Threat Intel / Due Diligence data for AI agents
OSINT and due-diligence signals: domain and IP ownership via RDAP, IP risk profiling (Tor and botnet C2 flags), and FBI Wanted screening.
Get a free key → See all 4 tools
Connect in one step
Threat Intel / Due Diligence tools run on the same LiveDataLink endpoint as every other domain - one bearer key, no per-source integration. Add this to your MCP client (Claude, Cursor, n8n, LangChain, and more):
{
"mcpServers": {
"livedatalink": {
"url": "https://livedatalink.ai/mcp",
"headers": { "Authorization": "Bearer YOUR_API_KEY" }
}
}
}Then call any tool below. The free tier gives you 1,000 queries/month across all 284 tools with no credit card.
Threat Intel / Due Diligence tools (4)
| rdap_domain | Domain registration record via RDAP (modern WHOIS): registrar, dates, status, nameservers, DNSSEC. |
| rdap_ip | IP/block ownership via RDAP: network name, owning org, ASN, CIDR, country. |
| ip_reputation | IP risk profile: geolocation, ASN/ISP, Tor-exit-node flag, and abuse.ch botnet C2 blocklist check. |
| fbi_wanted | Search the FBI Wanted/fugitive list by name or keyword; returns subjects, aliases, field offices, and a link. |
Common queries this domain answers: rdap · whois · domain owner · ip owner · asn · ip reputation · tor · exit node · botnet · c2 · command and control · abuse · threat intel · osint · fbi wanted · fugitive · due diligence · registrar.
Why LiveDataLink for Threat Intel / Due Diligence
- One key, 59 domains. These tools sit alongside FMCSA carrier safety, sanctions screening, SEC filings, courts, Census, and FRED - no separate integration per source.
- Resale-safe. Sourced from RDAP / abuse.ch / FBI - public and openly-licensed data you can embed and redistribute.
- Built for agents. Read-only annotated MCP tools, Streamable HTTP, Bearer auth. Works out of the box in Claude, Cursor, and n8n's native MCP node.
FAQ
- What Threat Intel / Due Diligence data can an AI agent access through LiveDataLink?
- OSINT and due-diligence signals: domain and IP ownership via RDAP, IP risk profiling (Tor and botnet C2 flags), and FBI Wanted screening. It exposes 4 tools (rdap_domain, rdap_ip, ip_reputation, fbi_wanted) over the Model Context Protocol at https://livedatalink.ai/mcp, sourced from RDAP / abuse.ch / FBI.
- How do I connect to the LiveDataLink Threat Intel / Due Diligence MCP server?
- Add https://livedatalink.ai/mcp as a Streamable-HTTP MCP server in Claude, Cursor, n8n, or any MCP client, with an "Authorization: Bearer YOUR_API_KEY" header. Get a free key (1,000 queries/month, no credit card) at https://livedatalink.ai/signup/free. No per-domain setup - the Threat Intel / Due Diligence tools load under the same key as every other domain.
- Is the LiveDataLink Threat Intel / Due Diligence data free and safe to redistribute?
- LiveDataLink sources Threat Intel / Due Diligence data from RDAP / abuse.ch / FBI. Public-domain US-government and openly-licensed data is resale-safe, so results can be embedded and redistributed in your own product. The free tier includes 1,000 queries/month; paid plans start at $10/month.