Searching IP Data
VulnCheck IP Intelligence includes tracking of potentially vulnerable systems that may be targeted by initial access exploits as well as tracking of command & control (C2) attacker infrastructure and honeypots.
API Query Parameters
VulnCheck IP Intelligence makes it easy to query our IP data set with a number of API query parameters, useful for filtering the results. Supported API query parameters are as follows:
| Query Parameter | Description |
|---|---|
| asn | Filter based on ASN: e.g., "AS719" |
| cidr | Filter based on IP address or range: e.g., "165.227.231.125" |
| country | Filter based on country_code: e.g., "Australia" |
| country_code | Filter based on country_code: e.g., "AU" |
| hostname | Filter based on keyword or FQDN: e.g., "google" or "amazonaws.com" |
| id | Filter based on supported detection types: e.g., "c2", "honeypot", or "initial-access" |
Example API Queries
VulnCheck IP Intelligence supports a wide range of use cases.
C2 Detections in Sweden
By combining two of the API query parameters (Country and ID) we can quickly zoom in one Command & Control (C2) detections in a given geography -- in this case, Sweden.
curl --request GET \
--url https://api.vulncheck.com/v3/index/ipintel-3d?id=c2&country=Sweden \
--header 'Accept: application/json' \
--header 'Authorization: Bearer insert_token_here'
Offline Backups Available
| Offline Backup | Description |
|---|---|
| ipintel-3d | IP Intelligence detections for the past 3 days |
| ipintel-10d | IP Intelligence detections for the past 10 days |
| ipintel-30d | IP Intelligence detections for the past 30 days |
| ipintel-90d | IP Intelligence detections for the past 90 days |
To request a specific offline backup, simply call /v3/backup/:index as follows (ipintel-3d shown below):
curl --request GET \
--url https://api.vulncheck.com/v3/backup/ipintel-3d \
--header 'Accept: application/json' \
--header 'Authorization: Bearer insert_token_here'
Introduction
VulnCheck IP Intelligence includes tracking of potentially vulnerable systems that may be targeted by initial access exploits as well as tracking of command & control (C2) attacker infrastructure and honeypots.
Firewall Dynamic Blocklists
VulnCheck IP Intelligence includes a Tags API endpoint that returns a list of IP addresses associated with a given tag or filter.
