Accessing IP Intel

VulnCheck IP Intelligence includes tracking of potentially vulnerable systems that may be targeted by initial access exploits as well as tracking of command & control (C2) attacker infrastructure and honeypots.

Example API Queries

VulnCheck IP Intelligence supports a wide range of use cases.

C2 Detections in Sweden

By combining two of the API query parameters (Country and ID) we can quickly zoom in one Command & Control (C2) detections in a given geography -- in this case, Sweden.

curl --request GET \
    --url https://api.vulncheck.com/v3/index/ipintel-3d?id=c2&country=Sweden \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"

    vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
    configuration := vulncheck.NewConfiguration()
    configuration.Scheme = "https"
    configuration.Host = "api.vulncheck.com"

    client := vulncheck.NewAPIClient(configuration)

    token := os.Getenv("VULNCHECK_API_TOKEN")
    auth := context.WithValue(
        context.Background(),
        vulncheck.ContextAPIKeys,
        map[string]vulncheck.APIKey{
            "Bearer": {Key: token},
        },
    )
    resp, httpRes, err := client.IndicesAPI.IndexIpintel3dGet(auth).Country("Sweden").Id("c2").Execute()

    if err != nil || httpRes.StatusCode != 200 {
        log.Fatal(err)
    }

    prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
    if err != nil {
        log.Fatalf("Failed to generate JSON: %v", err)
        return
    }

    fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    indices_client = vulncheck_sdk.IndicesApi(api_client)

    api_response = indices_client.index_ipintel3d_get(id="c2", country="Sweden")

    print(api_response)

vulncheck index browse ipintel-3d --id c2 --country Sweden

Example API Response for IP Intel-3D

After calling the /v3/index/ipintel-3d?id=c2&country=:country API endpoint with a valid country, a response similar to the below will be returned:

{
  "_benchmark": 0.04378,
  "_meta": {
    "timestamp": "2025-10-27T23:18:59.172188696Z",
    "index": "ipintel-3d",
    //...
  },
  "data": [
    {
      "ip": "46.22.115.147",
      "port": 443,
      "ssl": true,
      "lastSeen": "2025-10-27T07:55:47.459042",
      "asn": "AS43853",
      "country": "Sweden",
      "country_code": "SE",
      "city": "Huddinge",
      "cve": [],
      "matches": [
        "SoftEther"
      ],
      "hostnames": [
        "46-22-115-147.ip.axbyte.se"
      ],
      "type": {
        "id": "c2",
        "kind": "Proxy",
        "finding": "command and control infrastructure"
      },
      "feed_ids": [
        "a93a3bdd-c625-4128-a15b-e99e2ca93d62"
      ],
      "_timestamp": "2025-10-27T09:05:50.858661971Z"
    },
    {
      "ip": "185.232.44.180",
      "port": 443,
      "ssl": true,
      "lastSeen": "2025-10-27T07:24:52.904576",
      "asn": "AS209209",
      "country": "Sweden",
      "country_code": "SE",
      "city": "Västerås",
      "cve": [],
      "matches": [
        "Interactsh"
      ],
      "hostnames": [],
      "type": {
        "id": "c2",
        "kind": "Attack Infrastructure",
        "finding": "command and control infrastructure"
      },
      "feed_ids": [
        "7f6bc0e7-8064-40f8-b7d4-c4ebc17cf997"
      ],
      "_timestamp": "2025-10-27T09:04:42.629323571Z"
    },
    //...
  ]
}

API Query Parameters

VulnCheck IP Intelligence makes it easy to query our IP data set with a number of API query parameters, useful for filtering the results. Supported API query parameters are as follows:

Query Parameter	Description
asn	Filter based on ASN: e.g., "AS719"
cidr	Filter based on IP address or range: e.g., "165.227.231.125"
country	Filter based on country_code: e.g., "Australia"
country_code	Filter based on country_code: e.g., "AU"
hostname	Filter based on keyword or FQDN: e.g., "google" or "amazonaws.com"
id	Filter based on supported detection types: e.g., "c2", "honeypot", or "initial-access"

Offline Backups Available

Offline Backup	Description
ipintel-3d	IP Intelligence detections for the past 3 days
ipintel-10d	IP Intelligence detections for the past 10 days
ipintel-30d	IP Intelligence detections for the past 30 days
ipintel-90d	IP Intelligence detections for the past 90 days

To request a specific offline backup, simply call /v3/backup/:index as follows (ipintel-3d shown below):

curl --request GET \
    --url https://api.vulncheck.com/v3/backup/ipintel-3d \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"

    vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
    configuration := vulncheck.NewConfiguration()
    configuration.Scheme = "https"
    configuration.Host = "api.vulncheck.com"

    client := vulncheck.NewAPIClient(configuration)

    token := os.Getenv("VULNCHECK_API_TOKEN")
    auth := context.WithValue(
        context.Background(),
        vulncheck.ContextAPIKeys,
        map[string]vulncheck.APIKey{
            "Bearer": {Key: token},
        },
    )
    resp, httpRes, err := client.EndpointsAPI.BackupIndexGet(auth, "ipintel-3d").Execute()

    if err != nil || httpRes.StatusCode != 200 {
        log.Fatal(err)
    }

    prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
    if err != nil {
        log.Fatalf("Failed to generate JSON: %v", err)
        return
    }

    fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    endpoints_client = vulncheck_sdk.EndpointsApi(api_client)

    api_response = endpoints_client.backup_index_get("ipintel-3d")

    print(api_response.data[0].url)

vulncheck backup download ipintel-3d

IP Intel Attribute Details

Attribute	Meaning
ip	IP Address of the host
port	Port the host was accessible
ssl
lastSeen	The last time the record was seen
asn	asn associated with the IP address
country	country associated with the IP address
country code	country code associated with the IP address
city	city associated with the IP address
cve	CVE's associated with the host
matches	Represents the name or identifier in relation to the ID. e.g. Confluence Honeypot when ID is honeypot, name of vulnerability when ID is initial-access
hostnames	Reverse DNS lookups for IP address
feed_ids	Indicates which rule in the feed was used to detect that particular finding
_timestamp	Time when the record was last modified

type attribute

Attribute	Meaning
id	source of ip intelligence ie: initial-access, proxy, c2, ics, vulncheck-canaries
kind	Identifies C2 or C2 Proxy when ID is c2 ie: Proxy,C2, Attack Infrastructure, Scanner
finding	potentially vulnerable, proxy, honeypot, command and control infrastructure, web application attack, ics, detection of a network scan, potentially bad traffic

IP Intelligence

Firewall Dynamic Blocklists