Key is an IP, value is a JSON Object. All fields for each item are shown below:
threat_level: String.
malicious: Only when we capture some specific activities related to "C2, Sinkhole C2, MiningPool, CoinMiner, Malware", we will consider it malicious in the compromise detection scenario.
safe: This determination is made only from the perspective of compromise detection and does not mean that there are no other malicious intelligence or activities associated with the IP or domain name beyond compromise.
confidence_level: String. There are three levels.
high
midium
low
judgments: Array. Intelligence type.
There are 5 malicious types considered as indicators of compromise(IOC) in this API shown as below, other malicious types in the complete Intelligence Types sheets will not be returned.
C2
Sinkhole C2
MiningPool
CoinMiner
Malware
Besides, neutral intelligence type will be returned, such as CDN, IDC, DNS, etc.
whitelist: Boolean.
true: It is whitelisted.
false: It is not whitelisted.
APT: Boolean
true: It is an APT.
false: There is not enough evidence to identify whether it is an APT.
threat_actor: Array.
family: Array. Virus or Trojan family.
tag_categories: Array. Fields for each item are shown bellow.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"ThreatBook CTI Documentation","colors":{"primary":"#CC0000","light":"#eb2d17","dark":"#15803D"},"logo":{"light":"https://mintcdn.com/secai-a5d02ac5/R6uyh1S1hrTJxXQ_/logo/logo_light.svg?fit=max\u0026auto=format\u0026n=R6uyh1S1hrTJxXQ_\u0026q=85\u0026s=c467c47ec081583290c17e11c5d34135","dark":"https://mintcdn.com/secai-a5d02ac5/R6uyh1S1hrTJxXQ_/logo/logo_dark.svg?fit=max\u0026auto=format\u0026n=R6uyh1S1hrTJxXQ_\u0026q=85\u0026s=ee156437cceb28ed4624144adaa33d04","href":"https://docs.threatbook.io/"},"favicon":"https://mintcdn.com/secai-a5d02ac5/zTkhlyUlQIO0Fe8R/favicon.ico?fit=max\u0026auto=format\u0026n=zTkhlyUlQIO0Fe8R\u0026q=85\u0026s=72ad6b570c62b69bbf882e317b3f8b86","api":{"params":{"expanded":"all"},"playground":{"display":"interactive","proxy":false}},"navbar":{"links":[{"href":"https://i.threatbook.io/research","label":"Try Investigator"},{"href":"https://ati.threatbook.io/","label":"Login to ATI"}],"primary":{"type":"button","label":"Contact us","href":"https://i.threatbook.io/contactus"}},"footer":{"socials":{"x":"https://x.com/ThreatBookLabs","linkedin":"https://www.linkedin.com/company/threatbook"}},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"secai-a5d02ac5","hasAudioNarration":false,"actualSubdomain":"secai-a5d02ac5","customDomains":["docs.threatbook.io"],"gitSource":{"type":"github","owner":"qilei-booker","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ac9d31150d8f4d6aeeb03ad","collectionId":"35312225-3107-4208-9227-53b5e6ca59b7","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ac9d31150d8f4d6aeeb03ad"},"entitlements":{},"buildId":"6ac9d31150d8f4d6aeeb03ad","clientVersion":"0.0.3964","searchFilterCounts":[{"language":"default","tag":"API Reference","count":21},{"language":"default","tag":"Guides","count":12},{"language":"default","tag":"Enrichment","count":9},{"language":"default","tag":"Feeds","count":6},{"language":"default","tag":"Deprecated","count":3},{"language":"default","tag":"Reports","count":3},{"language":"default","tag":"Quick Start","count":3},{"language":"default","tag":"Use Cases","count":3},{"language":"default","tag":"Our CTI Data","count":3},{"language":"default","tag":"Knowledge Hub","count":2}]},"assistantConfig":{},"hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"isAtlas":false,"googleFontsInlined":false},"customCss":[{"filePath":"style.css","content":".threatBook-download-btn{color:#fff;background-color:#1a1a1a;border-radius:40px;cursor:pointer;display:inline-flex;padding:8px 20px;justify-content:center;align-items:center;gap:8px;font-size:12px;font-weight:500;line-height:16px}.threatBook-download-btn:hover{background-color:#4d4d4d}.threatBook-download-btn svg{width:14px;height:14px;fill:#fff}a[href=\"https://threatbook.ai/contactus\"]{display:none}#topbar-cta-button{--primary-light:26 26 26;--primary-dark:26 26 26}table th{text-align:left}"}],"page":{"pagePath":"api-reference/enrichment/compromise-detection-v1","slug":"/api-reference/enrichment/compromise-detection-v1","pageMetadata":{"title":"Compromise Detection","openapi":"api-reference/enrichment/compromise-detection-v1.openapi.json POST /v1/ioc/query","description":"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.","href":"/api-reference/enrichment/compromise-detection-v1"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Compromise Detection","openapi":"api-reference/enrichment/compromise-detection-v1.openapi.json POST /v1/ioc/query","description":"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.","href":"/api-reference/enrichment/compromise-detection-v1"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/secai-a5d02ac5/5dcccf5574296389/custom.js"],"openApiReferenceData":{"operation":{"summary":"Compromise Detection (V1)","deprecated":false,"description":"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.","tags":[],"parameters":["fdd6eb9b-c53c-40dc-b880-f04c0c6cac6d","c6968610-57e6-44dc-bcc4-625314038a6f"],"responses":{"200":"a5fc6613-9f86-4a41-a95e-086119f51e08","400":"e6666246-2c05-421b-912c-a5d8cac69d8c","401":"e5e86daf-0f86-4f5d-b178-6ee6c06fd56b","405":"aa24f217-45ce-4ee7-bd5b-7d9c648bfc33","429":"7dc2953c-b3f4-427e-8210-9205f84e6ad2","500":"f7afed65-3a28-4618-955c-edd7327e0e38"},"security":[],"method":"post","type":"path","servers":["798b0034-0103-4c15-8d2e-3c2d6c4cae17"],"path":"/v1/ioc/query","baseUrlOptions":["https://api.threatbook.io"],"title":"Compromise Detection (V1)","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated","disableProxy":true},"dependencies":{"parameters":{"fdd6eb9b-c53c-40dc-b880-f04c0c6cac6d":{"name":"apikey","in":"query","description":"Your API key. For details on how to obtain and manage your API key, please refer to the [Authentication](https://docs.threatbook.io/api-reference/authentication) page.\n\n**Kindly note:**\n\nPlease check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.","required":true,"schema":{"type":"string","isRequired":true,"description":"Your API key. For details on how to obtain and manage your API key, please refer to the [Authentication](https://docs.threatbook.io/api-reference/authentication) page.\n\n**Kindly note:**\n\nPlease check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.","uniqueKey":"","typeLabel":"string"}},"c6968610-57e6-44dc-bcc4-625314038a6f":{"name":"resource","in":"query","description":"Domain names / IP address / IP:Port to query.\n\nYou are allowed to query a domain or IP address with a port to get more accurate intelligence, for example:\n- Domain to query:\n\n **googlenew.moy.su**\n\n- IPv4 with port to query:\n\n **183.18.2.4:8080**\n \n- IPv6 with port to query:\n\n \\[**2001:0db8:0000:0000:0001:0000:0000:0000**\\]:80","required":true,"schema":{"type":"string","isRequired":true,"description":"Domain names / IP address / IP:Port to query.\n\nYou are allowed to query a domain or IP address with a port to get more accurate intelligence, for example:\n- Domain to query:\n\n **googlenew.moy.su**\n\n- IPv4 with port to query:\n\n **183.18.2.4:8080**\n \n- IPv6 with port to query:\n\n \\[**2001:0db8:0000:0000:0001:0000:0000:0000**\\]:80","uniqueKey":"","typeLabel":"string"}}},"responses":{"a5fc6613-9f86-4a41-a95e-086119f51e08":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"msg":{"type":"string","const":"Success","isRequired":true,"uniqueKey":"msg","typeLabel":"string"},"data":{"type":"object","properties":{"ips":{"type":"object","properties":{},"description":"Key is an IP, value is a JSON Object. All fields for each item are shown below:\n- **threat_level**: String.\n - **malicious**: Only when we capture some specific activities related to \"C2, Sinkhole C2, MiningPool, CoinMiner, Malware\", we will consider it malicious in the compromise detection scenario. \n - **safe**: This determination is made only from the perspective of compromise detection and does not mean that there are no other malicious intelligence or activities associated with the IP or domain name beyond compromise.\n- **confidence_level**: String. There are three levels.\n - high\n - midium\n - low\n- **judgments**: Array. Intelligence type.\n There are 5 malicious types considered as **indicators of compromise(IOC)** in this API shown as below, other malicious types in the complete Intelligence Types sheets will not be returned.\n - C2\n - Sinkhole C2\n - MiningPool\n - CoinMiner\n - Malware\n \n Besides, neutral intelligence type will be returned, such as CDN, IDC, DNS, etc.\n- **whitelist**: Boolean. \n - true: It is whitelisted.\n - false: It is not whitelisted.\n- **APT**: Boolean\n - true: It is an APT.\n - false: There is not enough evidence to identify whether it is an APT.\n- **threat_actor**: Array. \n- **family**: Array. Virus or Trojan family.\n- **tag_categories**: Array. Fields for each item are shown bellow. \n - tags_type: Tag type. For example, “industry”.\n - tags: Specific tags are under the tags type.","isRequired":true,"uniqueKey":"data.ips","typeLabel":"object"},"domains":{"type":"object","properties":{},"description":"Key is an Domain name, value is a JSON Object. All fields for each item are shown below:\n- **categories**: Object. Domain categories.\n - first_cats:Array.\n - Second_cats:String.\n \nOther fields are the same as the description of \"ips\" above.","isRequired":true,"uniqueKey":"data.domains","typeLabel":"object"}},"required":["ips","domains"],"isRequired":true,"uniqueKey":"data","typeLabel":"object"},"response_code":{"type":"integer","const":200,"isRequired":true,"uniqueKey":"response_code","typeLabel":"integer"}},"required":["msg","data","response_code"],"uniqueKey":"","typeLabel":"object"},"example":{"msg":"Success","data":{"ips":{"183.18.2.4:8080":{"judgments":["Dynamic IP","Gateway"],"whitelist":false,"family":[],"severity":"info","APT":false,"threat_actor":[],"tag_categories":[],"confidence_level":"high","threat_level":"safe"}}},"response_code":200},"examples":{"Example":{"title":"Example","value":{"msg":"Success","data":{"ips":{"183.18.2.4:8080":{"judgments":["Dynamic IP","Gateway"],"whitelist":false,"family":[],"severity":"info","APT":false,"threat_actor":[],"tag_categories":[],"confidence_level":"high","threat_level":"safe"}}},"response_code":200}}},"exampleType":"examples"}},"headers":{},"exampleType":"examples"},"e6666246-2c05-421b-912c-a5d8cac69d8c":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"msg":{"type":"string","enum":["Required:{resource/apikey}","Invalid parameter:{parameter}"],"isRequired":true,"uniqueKey":"msg","typeLabel":"enum\u003cstring>"},"response_code":{"type":"integer","const":400,"isRequired":true,"uniqueKey":"response_code","typeLabel":"integer"}},"required":["msg","response_code"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example 1":{"title":"Example 1","value":{"msg":"Required:{resource/apikey}","response_code":400}}},"exampleType":"examples"}},"exampleType":"examples"},"e5e86daf-0f86-4f5d-b178-6ee6c06fd56b":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"msg":{"type":"string","enum":["Invalid account status","Invalid access IP: {actual IP address}","Invalid API key","Invalid key status","No access to the API","Expired API key","No access to the requested resource","No access to: {parameter}"],"isRequired":true,"uniqueKey":"msg","typeLabel":"enum\u003cstring>"},"response_code":{"type":"integer","const":401,"isRequired":true,"uniqueKey":"response_code","typeLabel":"integer"}},"required":["msg","response_code"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example 1":{"title":"Example 1","value":{"msg":"Invalid account status","response_code":401}}},"exampleType":"examples"}},"exampleType":"examples"},"aa24f217-45ce-4ee7-bd5b-7d9c648bfc33":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"msg":{"type":"string","const":"Invalid API method","isRequired":true,"uniqueKey":"msg","typeLabel":"string"},"response_code":{"type":"integer","const":405,"isRequired":true,"uniqueKey":"response_code","typeLabel":"integer"}},"required":["msg","response_code"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example 1":{"title":"Example 1","value":{"msg":"Invalid API method","response_code":405}}},"exampleType":"examples"}},"exampleType":"examples"},"7dc2953c-b3f4-427e-8210-9205f84e6ad2":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"msg":{"type":"string","enum":["Request rate limitation","Beyond {daily/monthly/total} quotas limitation"],"isRequired":true,"uniqueKey":"msg","typeLabel":"enum\u003cstring>"},"response_code":{"type":"integer","const":429,"isRequired":true,"uniqueKey":"response_code","typeLabel":"integer"}},"required":["msg","response_code"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example 1":{"title":"Example 1","value":{"msg":"Request rate limitation","response_code":429}}},"exampleType":"examples"}},"exampleType":"examples"},"f7afed65-3a28-4618-955c-edd7327e0e38":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"msg":{"type":"string","enum":["System error","URL Download Fail"],"isRequired":true,"uniqueKey":"msg","typeLabel":"enum\u003cstring>"},"response_code":{"type":"integer","const":500,"isRequired":true,"uniqueKey":"response_code","typeLabel":"integer"}},"required":["msg","response_code"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example 1":{"title":"Example 1","value":{"msg":"System error","response_code":500}}},"exampleType":"examples"}},"exampleType":"examples"}},"security":{},"servers":{"798b0034-0103-4c15-8d2e-3c2d6c4cae17":{"url":"https://api.threatbook.io"}}},"originalFileLocation":"api-reference/enrichment/compromise-detection-v1.openapi.json"},"subdomain":"secai-a5d02ac5","siteName":"ThreatBook CTI Documentation","title":"Compromise Detection - ThreatBook CTI Documentation","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-01-28T06:06:02.479Z","originalFileLocation":"api-reference/enrichment/compromise-detection-v1.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.\">\u003cmeta data-mint-head name=\"application-name\" content=\"ThreatBook CTI Documentation\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Compromise Detection - ThreatBook CTI Documentation\">\u003cmeta data-mint-head property=\"og:description\" content=\"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"ThreatBook CTI Documentation\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://secai-a5d02ac5.mintlify.app/_mintlify/api/og/v2?division=Enrichment\u0026amp;title=Compromise+Detection\u0026amp;description=This+API+is+used+to+detect+if+an+outbound+address+requested+from+an+internal+host+is+malicious+and+corresponding+threat+intel+labels.\u0026amp;theme=cc96c7d1e94e3382abfd5738\u0026amp;signature=2cc62ff9ac760a5671377b1b6009a5b9bec21628671cdde7056e8772483aec64\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Compromise Detection - ThreatBook CTI Documentation\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://secai-a5d02ac5.mintlify.app/_mintlify/api/og/v2?division=Enrichment\u0026amp;title=Compromise+Detection\u0026amp;description=This+API+is+used+to+detect+if+an+outbound+address+requested+from+an+internal+host+is+malicious+and+corresponding+threat+intel+labels.\u0026amp;theme=cc96c7d1e94e3382abfd5738\u0026amp;signature=2cc62ff9ac760a5671377b1b6009a5b9bec21628671cdde7056e8772483aec64\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/secai-a5d02ac5/FIkeW9BxQq6Kwlsn/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"ThreatBook CTI Documentation\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#CC0000\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/enrichment/compromise-detection-v1.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.threatbook.io/#organization\",\"name\":\"ThreatBook CTI Documentation\",\"url\":\"https://docs.threatbook.io\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/secai-a5d02ac5/R6uyh1S1hrTJxXQ_/logo/logo_light.svg?fit=max\u0026auto=format\u0026n=R6uyh1S1hrTJxXQ_\u0026q=85\u0026s=c467c47ec081583290c17e11c5d34135\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.threatbook.io#website\",\"name\":\"ThreatBook CTI Documentation\",\"url\":\"https://docs.threatbook.io\",\"publisher\":{\"@id\":\"https://docs.threatbook.io/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1#webpage\",\"url\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1\",\"name\":\"Compromise Detection\",\"description\":\"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.\",\"dateModified\":\"2026-01-28T06:06:02.479Z\",\"isPartOf\":{\"@id\":\"https://docs.threatbook.io#website\"},\"breadcrumb\":{\"@id\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Enrichment\",\"item\":\"https://docs.threatbook.io/api-reference/enrichment/ip-report-v1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Compromise Detection\",\"item\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1#apireference\",\"headline\":\"Compromise Detection\",\"name\":\"Compromise Detection\",\"description\":\"This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.\",\"url\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1\",\"mainEntityOfPage\":{\"@id\":\"https://docs.threatbook.io/api-reference/enrichment/compromise-detection-v1#webpage\"},\"dateModified\":\"2026-01-28T06:06:02.479Z\",\"publisher\":{\"@id\":\"https://docs.threatbook.io/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.threatbook.io#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"ThreatBook CTI Documentation\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"ThreatBook CTI Documentation","nav":{"global":null,"tabs":[{"tab":"Guides","pages":[{"title":"Guides","href":"/guide/introduction"}]},{"tab":"API Reference","groups":[{"group":"API Documentation","pages":[{"title":"Authentication","href":"/api-reference/authentication"}]},{"group":"Enrichment","pages":[{"title":"IP Report(Community)","openapi":"api-reference/enrichment/ip-report-v1.openapi.json POST /v1/community/ip","description":"You are able to get an IP report with comprehensive intelligence labels, such as **C2, Malware, Zombie, Compromised Host, Scanner,** etc., and contextual information like **open ports, certificates,** and so on.","href":"/api-reference/enrichment/ip-report-v1"},{"title":"Compromise Detection","openapi":"api-reference/enrichment/compromise-detection-v1.openapi.json POST /v1/ioc/query","href":"/api-reference/enrichment/compromise-detection-v1"},{"title":"IP Intelligence","openapi":"api-reference/enrichment/ip-intelligence-v2.openapi.json POST /v2/ip/query","description":"IP Intelligence(V2) API provides detailed threat intelligence for both **inbound** and **outbound** IP addresses. This includes threat verdict and labes from **ThreatBook Lab**, as well as associated internet asset and contextual data for each IP address.","href":"/api-reference/enrichment/ip-intelligence-v2"},{"title":"Domain Intelligence","openapi":"api-reference/enrichment/domain-intelligence-v2.openapi.json POST /v2/domain/query","href":"/api-reference/enrichment/domain-intelligence-v2"},{"title":"File Intelligence","openapi":"api-reference/enrichment/file-intelligence-v2.openapi.json POST /v2/file/query","href":"/api-reference/enrichment/file-intelligence-v2"},{"title":"File Upload","openapi":"api-reference/enrichment/file-upload-v2.openapi.json POST /v2/file/upload","href":"/api-reference/enrichment/file-upload-v2"},{"title":"URL Intelligence","openapi":"api-reference/enrichment/url-intelligence-v2.openapi.json POST /v2/url/query","href":"/api-reference/enrichment/url-intelligence-v2"},{"group":"Deprecated","pages":[{"title":"IP Intelligence(v1)","openapi":"api-reference/enrichment/ip-intelligence-v1.openapi.json POST /v1/ip/query","href":"/api-reference/enrichment/ip-intelligence-v1"},{"title":"Domain Intelligence(v1)","openapi":"api-reference/enrichment/domain-intelligence-v1.openapi.json POST /v1/domain/query","href":"/api-reference/enrichment/domain-intelligence-v1"}]}]},{"group":"Vulnerabilities","pages":[{"title":"Vulnerability Intelligence","openapi":"api-reference/vulnerabilities/vulnerability-intelligence-v2.openapi.json POST /v2/vulnerability/query","href":"/api-reference/vulnerabilities/vulnerability-intelligence-v2"}]},{"group":"Reports","pages":[{"title":"Report List","openapi":"api-reference/reports/report-list.openapi.json POST /v3/reports/list","href":"/api-reference/reports/report-list-v3"},{"title":"Report Detail","openapi":"api-reference/reports/report-detail.openapi.json GET /v2/reports/{id}","href":"/api-reference/reports/report-detail"},{"group":"Deprecated","pages":[{"title":"Report List (v2)","openapi":"api-reference/reports/report-list.openapi.json GET /v2/reports/list","href":"/api-reference/reports/report-list-v2"}]}]},{"group":"Feeds","pages":[{"title":"IP Reputation","openapi":"api-reference/feeds/ip-reputation.openapi.json GET /v2/feeds/stix/ip-reputation","playground":"simple","href":"/api-reference/feeds/ip-reputation"},{"title":"IOC","openapi":"api-reference/feeds/ioc.openapi.json GET /v2/feeds/stix/ioc","playground":"simple","href":"/api-reference/feeds/ioc"},{"title":"Reports","openapi":"api-reference/feeds/reports.openapi.json GET /v2/feeds/stix/reports","playground":"simple","href":"/api-reference/feeds/reports"},{"title":"Actors","openapi":"api-reference/feeds/actors.openapi.json GET /v2/feeds/stix/actor","playground":"simple","href":"/api-reference/feeds/actors"},{"title":"Hash","openapi":"api-reference/feeds/hash.openapi.json GET /v2/feeds/stix/hash","playground":"simple","href":"/api-reference/feeds/hash"},{"title":"URL","openapi":"api-reference/feeds/url.openapi.json GET /v2/feeds/stix/url","playground":"simple","href":"/api-reference/feeds/url"}]},{"group":"Third-party Integration","pages":[{"title":"Splunk APP - ThreatBook TI","href":"/api-reference/integration/splunk-app-api"}]}]}]},"title":"Compromise Detection - ThreatBook CTI Documentation","buildId":"dpl_HcHmUS6i3UwswnTHJUEdcTtwfdTQ","deploymentId":"dpl_HcHmUS6i3UwswnTHJUEdcTtwfdTQ","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-BRm_l__d.js","utils-f1l1Oc-G.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-BlhqDhJO.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-DHCB7rsC.js","snippetPresets-CYXLx6Hv.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-B78P2dEq.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-C4YLPVAh.js","shallow-vlLnTDkQ.js","getApiPlaygroundDisplay-D_98hhvf.js","CodeSnippet-DtnZHGqq.js","CodeSnippets-CLFb8KJt.js","Page-kQh739Uz.js","getPastedJson-Cq-zlbnU.js","icon-sN3t983t.js","MethodPill-P_YQ2s09.js","DuplicateIcon-BVzyNsGJ.js","createIcon-B3jqgqC6.js","DynamicMarkdown-Crwq6WG_.js","SectionHeading-C7pGS2Bb.js","axios-vUo_bRtp.js","Markdown-BuPH8yuW.js","clsx-CCOYKgaU.js","lib--scc4DXi.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BnkC_6oA.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-BM4S31-f.js"]}