Sign in
check

Full Threat Analysis

Comprehensive threat intelligence check for IPs, domains, URLs, and file hashes.

Enrichment Levels:

  • basic - Malicious status, reputation counters, sources, blocklist counters, plus whatever the dataset holds (geo, whois, certificates, vulnerabilities, dns, …). No risk score.
  • standard (default) - Basic + risk score, classification, confidence, MITRE mapping, cross-correlation, ASN reputation, OTX context
  • full - Standard + detection timeline and related infrastructure

With no target parameter at all, answers a minimal 200 body (malicious: false + dataTrust/evidence) instead of an error.

get/check

Query parameters

querystring

IP address, domain, URL or file hash to check. Supply this or one of the ip / domain / hash aliases.

ipstring

Alias for query restricted in intent to IP addresses

domainstring

Alias for query restricted in intent to domains

hashstring

Alias for query restricted in intent to file hashes (MD5/SHA1/SHA256)

enrichmentstring

Enrichment level: basic, standard, or full

Response

Threat analysis response. Field availability depends on the entity type, the enrichment level, and the dataset — see the schema description.

apiVersionstring required

API version

asnReputationobject nullable

ASN-level reputation (standard/full, when resolvable)

azureTenantobject nullable

Azure tenant details (cached enrichment)

blocklistHitsinteger nullable

Number of blocklist sources listing the entity

blocklistListedboolean nullable

Whether the entity appears on at least one enabled blocklist

certificatesobject nullable

Raw certificate-transparency rows (shape follows crt.sh)

confidenceScorenumber double nullable

Hash queries only: ingestion confidence from the feed document (0-100)

crossCorrelationobject nullable

Cross-correlation signals across data facets (standard/full)

delistedboolean nullable

Present and true when the entity was delisted after review

dnsobject nullable

Raw DNS snapshot (records, SPF/DMARC flags)

enrichmentLevelstring required

Enrichment level applied: basic | standard | full

geoobject nullable

Raw geolocation payload (shape follows ip-api)

intelOwlobject nullable

IntelOwl analyzer output (cached enrichment)

knownGoodboolean nullable

Hash queries only: present and true when the hash is NSRL-listed known software

maliciousboolean required

Whether the entity is considered malicious

microsoftTenantboolean nullable

Whether the domain maps to a Microsoft/Azure tenant

mitreobject nullable

MITRE ATT&CK mapping for the classified categories (standard/full)

otxobject nullable

AlienVault OTX pulse context (standard/full)

processingTimeinteger nullable

Server-side processing time in milliseconds (absent on the minimal no-target response)

ransomwareobject nullable

Ransomware-group context, when the entity appears in ransomware feeds

relatedInfrastructureobject nullable

Related infrastructure (full enrichment only)

reputationobject nullable

Aggregated detection counters (typically malicious / suspicious / harmless / undetected, sometimes timeout). May be null for unknown entities.

similar_domainsobject nullable

Similar registered domains (typosquatting candidates)

sourcesobject[] nullable

Raw source rows from the feed corpus (name, url, category, … as ingested)

techStackobject nullable

Detected technology stack (cached enrichment)

timelineobject nullable

Detection timeline (full enrichment only)

vulnerabilitiesobject nullable

Raw open-port / CVE payload (shape follows Shodan InternetDB: cpes / hostnames / ip / ports / tags / vulns)

whoisobject nullable

Raw WHOIS payload (shape follows the WHOIS provider)

Example response

{
  "apiVersion": "v2",
  "classification": {
    "indicators": [
      {
        "category": "phishing",
        "type": "source_category"
      }
    ],
    "primary": "safe"
  },
  "confidence": {
    "factors": [
      {
        "name": "source_agreement"
      }
    ],
    "level": "high"
  },
  "enrichmentLevel": "standard",
  "hashInfo": {
    "hash": "44d88612fea8a8f36de82e1278abb02f",
    "hashType": "md5"
  },
  "riskScore": {
    "factors": [
      {
        "name": "domain_age"
      }
    ],
    "level": "safe"
  }
}

Changes