GhostShield is a scoring API. Send the IP, path and user-agent of a request your app just received. Get back CLEAN, CHALLENGE_REQUIRED or THREAT — with the score and the rule that fired. You decide what to do with it.
It is the same engine that scores every request to the Graylight fleet — 724,000 scored to date. No agent to install, no DNS change, no traffic through us: GhostShield never contacts the address you send it and never sees your response.
POST https://sentinel.graylightcreative.com/v1/ghostshield/scan
X-GS-KEY: gsk_live_...
{"ip":"203.0.113.10","path":"/wp-admin/../.env","user_agent":"sqlmap/1.7"}
→ {"status":"success","verdict":"THREAT","score":100,
"threat_type":"PATH_TRAVERSAL","scans_left":24}
Three more endpoints, same key: GET /v1/ghostshield/bans (your ban list, so you can
push it into your own firewall), GET /v1/ghostshield/threats?hours=24 and
GET /v1/ghostshield/usage.
SQL injection, cross-site scripting, path traversal and shell command injection, matched across the path, query string and body. The single largest category we see in production is traversal probes for .env and .aws/credentials.
masscan, nikto, sqlmap, nmap, zgrab, nuclei, dirbuster, gobuster and hydra, identified by user-agent.
Per-address request velocity over a 60-second and a 1-hour window, scored against your account's own traffic only — never mixed with another customer's.
Anything scoring 80+ is banned for 24 hours on your account and short-circuits every later scan of that address. Readable over the API so you can enforce it at your edge; we never touch your infrastructure.
Threat events are kept for 90 days and visible in your console. Ordinary CLEAN traffic is rolled up to daily counts after 7 days.
Billing runs through Chancellor, Graylight's PCI-scoped orchestration layer. GhostShield never sees or stores your card.
Paid plans are not open yet, so these buttons do not take money rather than pretending to. The free tier above is live now and is the same API.