Compromise Detection

Key is an IP, value is a JSON Object. All fields for each item are shown below:

• threat_level: String.
  • malicious: Only when we capture some specific activities related to "C2, Sinkhole C2, MiningPool, CoinMiner, Malware", we will consider it malicious in the compromise detection scenario.
  • safe: This determination is made only from the perspective of compromise detection and does not mean that there are no other malicious intelligence or activities associated with the IP or domain name beyond compromise.
• confidence_level: String. There are three levels.
  • high
  • midium
  • low
• judgments: Array. Intelligence type. There are 5 malicious types considered as indicators of compromise(IOC) in this API shown as below, other malicious types in the complete Intelligence Types sheets will not be returned.

  • C2

  • Sinkhole C2

  • MiningPool

  • CoinMiner

  • Malware

    Besides, neutral intelligence type will be returned, such as CDN, IDC, DNS, etc.

• whitelist: Boolean.
  • true: It is whitelisted.
  • false: It is not whitelisted.
• APT: Boolean
  • true: It is an APT.
  • false: There is not enough evidence to identify whether it is an APT.
• threat_actor: Array.
• family: Array. Virus or Trojan family.
• tag_categories: Array. Fields for each item are shown bellow.
  • tag_type: Tag type. For example, “industry”.
  • tags: Specific tags are under the tag type.

Key is an Domain name, value is a JSON Object. All fields for each item are shown below:

• categories: Object. Domain categories.
  • first_cats:Array.
  • Second_cats:String.

Other fields are the same as the description of "ips" above.