feat: Add Lunar Domain Exposure API as an optional enrichment source

[rangeva]

Is there an existing feature or issue for this?

• I have searched the existing issues

Expected feature

It may be useful to add Lunar’s Domain Exposure API as an optional enrichment source for compromised domains.

The API returns domain-level exposure data related to infostealer logs and data breaches, including exposure counts, recent activity, malware families, affected services, and infected device metadata.

The API is free to use and does not require an API token.

Example:
https://api.lunarcyber.com/domain-exposure?domain=stryker.com

Alternative solutions

No response

Anything else?

No response

[github-actions]

Hey @rangeva! 🚀 Thanks for this exciting feature idea!

We love seeing fresh concepts that could take reNgine to the next level. 🌟

To help us understand your vision better, could you:

📝 Provide a detailed description of the feature
🎯 Explain the problem it solves or the value it adds
💡 Share any implementation ideas you might have

Your input is invaluable in shaping the future of reNgine. Let's innovate together! 💪

[rangeva]

The idea is to add Lunar’s Domain Exposure API as an optional passive enrichment source when reNgine scans a domain.

Feature description

For each root domain, reNgine could query:

https://api.lunarcyber.com/domain-exposure?domain=example.com

The response provides domain-level exposure data from infostealer logs and data breaches, including:

• Total exposure counts
• Recent exposure activity
• Infostealer versus data-breach exposure
• Malware families associated with infected devices
• Services where exposed credentials were found
• Metadata about infected devices

The integration would not require an API key or authentication.

Problem it solves

reNgine is strong at identifying externally visible assets, services, subdomains, and vulnerabilities. This integration would add another layer: whether credentials connected to the target domain have already appeared in infostealer logs or breach datasets.

That would help users identify cases where:

• Employees or customers may have exposed credentials
• Credentials were stolen from infected devices
• Specific services connected to the domain appear in exposure records
• Exposure activity has increased recently
• A domain has historical breach exposure even when no current infrastructure vulnerability is found

This would give users more context for prioritizing findings and assessing account-compromise risk.

Possible implementation

The API could be added as a passive enrichment module and run once per root domain.

The results could appear in a separate “Domain Exposure” section containing:

• Overall exposure summary
• Exposure counts by source type
• Recent activity timeline
• Malware-family distribution
• Affected services
• Available infected-device metadata

The module could also create informational findings when exposure is present, with severity based on factors such as recent activity, infostealer involvement, or exposure volume.

Since the API is free and requires no token, it could work out of the box, with a setting to enable or disable the module.

I can also provide a sample API response or help map the returned fields to reNgine’s current data model.