Skip to main content
POST
/
v2
/
ip
/
query
IP Intelligence (V2)
curl --request POST \
  --url https://api.threatbook.io/v2/ip/query
{
  "msg": "<string>",
  "response_code": 123,
  "data": {
    "basic": {},
    "threat_types": [
      "<string>"
    ],
    "verdict": "<string>",
    "inbound_verdict": "<string>",
    "outbound_verdict": "<string>",
    "intel_labels": [
      "<string>"
    ],
    "is_highly_active": true,
    "seen_in_honeypot": true,
    "intelligences": [
      {}
    ],
    "samples": [
      {
        "sha256": "<string>",
        "ratio": "<string>",
        "scan_time": "<string>",
        "malware_type": "<string>",
        "malware_family": "<string>"
      }
    ],
    "asn": {},
    "ssl_certs": [
      {}
    ],
    "update_time": "<string>",
    "pdns_count": "<string>",
    "scene": "<string>"
  }
}

Query Parameters

​
apikey
string
required

Your API Key.

You are able to get the key on "My API" page of i.threatbook.io.

Kindly note:

Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.

​
resource
string
required

Single IPv4 or IPv6 address to query.

​
exclude
string

You can exclude the following parameters from the response based on actual usage scenarios. When specifying multiple parameters, separate them with commas (note: do not include spaces).

  • asn: ASN information.
  • ssl_certs: SSL certificate and related information.
  • intelligences: Threat intelligence.
  • judgments: Threat types derived from threat intelligence through comprehensive analysis.
  • tags_classes: Tags related to attack groups or security incidents.
  • samples: Related samples.
  • update_time: Latest update time of the intelligence.
  • pdns_count: Number of currently pointing domains.
  • scene: Application scenario.

If you don’t specify this parameter, we will return all data by default.

Response

​
msg
string
required
​
response_code
integer
required
​
data
object
required
⌘I