Bulk Check Mass threat intelligence lookups
Check batches of domains, IPs, or URLs in one API call (up to 100 on Pro, 500 on Enterprise). Each item returns full threat context subject to your plan limits.
No credit card required · Free API key
Threat Intelligence at Scale
The database powering every bulk check request.
Current data sample
29 075 995
Total threats
19 749 030
Malicious domains
9 326 965
Malicious IPs
591
Sources in the corpus
No credit card required · Free: a 10% sample of each list · full lists on paid plans
100
Max items/request (Pro)
10K/mo
Pro monthly quota
60/min
Pro API burst
Mixed
Input types
Key features.
Available signals and integration options.
Plan-based batches
Small evaluation batches on Free and up to 100 entities per request on Pro, within monthly quotas.
Multiple Formats
Accept JSON, CSV, or newline-delimited text input.
Mixed Types
Check domains, IPs, and URLs in the same request.
Full Results
Get complete threat data for each item, not just verdicts.
Chunk large jobs
Split very large indicator lists across multiple requests while respecting burst and monthly limits.
Export Options
Download results as JSON, CSV, or STIX format.
Use cases.
Workflows to evaluate with your existing tools.
Log Enrichment
Enrich SIEM logs with threat data in bulk.
List Validation
Validate blocklists and allowlists against threat intel.
Incident Response
Quickly check IOCs during incident investigations.
Email Gateway
Check sender domains and URLs from email batches.
Why Bulk Threat Checking?
Security operations generate massive volumes of indicators that require threat analysis: firewall logs contain thousands of external IPs daily, email gateways process millions of URLs, SIEMs aggregate indicators from dozens of sources, and incident response investigations can involve hundreds of IOCs. Checking these one at a time is impractical. The bulk API lets you process many domains, IPs, and URLs per call (small evaluation batches on Free, up to 100 on Pro and 500 on Enterprise), so you can automate enrichment in chunks that fit your plan limits.
Use Cases for Bulk Threat Intelligence
Security teams use bulk checking across numerous workflows: enrich SIEM alerts with threat context for thousands of indicators simultaneously, validate and prioritize blocklists before deployment, analyze log files to identify compromised hosts communicating with malicious infrastructure, screen vendor and partner domains for supply chain risk assessment, and process IOC feeds from ISAC sharing groups. Any scenario involving more than a handful of indicators benefits from bulk API efficiency.
API Integration Best Practices
Maximize bulk API effectiveness with these practices: batch indicators logically by time window or source for easier result correlation, implement async processing for very large batches to avoid timeout issues, cache results to reduce duplicate lookups for frequently-seen indicators, use mixed-type requests to check domains, IPs, and URLs together when investigating related infrastructure, and export results in STIX format for direct integration with threat intelligence platforms.
Performance and Scalability
Our bulk API handles mixed indicator types with automatic detection and routing, supports JSON bodies with arrays of entities, returns rich threat context for each item, and is designed to be called repeatedly within your plan burst and monthly quotas. For volumes beyond a single batch, run parallel or sequential requests and cache results to stay within limits.
Frequently asked questions.
How many items can I check at once?
What formats do you accept?
How fast is bulk processing?
Can I mix domains and IPs in one request?
Related articles.
Learn more from our security research blog.
Ready to get started?
Test the available signals in your workflow. Review the sources and limits before integrating.
No credit card required · Free API key