: email
                  values:
                  - test@example.com
                - data_key: password
                  values:
                  - password123
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/domain-permutations/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves domain permutation event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainPermutation.DomainPermutation'
              example:
                id: 1ea1494c-d1e7-4e7d-a87b-e69f4165e646
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: DOMAIN_PERMUTATION
                module: DOMAIN_SQUATTING
                risk_level: HIGH
                is_resolved: true
                date_added: '2023-02-01T05:18:00.000Z'
                tags:
                - dormant_infrastructure
                - suspicious_infrastructure
                - tld-swap
                original_domain: example.com
                domain: examble.com
                permutation_type: dictionary
                detected_at: '2023-02-01T04:18:00.000Z'
                geo_ips:
                - address: 109.235.74.225
                  country_name: The Netherlands
                  country_code_iso2: NL
                whois:
                  name: REDACTED FOR PRIVACY
                  organization: REDACTED FOR PRIVACY
                  registrar: Realtime Register B.V.
                  contacts: rtr-security-threats@realtimeregister.com
                  registration_date: '2024-11-19'
                  expiration_date: '2025-11-19'
                service_banners:
                  http: cloudflare
                  smtp: lotus.secure-hq.com ESMTP Postcow
                threat_analysis:
                  content_similarity: null
                  visual_similarity: null
                redirects:
                - url: http://meettelesoftas.com/
                  status_code: 301
                ai_analysis:
                  threats:
                  - type: affiliate_fraud
                    confidence: 85
                    evidences:
                    - Redirect chain leads to the original domain (telesoftas.com)
                    - Contains similar content that matches the original domain
                    - Different organization in WHOIS with privacy protection
                    severity: CRITICAL
                  recommendations:
                  - action: Monitor the domain and its activity closely
                    rationale: High risk of affiliate fraud with potential attempts to intercept traffic to the legitimate site.
                name_servers:
                - ns2.yoursrs.com
                - ns1.yoursrs.com
                mail_servers:
                - lotus.secure-hq.com
        '400':
          description: The server cannot or will not process the request due to an error made by the client.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request
                title: Bad Request
                status: 400
                instance: /v1/resource/123
                errors:
                  FIELD A:
                  - ERROR 1
                  - ERROR 2
                  FIELD B:
                  - ERROR 3
        '401':
          description: The server has received and understood the request but is unable to authenticate it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized
                title: Unauthorized
                status: 401
                detail: User unauthorized.
                instance: /v1/resource/123
        '403':
          description: The server has received and understood the request but is unable to authorize it.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden
                title: Forbidden
                status: 403
                detail: The user is not allowed to do an action for the specified resource.
                instance: /v1/resource/123
        '500':
          description: The server has encountered a situation it does not know how to handle.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error
                title: Internal Server Error
                status: 500
                detail: Something went wrong
                instance: /v1/resource/123
    servers:
    - url: https://platform-integration-api.nordstellar.com
  /v1/events/malware-infections/{event-id}:
    get:
      tags:
      - Events
      summary: Retrieves malware infection event details.
      parameters:
      - name: event-id
        in: path
        description: Unique identifier of the event
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: The request has succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareInfection.MalwareInfection'
              example:
                id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf
                project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29
                type: MALWARE_INFECTION
                stealer_name: redline
                identifier: 53956e45779669337341fd33337c7328e5a85b42576152b99ferdf26d736321f
                module: LEAKED_DATA
                risk_level: HIGH
                is_resolved: false
                date_added: '2020-05-01T08:06:32.000Z'
                infection_date: '2020-01-01T08:00:00.000Z'
                asset:
                  type: EMAIL
                  value: test@example.com
                tags:
                - CORPORATE_CREDENTIALS
                - CORPORATE_COOKIES
                - CREDENTIALS
                files:
                - path: path/path/path/file1.txt
                - path: path/path/path/file2.pdf
                corporate_domain_cookies:
                - domain: <redacted>
                  expired_cookies_count: 1
                  valid_cookies_count: 1
                  cookies:
                  - name: cache
                    value: xnhgvsssffcsbs
                    expires_on: '2024-05-01T08:06:32.000Z'
                    expired_for: 1002145
                  - name: machine
                    value: localhost
                    expires_on: '2025-05-01T08:06:32.000Z'
                    expired_for: null
                credentials:
                - url: <redacted>
                  application: Google Chrome
                  email: test@example.com
                  username: example
                  password: asdjnashyssuasa
                  is_corporate: true
                - url: <redacted>
                  application: Google Chrome
                  email: email@example.com
                  username: Username
                  password: Jonam@321
                  is_corporate: false
                corporate_auto_fills:
                - name: website
                  value: <redacted>
                  browser: Firefox
                - name: mobilePhone
                  value: '12354789'
                  browser: Internet Explorer
                credit_cards:
                - card_holder_name: Name Surname
                  card_number: xxxx-xxxx-xxxx
                  cvv: '123'
                  expires_on: 01/01
                device_info:
                  ip: 192.16.0.1
                  hardware_id: 191C0049FB5931205A5AFF3CD86DE98

# --- truncated at 32 KB (200 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/nord-security/refs/heads/main/openapi/nord-security-events-api-openapi.yml