curl --request POST \
--url https://api.threatbook.io/v1/community/ipimport requests
url = "https://api.threatbook.io/v1/community/ip"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.threatbook.io/v1/community/ip', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v1/community/ip",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v1/community/ip"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v1/community/ip")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v1/community/ip")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"msg": "Success",
"data": {
"summary": {
"judgments": [],
"whitelist": true,
"first_seen": "2020-07-02",
"last_seen": "2022-09-11"
},
"basic": {
"carrier": "Cloudflare, Inc.",
"location": {
"country": "Australia",
"province": "",
"city": "",
"lng": "151.211354",
"lat": "-33.86264",
"country_code": "AU"
}
},
"asn": {
"rank": 4,
"info": "CLOUDFLARENET, US",
"number": 13335
},
"ports": [
{
"port": 80,
"module": "http",
"product": "Cloudflare http proxy",
"version": "",
"detail": ""
},
{
"port": 443,
"module": "https",
"product": "Cloudflare http proxy",
"version": "",
"detail": ""
}
],
"cas": [
{
"protocol": "https",
"port": 443,
"digital_certificate": {
"sha256": "73b8ed5becf1ba6493d2e2215a42dfdc7877e91e311ff5e59fb43d094871e699",
"subject": "cloudflare-dns.com",
"issuer": "DigiCert Global G2 TLS RSA SHA256 2020 CA1",
"fingerprint": "3ba7e9f806eb30d2f4e3f905e53f07e9acf08e1e",
"purpose": "SSL client|SSL server|Any Purpose|Any Purpose CA|OCSP helper",
"verify": "SHA256withRSA",
"status": "0",
"revoked": false,
"begin": "2025-01-02",
"end": "2026-01-21",
"status_desc": "Valid",
"serial_number": "27dc8c5e17294aec9ed3f67728e8a08",
"revoked_time": ""
}
}
],
"IP": "1.1.1.1"
},
"response_code": 200
}{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}IP Report(Community)
You are able to get an IP report with comprehensive intelligence labels, such as C2, Malware, Zombie, Compromised Host, Scanner, etc., and contextual information like open ports, certificates, and so on.
curl --request POST \
--url https://api.threatbook.io/v1/community/ipimport requests
url = "https://api.threatbook.io/v1/community/ip"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.threatbook.io/v1/community/ip', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v1/community/ip",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v1/community/ip"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v1/community/ip")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v1/community/ip")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"msg": "Success",
"data": {
"summary": {
"judgments": [],
"whitelist": true,
"first_seen": "2020-07-02",
"last_seen": "2022-09-11"
},
"basic": {
"carrier": "Cloudflare, Inc.",
"location": {
"country": "Australia",
"province": "",
"city": "",
"lng": "151.211354",
"lat": "-33.86264",
"country_code": "AU"
}
},
"asn": {
"rank": 4,
"info": "CLOUDFLARENET, US",
"number": 13335
},
"ports": [
{
"port": 80,
"module": "http",
"product": "Cloudflare http proxy",
"version": "",
"detail": ""
},
{
"port": 443,
"module": "https",
"product": "Cloudflare http proxy",
"version": "",
"detail": ""
}
],
"cas": [
{
"protocol": "https",
"port": 443,
"digital_certificate": {
"sha256": "73b8ed5becf1ba6493d2e2215a42dfdc7877e91e311ff5e59fb43d094871e699",
"subject": "cloudflare-dns.com",
"issuer": "DigiCert Global G2 TLS RSA SHA256 2020 CA1",
"fingerprint": "3ba7e9f806eb30d2f4e3f905e53f07e9acf08e1e",
"purpose": "SSL client|SSL server|Any Purpose|Any Purpose CA|OCSP helper",
"verify": "SHA256withRSA",
"status": "0",
"revoked": false,
"begin": "2025-01-02",
"end": "2026-01-21",
"status_desc": "Valid",
"serial_number": "27dc8c5e17294aec9ed3f67728e8a08",
"revoked_time": ""
}
}
],
"IP": "1.1.1.1"
},
"response_code": 200
}{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}Query Parameters
Your API key. For details on how to obtain and manage your API key, please refer to the Authentication page.
Kindly note:
Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.
Single IPv4 or IPv6 to query.
You are allowed to specify the following arguments to get specific data back. Each of them should be separated by commas if you would like to request more than two of them.
- summary: Summary of the threat intelligence.
- ports: open ports of the IP.
- cas: Relevant certificates of the IP.
- basic: Geographic location and carrier, etc.
- asn: Asn information.
If you don’t specify this parameter, we will return all data by default.
Response
"Success"Hide child attributes
Hide child attributes
Summary of the intelligence determined by ThreatBook
Each item includes the following fields:
- judgments: Array. Intelligence type of the final verdict by ThreatBook.
- whitelist: Boolean.
true: It is whitelisted.false: It is not whitelisted.
- first_seen: String. UTC time of the first discovery of intelligence.
- last_seen: String. UTC time of the last discovery of intelligence.
Geographic location information
- carrier
- location
- country
- country_code
- province
- city
- lng: longitude
- lat: latitude
ASN information.
Open ports
Each item includes the following fields:
- port
- module
- product
- version
- detail
SSL certificates associated with this IP address
Each item includes the following fields:
- protocol
- port
- digital_certificate: SSL Certificate detail.
- subject
- issuer
- fingerprint
- purpose
- verify: Digital signature algorithm.
- status: There are four status values for the certificate.
0: Normal1: Expired2: Invalid3: Self-signed
- status_desc: Description for the certificate status.
- revoked: Boolean. Indicates whether the certificate is revoked.
- revoke_time: The revoke time for the certificate.
- start: Effective time of the certificate.
- end: Expiration time of the certificate.
- serial_number: Serial number of the certificate.
The queried IP address.
Please pay attention, IPv6 will be returned in the following format: 2001:0db8:0000:0000:0001:0000:0000:0000