---
title: "Passive DNS and reputation for a domain or IP"
method: POST
path: "/v1/metered/ip-intel"
tags: ["Domain and infrastructure"]
---

# Passive DNS and reputation for a domain or IP

`POST /v1/metered/ip-intel`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/ip-intel`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Pass a domain for its historical IP resolutions, or an IP for reverse resolutions, AS owner and country. RelayShield's own IOC corpus is consulted first; a hit there is a stronger signal than a third-party vote count and short-circuits the external lookup.

**Billing.** $0.10 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** Responses are cached, so repeat lookups of the same value within the cache window are served from cache.

## Request body

- object: At least one of: `domain`, `ip`.
  - `domain` string: Domain to look up. A leading `www.` is stripped.
  - `ip` string: IP address to look up. Takes precedence when both are supplied.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `queried` string: The value that was looked up.
    - `query_type` 'domain' | 'ip': Which lookup ran.
    - `found` boolean: True when the value is known to any source.
    - `reputation` integer, nullable: Reputation score. null on a RelayShield-corpus hit or when not found.
    - `malicious_votes` integer, nullable: Engines flagging it malicious. On a corpus hit this is the corpus hit count.
    - `suspicious_votes` integer, nullable: Engines flagging it suspicious.
    - `source` string: Present and set to `relayshield_ioc_corpus` when the answer came from RelayShield's own corpus.
    - `resolutions` object[]: Up to 10 historical resolutions, newest first.
      - `date` string, nullable: When the resolution was observed.
      - `hostname` string: Present when query_type is `ip`.
      - `ip_address` string: Present when query_type is `domain`.
    - `as_owner` string: Autonomous system owner. Present only when query_type is `ip`.
    - `country` string: Two-letter country code. Present only when query_type is `ip`.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: Neither `domain` nor `ip` supplied.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `502`: Upstream reputation provider unavailable.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)