---
title: "Full Threat Analysis"
method: GET
path: "/check"
tags: ["check"]
---

# Full Threat Analysis

`GET /check`

Comprehensive threat intelligence check for IPs, domains, URLs, and file
hashes.

**Enrichment Levels:**
- `basic` - Malicious status, reputation counters, sources, blocklist
  counters, plus whatever the dataset holds (geo, whois, certificates,
  vulnerabilities, dns, …). No risk score.
- `standard` (default) - Basic + risk score, classification, confidence,
  MITRE mapping, cross-correlation, ASN reputation, OTX context
- `full` - Standard + detection timeline and related infrastructure

With no target parameter at all, answers a minimal 200 body
(`malicious: false` + `dataTrust`/`evidence`) instead of an error.

## Query parameters

- `query` string
- `ip` string
- `domain` string
- `hash` string
- `enrichment` string

## Response `200`

Threat analysis response. Field availability depends on the entity type, the enrichment level, and the dataset — see the schema description.

- CheckResponse — Main threat analysis response (`domain/check_pipeline.rs::assemble_check_json` and, for hashes, `api/check_core.rs::check_hash_json`). Only `malicious`, `apiVersion`, `enrichmentLevel`, `dataTrust`, `evidence` and the three document stamps (`firstSeen`, `lastSeen`, `lastUpdated` — nullable) are present on every entity response. Everything else depends on the query (with no target at all, a minimal body is returned), the entity type (hash responses carry `hashInfo`/`knownGood`, never `geo`/`whois`), the enrichment level (`riskScore`, `confidence`, `classification` and the cross-correlation block need `standard`+; `timeline` and `relatedInfrastructure` need `full`) and on what the dataset holds for the entity. `geo`, `whois`, `certificates`, `vulnerabilities` and `dns` are **raw upstream payloads** cached as-is — their shape follows the source (ip-api, WHOIS, crt.sh, Shodan InternetDB, DoH), not a schema this API controls. Feed-ingested hash documents additionally pass their raw fields through at the top level (e.g. `malwareFamily`, `firstSeen`, `categories`).
  - `apiVersion` string, required — API version
  - `asnReputation` object, nullable — ASN-level reputation (`standard`/`full`, when resolvable)
  - `azureTenant` object, nullable — Azure tenant details (cached enrichment)
  - `blocklistHits` integer, nullable — Number of blocklist sources listing the entity
  - `blocklistListed` boolean, nullable — Whether the entity appears on at least one enabled blocklist
  - `certificates` object, nullable — Raw certificate-transparency rows (shape follows crt.sh)
  - `classification` Classification — Classification of the entity (`enrichment/threat_classifier.rs::ThreatClassification`).
    - `confidence` integer, required — Classification confidence (0-100)
    - `indicators` ThreatIndicator[], required — Indicators behind the classification
      - `category` string, required — Threat category this indicator points to
      - `description` string, required — Human-readable explanation
      - `type` string, required — Indicator type
      - `weight` number, double, required — Weight of this indicator
    - `primary` string, required — Primary classification
    - `secondary` string[], required — Secondary classifications
  - `confidence` Confidence — Confidence score with level and factors (`enrichment/confidence.rs::ConfidenceScore`).
    - `explanation` string, required — One-line explanation of the confidence
    - `factors` ConfidenceFactor[], required — Factors contributing to the confidence score
      - `contribution` number, double, required — Weighted contribution to the final score
      - `description` string, required — Human-readable explanation
      - `name` string, required — Factor name
      - `score` number, double, required — Raw factor score
      - `weight` number, double, required — Weight of this factor in the composite score
    - `level` string, required — Confidence level: `low` | `medium` | `high`
    - `score` integer, required — Confidence score from 0-100
  - `confidenceScore` number, double, nullable — Hash queries only: ingestion confidence from the feed document (0-100)
  - `crossCorrelation` object, nullable — Cross-correlation signals across data facets (`standard`/`full`)
  - `dataTrust` DataTrustProfile, required — Data Trust profile attached to check responses
    - `completeness` DataCompleteness, required — Data completeness across expected enrichment facets
      - `missing` string[], required
      - `present` string[], required
      - `score` integer, required
    - `dataAgeHours` number, double, nullable
    - `firstSeen` string, nullable
    - `freshness` string, required
    - `lastSeen` string, nullable
    - `lastUpdated` string, nullable
    - `observedAt` string, required
    - `providerAgreement` ProviderAgreement, required — Provider agreement summary from cross-correlation signals
      - `contradictorySignals` ProviderContradictorySignal[], required
        - `description` string, required
        - `severity` string, required
        - `title` string, required
        - `type` string, required
      - `status` string, required
      - `summary` string, required
    - `sourceAgreement` SourceAgreement, required — Source agreement summary across blocklists and scanners
      - `count` integer, required
      - `level` string, required
      - `scannerClean` integer, required
      - `scannerDetections` integer, required
      - `scannerSuspicious` integer, required
      - `weightedStrength` number, double, required
    - `sources` DataTrustSource[], required
      - `category` string, nullable
      - `name` string, required
      - `noiseProfile` 'authoritative' | 'contextual' | 'noisy', required — Operational noise profile for a source
      - `reliability` number, double, required
      - `reliabilityLevel` 'high' | 'medium' | 'low', required — Source reliability level used by Data Trust evidence
      - `type` string, required
      - `url` string, nullable
  - `delisted` boolean, nullable — Present and `true` when the entity was delisted after review
  - `dns` object, nullable — Raw DNS snapshot (records, SPF/DMARC flags)
  - `enrichmentLevel` string, required — Enrichment level applied: `basic` | `standard` | `full`
  - `evidence` SocEvidence, required — SOC-ready verdict evidence attached to check responses
    - `analystStatus` string, required
    - `confidence` EvidenceConfidence — Confidence excerpt included in SOC evidence
      - `level` string, required
      - `score` integer, required
    - `contradictorySignals` ProviderContradictorySignal[], required
      - `description` string, required
      - `severity` string, required
      - `title` string, required
      - `type` string, required
    - `dataAgeHours` number, double, nullable
    - `freshness` string, required
    - `observedAt` string, required
    - `reasons` string[], required
    - `recommendedAction` string, required
    - `score` integer, nullable
    - `sourceSummary` EvidenceSourceSummary, required — Source summary included in SOC evidence
      - `count` integer, required
      - `highReliabilityCount` integer, required
      - `noiseWarnings` string[], required
      - `weightedStrength` number, double, required
    - `verdict` string, required
  - `firstSeen` string, nullable — When the entity entered the dataset, or the feed's earliest observation of it — RFC 3339 UTC (`2026-08-25T14:17:40Z`). Present at every enrichment level; `null` when the stored document carries no stamp (an entity no feed has ever listed)
  - `geo` object, nullable — Raw geolocation payload (shape follows ip-api)
  - `hashInfo` HashInfo — Identity of the hash that was looked up (hash queries only). Feed-ingested hash documents pass extra file metadata through alongside these fields (file names, sizes, signatures — shape follows the source feed), so treat this object as open.
    - `hash` string, required — The hash as queried
    - `hashType` string, required — `md5` | `sha1` | `sha256` | `unknown`
    - `nsrl` boolean, nullable — Present and `true` when the hash is in the NSRL known-software corpus
  - `infrastructure` InfrastructureAttribution — What the entity IS, according to the listings that describe rather than accuse it. Present on a response only when at least one such listing exists on the document.
    - `attributes` string[], required — Distinct, sorted attributes drawn from the vocabulary: `tor-exit`, `vpn`, `proxy`, `doh-resolver`, `dns-resolver`, `sinkhole`, `cloud`, `cdn`, `crawler`, `scanner`, `monitoring`, `disposable-email`, `dynamic-dns`, `url-shortener`, `bogon`, `saas`, `allowlist`
    - `sources` InfrastructureSource[], required — The non-threat listings the attributes were derived from
      - `category` string, nullable — The listing's primary category, as ingested
      - `id` string, nullable — Registry id of the feed (absent on legacy listings written before ids)
      - `name` string, required — Feed name as stored on the listing
      - `threatClass` string, required — `infrastructure` | `policy` | `allowlist` — never `threat` here
  - `intelOwl` object, nullable — IntelOwl analyzer output (cached enrichment)
  - `knownGood` boolean, nullable — Hash queries only: present and `true` when the hash is NSRL-listed known software
  - `lastSeen` string, nullable — Latest re-observation of the entity by a feed — RFC 3339 UTC. Present at every enrichment level; `null` when unknown
  - `lastUpdated` string, nullable — Last full refresh of the stored document at ingest — RFC 3339 UTC. Present at every enrichment level; `null` when unknown
  - `lookupStatus` string, nullable — Hash queries only: `known` when a reputation source or NSRL match is available, otherwise `unknown`. Unknown hashes require review and are not positive evidence that the file is safe.
  - `malicious` boolean, required — Explicit or scanner-derived malicious detection for IPs/domains; hashes also include malware-feed matches. `false` is not a safety verdict. Consult `riskScore`, `evidence` and blocklist fields for the overall assessment, and `lookupStatus` for unknown hashes.
  - `microsoftTenant` boolean, nullable — Whether the domain maps to a Microsoft/Azure tenant
  - `mitre` object, nullable — MITRE ATT&CK mapping for the classified categories (`standard`/`full`)
  - `otx` object, nullable — AlienVault OTX pulse context (`standard`/`full`)
  - `processingTime` integer, nullable — Server-side processing time in milliseconds (absent on the minimal no-target response)
  - `ransomware` object, nullable — Ransomware-group context, when the entity appears in ransomware feeds
  - `relatedInfrastructure` object, nullable — Related infrastructure (`full` enrichment only)
  - `reputation` object, nullable — Aggregated detection counters (typically `malicious` / `suspicious` / `harmless` / `undetected`, sometimes `timeout`). May be `null` for unknown entities.
  - `riskScore` RiskScore — Risk score with level and contributing factors (`enrichment/risk_scorer.rs::RiskScore`).
    - `factors` RiskFactor[], required — Factors contributing to the risk score
      - `contribution` number, double, required — Weighted contribution to the final score
      - `description` string, required — Human-readable explanation
      - `name` string, required — Factor name
      - `score` number, double, required — Raw factor score (0-100, higher = riskier)
      - `weight` number, double, required — Weight of this factor in the composite score
    - `level` string, required — Risk level: `safe` | `low` | `medium` | `high` | `critical`
    - `score` integer, required — Risk score from 0-100 (higher = riskier)
    - `summary` string, required — One-line summary of the verdict
  - `similar_domains` object, nullable — Similar registered domains (typosquatting candidates)
  - `sources` object[], nullable — Raw source rows from the feed corpus (name, url, category, … as ingested). Each row may carry `threatClass` (`threat` when absent, `infrastructure`, `policy`, `allowlist`) and `fpRisk` (`low` when absent, `medium`, `high`) copied from the feed registry
  - `techStack` object, nullable — Detected technology stack (cached enrichment)
  - `timeline` object, nullable — Detection timeline (`full` enrichment only)
  - `vulnerabilities` object, nullable — Raw open-port / CVE payload (shape follows Shodan InternetDB: `cpes` / `hostnames` / `ip` / `ports` / `tags` / `vulns`)
  - `whois` object, nullable — Raw WHOIS payload (shape follows the WHOIS provider)

## Other responses

- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-09-22** `58a5aec0e63b` — 3 info
  - added the optional property `firstSeen` to the response with the `200` status
  - added the optional property `lastSeen` to the response with the `200` status
  - added the optional property `lastUpdated` to the response with the `200` status
- **2026-09-20** `eb1bf7b5e785` — 1 info
  - added the optional property `lookupStatus` to the response with the `200` status
- **2026-09-19** `1bc3c7aeff82` — 1 info
  - added the optional property `infrastructure` to the response with the `200` status
- **2026-08-31** `9d9ef31d83e5` — 33 breaking, 2 warning, 59 info
  - the response property `certificates` became nullable for the status `200`
  - the response property `geo` became nullable for the status `200`
  - the response property `message` became nullable for the status `401`
  - the response property `message` became nullable for the status `429`
  - …90 more
- **2026-08-30** `aa5294fdc8d8` — 1 warning
  - deleted the `path` request parameter `track_reports`

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/check/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)