--- title: "Lookup a IP Address entity by id" method: GET path: "/ip/{id}" tags: ["IP"] --- # Lookup a IP Address entity by id `GET /ip/{id}` ## Request - Base URL: `https://api.recordedfuture.com/v2` - URL: `https://api.recordedfuture.com/v2/ip/{id}` - Auth: API key in header `X-RFToken` Get full IP enrichment including risk scoring, geolocation, DNS, open ports, and threat actor relationships. ## Path parameters - `id` string, required ## Query parameters - `fields` string - `metadata` unknown - `taggedText` boolean - `comment` string ## Response `200` Result of operation - IpLookupResponse: IP address enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested. - `data` object, required: IP address entity data with requested enrichment fields. - `entity` Entity: Recorded Future entity identification. - `id` string, required: Recorded Future entity ID. Format varies by type: ip:1.2.3.4, idn:example.com, hash:, url:https://..., or opaque alphanumeric IDs for vulnerabilities, malware, and companies. - `name` string, required: Human-readable entity name. - `type` 'IpAddress' | 'InternetDomainName' | 'Hash' | 'URL' | 'CyberVulnerability' | 'Malware' | 'Company', required: Entity type classification. - `description` string: Entity description (present for vulnerabilities and some other types). - `risk` RiskData: Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities. - `score` integer: Numeric risk score from 0 (no risk) to 99 (critical risk). - `criticality` integer: Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `riskString` string: Triggered vs total risk rules (e.g., '16/81'). - `rules` integer: Number of currently triggered risk rules. - `riskSummary` string: Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.'). - `evidenceDetails` EvidenceDetail[]: Evidence for each triggered risk rule. - `rule` string: Risk rule name that was triggered. - `criticality` integer: Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `evidenceString` string: Human-readable evidence summary with source references and sighting details. - `mitigationString` string: Recommended mitigation or remediation guidance for this risk rule. - `timestamp` string, date-time: ISO 8601 timestamp of when the evidence was observed. - `aiInsights` AiInsights: AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered. - `text` string, nullable: AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered. - `numberOfReferences` integer: Number of intelligence references used to generate the insight. - `comment` string, nullable: Explanatory comment (e.g., why insights are not available). - `links` LinksData: Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships. - `hits` object[]: Intelligence hits containing sectioned relationship data. - `start_date` string: Start date of the intelligence hit time window. - `stop_date` string: End date of the intelligence hit time window. - `total_count` integer: Total number of entity relationships in this hit. - `sample_reference_ids` string[]: Sample reference IDs supporting this hit. - `counts` object[]: Breakdown counts by entity type. - `count` integer: Number of entities. - `type` object: Entity type metadata. - `id` string - `name` string - `type` string - `event_count` integer: Number of events in this hit. - `sections` object[]: Relationship sections grouped by category. - `section_id` object: Section identifier. - `id` string: Section ID. - `name` string: Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules'). - `type` string: Section type (e.g., 'Category'). - `total_count` integer: Total entities in this section. - `lists` object[]: Entity lists within this section, grouped by entity type. - `entities` LinksEntity[] - … - `total_count` integer: Total entities in this list. - `type` object: Entity type metadata for this list. - … - `method_aggregates` object[]: Aggregated counts of linked entities by analysis method. - `count` integer: Number of links found by this method. - `type` string: Analysis method type. - `counts` object[]: Summary counts of linked entities by type. - `count` integer: Number of linked entities of this type. - `type` object: Entity type metadata. - `id` string - `name` string - `type` string - `description` string - `intelCard` string, uri: URL to the Recorded Future Intelligence Card for this IP. - `location` object: Geolocation and network ownership data for the IP address. Included when the fields parameter contains 'location'. - `organization` string: Hosting organization or ISP name. - `cidr` object: CIDR block containing this IP. - `id` string: CIDR entity ID. - `name` string: CIDR notation (e.g., '64.227.176.0/20'). - `type` string: Entity type. - `location` object: Geographic location. - `continent` string - `country` string - `city` string - `asn` union: Autonomous System Number. May be a simple string (e.g., 'AS14061') or an entity object with id/name/type. - string: ASN string (e.g., 'AS14061'). - object - `id` string: ASN entity ID (e.g., 'asn:AS14061'). - `name` string: ASN display name (e.g., 'AS14061'). - `type` string: Entity type. - `dnsPortCert` object: DNS records, open ports, and TLS certificates associated with the IP. Included when the fields parameter contains 'dnsPortCert'. - `certificates` object[]: TLS/SSL certificates observed on this IP. - `dns` object: DNS resolution data. - `forwardDns` object[]: Domains resolving to this IP. - `reverseDns` object[]: Reverse DNS (PTR) records for this IP. - `ports` object[]: Open ports observed on this IP. - `port` integer: Port number. - `protocol` string: Protocol (e.g., 'tcp', 'udp'). - `name` string: Service name (e.g., 'ssh', 'http'). - `product` string: Software product name. - `version` string: Software version. - `extraInfo` string: Additional service information. - `scanner` object: Scanning behavior analysis for the IP. Included when the fields parameter contains 'scanner'. - `verdict` string: Scanning verdict (e.g., 'scanner', 'not_scanner'). - `lastSeen` string, date-time: Last observed scanning activity. - `scannerCountry` string: Country of origin for scanning activity. - `scannedIpCountries` string[]: Countries of IPs targeted by this scanner. - `globalScanner` boolean: Whether this IP is classified as a global scanner. - `tags` object: Scanner classification tags. - `entity` object[]: Entity-level tags. - `rdns` string[]: Reverse DNS hostnames for this IP. - `webRequests` object[]: Observed web requests made by this scanner. - `userAgents` string[]: User agent strings observed from this scanner. - `ports` object: Ports scanned by this IP, grouped by protocol. - `tcp` integer[]: TCP ports scanned. - `udp` integer[]: UDP ports scanned. - `riskyCIDRIPs` object[]: Other risky IPs in the same CIDR block. Included when the fields parameter contains 'riskyCIDRIPs'. - `score` integer: Risk score of the related IP. - `ip` object - `id` string: IP entity ID. - `name` string: IP address string. - `type` string: Entity type (e.g., 'IpAddress'). - `timestamps` Timestamps: First and last seen timestamps for the entity in Recorded Future data. - `firstSeen` string, date-time: ISO 8601 timestamp of first observation. - `lastSeen` string, date-time: ISO 8601 timestamp of most recent observation. - `sightings` Sighting[]: Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'. - `source` string: Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum'). - `url` string, uri: URL to the original source. - `published` string, date-time: ISO 8601 timestamp of when the sighting was published. - `fragment` string: Text fragment from the source mentioning the entity. - `title` string: Title of the source document. - `type` 'recentDarkWeb' | 'recentPaste' | 'recentInfoSec' | 'recentSocialMedia' | 'mostRecent' | 'first': Sighting category. - `threatLists` ThreatList[]: Curated threat list memberships. - `id` string: Threat list entity ID. - `name` string: Threat list name. - `type` string: Entity type (e.g., 'EntityList'). - `description` string: Description of the threat list and its purpose. - `riskMapping` RiskMapping[]: Risk rule to MITRE ATT&CK mapping. - `rule` string: Risk rule name. - `categories` object[]: Framework categories this rule maps to. - `framework` string: Framework name (e.g., 'MITRE ATT&CK'). - `name` string: Category or technique name. - `analystNotes` object[]: Insikt Group analyst notes. Can be very large (67KB+). - `relatedEntities` object[]: Co-occurrence relationships (not editorially validated). Can be 19-29KB. - `counts` object[]: Daily reference count time-series. - `metrics` object[]: Flat metric counters. - `metadata` object: Request metadata. Included when the metadata query parameter is set to true. --- [API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)