check

Full Threat Analysis

Comprehensive threat intelligence check for IPs, domains, URLs, and file hashes.

Enrichment Levels:

basic - Malicious status, reputation counters, sources, blocklist counters, plus whatever the dataset holds (geo, whois, certificates, vulnerabilities, dns, …). No risk score.
standard (default) - Basic + risk score, classification, confidence, MITRE mapping, cross-correlation, ASN reputation, OTX context
full - Standard + detection timeline and related infrastructure

With no target parameter at all, answers a minimal 200 body (malicious: false + dataTrust/evidence) instead of an error.

get/check

Query parameters

querystring

IP address, domain, URL or file hash to check. Supply this or one of the ip / domain / hash aliases.

ipstring

Alias for query restricted in intent to IP addresses

domainstring

Alias for query restricted in intent to domains

hashstring

Alias for query restricted in intent to file hashes (MD5/SHA1/SHA256)

enrichmentstring

Enrichment level: basic, standard, or full

Response

Threat analysis response. Field availability depends on the entity type, the enrichment level, and the dataset — see the schema description.

apiVersionstring required

API version

asnReputationobject nullable

ASN-level reputation (standard/full, when resolvable)

azureTenantobject nullable

Azure tenant details (cached enrichment)

blocklistHitsinteger nullable

Number of blocklist sources listing the entity

blocklistListedboolean nullable

Whether the entity appears on at least one enabled blocklist

certificatesobject nullable

Raw certificate-transparency rows (shape follows crt.sh)

confidenceScorenumber double nullable

Hash queries only: ingestion confidence from the feed document (0-100)

crossCorrelationobject nullable

Cross-correlation signals across data facets (standard/full)

delistedboolean nullable

Present and true when the entity was delisted after review

dnsobject nullable

Raw DNS snapshot (records, SPF/DMARC flags)

enrichmentLevelstring required

Enrichment level applied: basic | standard | full

firstSeenstring nullable

When the entity entered the dataset, or the feed's earliest observation of it — RFC 3339 UTC (2026-08-25T14:17:40Z). Present at every enrichment level; null when the stored document carries no stamp (an entity no feed has ever listed)

geoobject nullable

Raw geolocation payload (shape follows ip-api)

intelOwlobject nullable

IntelOwl analyzer output (cached enrichment)

knownGoodboolean nullable

Hash queries only: present and true when the hash is NSRL-listed known software

lastSeenstring nullable

Latest re-observation of the entity by a feed — RFC 3339 UTC. Present at every enrichment level; null when unknown

lastUpdatedstring nullable

Last full refresh of the stored document at ingest — RFC 3339 UTC. Present at every enrichment level; null when unknown

lookupStatusstring nullable

Hash queries only: known when a reputation source or NSRL match is available, otherwise unknown. Unknown hashes require review and are not positive evidence that the file is safe.

maliciousboolean required

Explicit or scanner-derived malicious detection for IPs/domains; hashes also include malware-feed matches. false is not a safety verdict. Consult riskScore, evidence and blocklist fields for the overall assessment, and lookupStatus for unknown hashes.

microsoftTenantboolean nullable

Whether the domain maps to a Microsoft/Azure tenant

mitreobject nullable

MITRE ATT&CK mapping for the classified categories (standard/full)

otxobject nullable

AlienVault OTX pulse context (standard/full)

processingTimeinteger nullable

Server-side processing time in milliseconds (absent on the minimal no-target response)

ransomwareobject nullable

Ransomware-group context, when the entity appears in ransomware feeds

relatedInfrastructureobject nullable

Related infrastructure (full enrichment only)

reputationobject nullable

Aggregated detection counters (typically malicious / suspicious / harmless / undetected, sometimes timeout). May be null for unknown entities.

similar_domainsobject nullable

Lookalikes of the domain that the corpus lists — typosquats, homoglyphs, the name on other TLDs or wrapped in phishing words — best first: { keywords, hits, total_hits, truncated, matches: [{ domain, fuzzer, threatLevel }] }. hits holds the same names as matches.

sourcesobject[] nullable

Raw source rows from the feed corpus (name, url, category, … as ingested). Each row may carry threatClass (threat when absent, infrastructure, policy, allowlist) and fpRisk (low when absent, medium, high) copied from the feed registry

techStackobject nullable

Detected technology stack (cached enrichment)

timelineobject nullable

Detection timeline (full enrichment only)

vulnerabilitiesobject nullable

Raw open-port / CVE payload (shape follows Shodan InternetDB: cpes / hostnames / ip / ports / tags / vulns)

whoisobject nullable

Raw WHOIS payload (shape follows the WHOIS provider)

Example response

{
  "apiVersion": "v2",
  "classification": {
    "indicators": [
      {
        "category": "phishing",
        "type": "source_category"
      }
    ],
    "primary": "safe"
  },
  "confidence": {
    "factors": [
      {
        "name": "source_agreement"
      }
    ],
    "level": "high"
  },
  "enrichmentLevel": "standard",
  "firstSeen": "2026-08-25T14:17:40Z",
  "hashInfo": {
    "hash": "44d88612fea8a8f36de82e1278abb02f",
    "hashType": "md5"
  },
  "infrastructure": {
    "attributes": [
      "cloud",
      "saas"
    ],
    "sources": [
      {
        "category": "infrastructure",
        "id": "azure-ip-ranges",
        "name": "Azure - Published IP Ranges",
        "threatClass": "infrastructure"
      }
    ]
  },
  "lastSeen": "2026-09-20T06:00:00Z",
  "lastUpdated": "2026-09-01T00:00:00Z",
  "lookupStatus": "unknown",
  "riskScore": {
    "factors": [
      {
        "name": "domain_age"
      }
    ],
    "level": "safe"
  }
}

Changes

Changed in 5 of the 14 revisions of this API.33364

Sep 22, 202658a5aec0e63b3See the full diff
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
Sep 20, 2026eb1bf7b5e7851See the full diff
- ○
  added the optional property to the response with the status
  response-optional-property-added
Sep 19, 20261bc3c7aeff821See the full diff
- ○
  added the optional property to the response with the status
  response-optional-property-added
Aug 31, 20269d9ef31d83e533259See the full diff
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  added subschema #1 to the response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 to the response property oneOf list for the response status
  response-property-one-of-added
- ▲
  the response's property type changed from no type to object null for status
  response-property-type-changed
- ▲
  the response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the response's property type changed from no type to object for status
  response-property-type-changed
- ▲
  the response's property type changed from no type to object for status
  response-property-type-changed
- ▲
  the response's property type changed from no type to object null for status
  response-property-type-changed
- ▲
  the response's property type changed from no type to object null for status
  response-property-type-changed
- ▲
  the response's property type changed from no type to object null for status
  response-property-type-changed
- ▲
  removed the required property from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property / from the response with the status
  response-required-property-removed
- ▲
  removed the required property from the response with the status
  response-required-property-removed
- ●
  deleted the path request parameter enrichment
  request-parameter-removed
- ●
  deleted the path request parameter query
  request-parameter-removed
- ○
  added the new optional query request parameter domain
  new-optional-request-parameter
- ○
  added the new optional query request parameter enrichment
  new-optional-request-parameter
- ○
  added the new optional query request parameter hash
  new-optional-request-parameter
- ○
  added the new optional query request parameter ip
  new-optional-request-parameter
- ○
  added the new optional query request parameter query
  new-optional-request-parameter
- ○
  removed the non-success response with the status
  response-non-success-status-removed
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property / to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  the response property became required for the status
  response-property-became-required
- ○
  the response property became required for the status
  response-property-became-required
- ○
  removed subschema #1 from the response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 from the response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 from the response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 from the response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 from the response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 from the response property oneOf list for the response status
  response-property-one-of-removed
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
- ○
  added the required property / to the response with the status
  response-required-property-added
This revision also has 17 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Aug 30, 2026aa5294fdc8d81See the full diff
- ●
  deleted the path request parameter track_reports
  request-parameter-removed

Full history