License the data. Run it on your own infrastructure.
Your product already has a policy engine. The question is where its lookups run. License our threat and category data, keep your local database copy, and use the Query API for the rest.
Use cases you can build with it: secure web gateway · secure email gateway · protective DNS · VPN · secure browser · endpoint
OEM threat intelligence is domain, URL and IP risk scoring, plus content categorization for domains, URLs and millions of IPs, that security vendors license and embed in their own products. alphaMountain sells URL Classification (92 content categories), Threat Feed (1.0 to 10.0 risk score) and Domain/IP reputation factors. Available as OEM, white label or co-branded.
Your local DB copy. Your stability, latency and caching.
Everyday lookups run on your infrastructure, so they don't wait on a round trip to our cloud. You decide how to cache them. Category Batch and Threat Batch update your local DB copy every hour. The Query API covers what your copy hasn't seen.
Three product categories. One verdict format.
- URL Classification: 92 content categories for domains, URLs and a subset of IPs, as Category API, Category Batch or Category Feed.
- Threat Feed: a 1.0 to 10.0 risk score for domains, URLs and IPs, where 1 is very safe and 10 is known malicious, as Threat API, Threat Batch or Threat Feed.
- Domain/IP reputation factors: context that shows what drove a verdict, as Intelligence API.
A verdict is a category plus a risk score. Your product decides what to block.
Ingest it your way. Combine as needed.
- Batch API: batch updates to your local DB copy, delivered as Category Batch or Threat Batch.
- Query API: real-time, one-by-one lookups through the documented API (JSON and CSV).
- Feed: a segment of new findings. With Category Feed, you choose the categories. With Threat Feed, you choose a risk-score range, 7.0 and up by default.
Volume decides API or batch.
- Up to about 100,000 lookups a day: the Query API alone fits.
- Above about 100,000 a day: we recommend batch. The Query API handles up to 300,000 a day, but your local DB copy keeps latency under your control.
| Field | Detail |
|---|---|
| Object types | Domains, URLs, IPs |
| Product categories | URL Classification, Threat Feed, Domain/IP reputation factors |
| Products | Category API, Category Batch, Category Feed; Threat API, Threat Batch, Threat Feed; Intelligence API |
| Verdict | A content category plus a 1.0 to 10.0 risk score: 1 is very safe, 10 is known malicious |
| Content categories | 92, for domains and URLs, plus a subset of IPs; full list at /categories/ |
| Databases | Threat database, category database; priced separately, or as a bundle of both |
| Ingestion | Batch API (batch updates to your local DB copy: Category Batch, Threat Batch), Query API (one-by-one lookups), feed (a segment of new findings: Category Feed by category, Threat Feed by risk-score range, 7.0 and up by default) |
| Update cadence | Batch updates to your local DB copy every hour |
| Volume | Query API up to 300,000 lookups a day; batch recommended above about 100,000 a day |
| Blocking rules | Set in your product: by risk score, by category, or both |
| Formats | Documented API; JSON and CSV via the API |
| Domain/IP reputation factors | Intelligence API: human-readable context (WHOIS, popularity and passive DNS) paired with the risk score, that shows what drove the verdict |
| Availability | OEM, white label or co-branded |
| Evaluation | Free trials; help with proofs of value (POV) |
| Out of scope | File analysis. We don't analyze files. |
Licensing follows how you sell.
License by royalty (you pay as your product sells) or by consumption (you pay as it uses the data). The threat and category databases are priced separately, or as a bundle of both.
What we'd ask, if we were you.
- Can we try it first? Yes. We offer free trials, and we help you run a proof of value (POV).
- Can we check scores before the call? Yes. Look up a domain or URL in threatYeti.
- Do you analyze files? No. We score domains, URLs and IPs.
- Is there outside evidence? Our verdicts appear on VirusTotal as a listed URL engine. That shows visibility, not accuracy. Your POV shows accuracy.
- What if a verdict is wrong? Site owners can report a false positive.
FAQ
What is OEM threat intelligence, and is it white label?
OEM threat intelligence is domain, URL and IP risk scoring, plus content categorization for domains, URLs and a subset of IPs, that security vendors license and embed in their own products. alphaMountain's data is available as OEM, white label or co-branded.
Why keep a local DB copy instead of calling an API?
Your local DB copy puts stability, latency and caching under your control. Everyday lookups run on your infrastructure, not our cloud, and the Query API covers the rest.
Do we get the whole database, or part of it?
With batch, you get the whole database you license as your local DB copy: the threat database (Threat Batch), the category database (Category Batch), or both. Threat Feed delivers new threat findings in the risk-score range you choose, 7.0 and up by default.
What happens when a URL isn't in our local DB copy?
Your product looks it up with the Query API, one lookup at a time.
What score scale and categories do you use?
A score from 1.0 to 10.0, where 1 is very safe and 10 is known malicious, plus 92 content categories for domains, URLs and a subset of IPs, listed at /categories/.
Can we try the data before we license it?
Yes. We offer free trials, and we help you run a proof of value (POV).
How is OEM licensing priced?
By royalty or by consumption. The threat and category databases are priced separately, or as a bundle of both. Talk to us for pricing.
Is there a URL categorization API as well as a URL categorization database?
Yes: Category API and Category Batch, both part of URL Classification. Up to about 100,000 lookups a day, Category API alone fits. See URL Classification.
How often does the data update?
Batch updates reach your local DB copy every hour. The Query API covers what your copy hasn't seen.
Bring your volume.
Tell us what you ship and how many lookups it makes a day. We'll match the products, ingestion and licensing to it.