Real-Time Threat Intelligence
Look up domains, IPs, URLs, and file hashes across configured intelligence sources. Review risk, history, and source evidence.
Real data, real depth. Source-attributed, dated, weighted.
Every lookup returns risk scoring, source breakdown, geolocation, MITRE mapping, and confidence metrics.
live sampleGET /api/v1/check/185.220.101.1
185.220.101.1
Geolocation
Categories
Blocklist hits
0feeds
Confidence
75 %
Risk factors
MITRE ATT&CK tactics
TA0042 Resource Development
TA0011 Command & Control
TA0009 Collection
Data trust
What's in every response.
Risk score
Composite 0-100 score weighted across threat feeds, scanner consensus, infrastructure, and behavioral context.
Source coverage
configured intelligence sources aggregated by category: malware, phishing, abuse, proxy, and more — each with reliability weighting.
MITRE ATT&CK
Tactics, techniques, related threat actor groups, and recommended mitigations from the MITRE framework.
Geolocation
Country, region, city, ISP, ASN, and autonomous system ownership at global scale with lat/lon precision.
Detection timeline
First seen, last seen, and full detection history across all monitoring windows and source updates.
Confidence breakdown
Multi-factor confidence: source agreement, source quality, scanner consensus, and inter-provider alignment.
Intelligence Tools
Comprehensive threat analysis for every attack surface
Ready to Protect Your Organization?
Start with 30 free API requests per month. No credit card required.
Guides and research
Firewall Blocklist Automation: Pulling IP and Domain Feeds Without OutagesExternal dynamic lists can block malware and phishing at the edge — or break payroll, CDN traffic, and vendor portals. This guide covers staged rollout, allowlists, fail-open vs fail-closed, and measuring hit rates for IP and domain blocklists.
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM PipelinesHow to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.
How to Use an NRD Feed to Catch Phishing Before It Lands in the InboxNewly registered domains are where most phishing campaigns start. This guide walks through NRD feed workflows for brand monitoring, mail gateway hygiene, and SOC triage — without treating domain age as a blunt block rule.