---
title: "Full Threat Analysis"
method: GET
path: "/check"
tags: ["check"]
---

# Full Threat Analysis

`GET /check`

Comprehensive threat intelligence check for IPs and domains.

**Enrichment Levels:**
- `basic` - Malicious status, reputation, geo, whois, certificates, vulnerabilities
- `standard` - Basic + risk score, classification, confidence, MITRE mapping
- `full` - Standard + detection timeline, related infrastructure, DNS analysis, tech stack

## Path parameters

- `query` string, required
- `enrichment` string, nullable, required
- `track_reports` boolean, nullable, required

## Response `200`

Successful threat analysis response

- CheckResponse — Main threat analysis response
  - `api_version` string, required — API version used
  - `certificates` CertificateData — SSL/TLS certificate information
    - `fingerprint` string, required — Certificate fingerprint
    - `issuer` string, required — Certificate issuer
    - `serial_number` string, required — Certificate serial number
    - `subject` string, required — Certificate subject
    - `valid_from` string, required — Certificate validity start date
    - `valid_to` string, required — Certificate validity end date
  - `classification` Classification, required — Classification of the entity
    - `primary` string, required — Primary classification
    - `secondary` string[], required — Secondary classifications
  - `confidence` Confidence, required — Confidence score with level
    - `level` string, required — Confidence level
    - `score` integer, required — Confidence score from 0-100
  - `dataTrust` DataTrustProfile — Data Trust profile attached to check responses
    - `completeness` DataCompleteness, required — Data completeness across expected enrichment facets
      - `missing` string[], required
      - `present` string[], required
      - `score` integer, required
    - `dataAgeHours` number, double, nullable
    - `firstSeen` string, nullable
    - `freshness` string, required
    - `lastSeen` string, nullable
    - `lastUpdated` string, nullable
    - `observedAt` string, required
    - `providerAgreement` ProviderAgreement, required — Provider agreement summary from cross-correlation signals
      - `contradictorySignals` ProviderContradictorySignal[], required
        - `description` string, required
        - `severity` string, required
        - `title` string, required
        - `type` string, required
      - `status` string, required
      - `summary` string, required
    - `sourceAgreement` SourceAgreement, required — Source agreement summary across blocklists and scanners
      - `count` integer, required
      - `level` string, required
      - `scannerClean` integer, required
      - `scannerDetections` integer, required
      - `scannerSuspicious` integer, required
      - `weightedStrength` number, double, required
    - `sources` DataTrustSource[], required
      - `category` string, nullable
      - `name` string, required
      - `noiseProfile` 'authoritative' | 'contextual' | 'noisy', required — Operational noise profile for a source
      - `reliability` number, double, required
      - `reliabilityLevel` 'high' | 'medium' | 'low', required — Source reliability level used by Data Trust evidence
      - `type` string, required
      - `url` string, nullable
  - `enrichment_level` string, required — Enrichment level applied
  - `evidence` SocEvidence — SOC-ready verdict evidence attached to check responses
    - `analystStatus` string, required
    - `confidence` EvidenceConfidence — Confidence excerpt included in SOC evidence
      - `level` string, required
      - `score` integer, required
    - `contradictorySignals` ProviderContradictorySignal[], required
      - `description` string, required
      - `severity` string, required
      - `title` string, required
      - `type` string, required
    - `dataAgeHours` number, double, nullable
    - `freshness` string, required
    - `observedAt` string, required
    - `reasons` string[], required
    - `recommendedAction` string, required
    - `score` integer, nullable
    - `sourceSummary` EvidenceSourceSummary, required — Source summary included in SOC evidence
      - `count` integer, required
      - `highReliabilityCount` integer, required
      - `noiseWarnings` string[], required
      - `weightedStrength` number, double, required
    - `verdict` string, required
  - `geo` GeoData — Geographic location data
    - `city` string, required — City name
    - `country` string, required — Country name
    - `country_code` string, required — ISO country code
    - `isp` string, required — Internet Service Provider
    - `lat` number, double, nullable — Latitude
    - `lon` number, double, nullable — Longitude
    - `region` string, nullable — Region or state
  - `malicious` boolean, required — Whether the entity is considered malicious
  - `reputation` ReputationData, required — Reputation data from aggregated threat intelligence sources
    - `harmless` integer, required — Number of sources flagging as harmless
    - `malicious` integer, required — Number of sources flagging as malicious
    - `suspicious` integer, required — Number of sources flagging as suspicious
    - `undetected` integer, required — Number of sources with no detection
  - `risk_score` RiskScore, required — Risk score with level and contributing factors
    - `factors` string[], required — Factors contributing to the risk score
    - `level` string, required — Risk level category
    - `score` integer, required — Risk score from 0-100
  - `vulnerabilities` VulnerabilityData — Vulnerability data
    - `critical` integer, required — Critical severity count
    - `cves` Cve[], required — List of CVEs
      - `description` string, required — CVE description
      - `id` string, required — CVE identifier
      - `score` number, double, nullable — CVSS score
      - `severity` string, required — Severity level
    - `high` integer, required — High severity count
    - `low` integer, required — Low severity count
    - `medium` integer, required — Medium severity count
    - `total` integer, required — Total vulnerabilities found
  - `whois` WhoisData — WHOIS registration data
    - `created_date` string, nullable — Domain creation date
    - `expires_date` string, nullable — Domain expiration date
    - `name_servers` string[], required — Name servers
    - `registrant` string, nullable — Registrant name or organization
    - `registrar` string, nullable — Domain registrar
    - `updated_date` string, nullable — Last update date

## Other responses

- `400` — Bad request - Invalid parameters
- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ismalicious/ismalicious-threat-intelligence-api/revisions/c990a0940b7d/schema)