curl --request POST \
--url https://api.threatbook.io/v1/ioc/queryimport requests
url = "https://api.threatbook.io/v1/ioc/query"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.threatbook.io/v1/ioc/query', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v1/ioc/query",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v1/ioc/query"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v1/ioc/query")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v1/ioc/query")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"msg": "Success",
"data": {
"ips": {
"183.18.2.4:8080": {
"judgments": [
"Dynamic IP",
"Gateway"
],
"whitelist": false,
"family": [],
"severity": "info",
"APT": false,
"threat_actor": [],
"tag_categories": [],
"confidence_level": "high",
"threat_level": "safe"
}
}
},
"response_code": 200
}{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}Compromise Detection
This API is used to detect if an outbound address requested from an internal host is malicious and corresponding threat intel labels.
curl --request POST \
--url https://api.threatbook.io/v1/ioc/queryimport requests
url = "https://api.threatbook.io/v1/ioc/query"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.threatbook.io/v1/ioc/query', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v1/ioc/query",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v1/ioc/query"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v1/ioc/query")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v1/ioc/query")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"msg": "Success",
"data": {
"ips": {
"183.18.2.4:8080": {
"judgments": [
"Dynamic IP",
"Gateway"
],
"whitelist": false,
"family": [],
"severity": "info",
"APT": false,
"threat_actor": [],
"tag_categories": [],
"confidence_level": "high",
"threat_level": "safe"
}
}
},
"response_code": 200
}{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}Query Parameters
Your API key. For details on how to obtain and manage your API key, please refer to the Authentication page.
Kindly note:
Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.
Domain names / IP address / IP:Port to query.
You are allowed to query a domain or IP address with a port to get more accurate intelligence, for example:
-
Domain to query:
googlenew.moy.su
-
IPv4 with port to query:
183.18.2.4:8080
-
IPv6 with port to query:
[2001:0db8:0000:0000:0001:0000:0000:0000]:80
Response
"Success"Hide child attributes
Hide child attributes
Key is an IP, value is a JSON Object. All fields for each item are shown below:
- threat_level: String.
- malicious: Only when we capture some specific activities related to "C2, Sinkhole C2, MiningPool, CoinMiner, Malware", we will consider it malicious in the compromise detection scenario.
- safe: This determination is made only from the perspective of compromise detection and does not mean that there are no other malicious intelligence or activities associated with the IP or domain name beyond compromise.
- confidence_level: String. There are three levels.
- high
- midium
- low
- judgments: Array. Intelligence type.
There are 5 malicious types considered as indicators of compromise(IOC) in this API shown as below, other malicious types in the complete Intelligence Types sheets will not be returned.
-
C2
-
Sinkhole C2
-
MiningPool
-
CoinMiner
-
Malware
Besides, neutral intelligence type will be returned, such as CDN, IDC, DNS, etc.
-
- whitelist: Boolean.
- true: It is whitelisted.
- false: It is not whitelisted.
- APT: Boolean
- true: It is an APT.
- false: There is not enough evidence to identify whether it is an APT.
- threat_actor: Array.
- family: Array. Virus or Trojan family.
- tag_categories: Array. Fields for each item are shown bellow.
- tags_type: Tag type. For example, “industry”.
- tags: Specific tags are under the tags type.
Key is an Domain name, value is a JSON Object. All fields for each item are shown below:
- categories: Object. Domain categories.
- first_cats:Array.
- Second_cats:String.
Other fields are the same as the description of "ips" above.