Accessing IP Intel

VulnCheck IP Intelligence includes tracking of potentially vulnerable systems that may be targeted by initial access exploits as well as tracking of command & control (C2) attacker infrastructure and honeypots.

Example API Queries

VulnCheck IP Intelligence supports a wide range of use cases.

C2 Detections in Sweden

By combining two of the API query parameters (Country and ID) we can quickly zoom in one Command & Control (C2) detections in a given geography -- in this case, Sweden.

curl --request GET \
    --url https://api.vulncheck.com/v3/index/ipintel-3d?id=c2&country=Sweden \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"

    vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
    configuration := vulncheck.NewConfiguration()
    configuration.Scheme = "https"
    configuration.Host = "api.vulncheck.com"

    client := vulncheck.NewAPIClient(configuration)

    token := os.Getenv("VULNCHECK_API_TOKEN")
    auth := context.WithValue(
        context.Background(),
        vulncheck.ContextAPIKeys,
        map[string]vulncheck.APIKey{
            "Bearer": {Key: token},
        },
    )
    resp, httpRes, err := client.IndicesAPI.IndexIpintel3dGet(auth).Country("Sweden").Id("c2").Execute()

    if err != nil || httpRes.StatusCode != 200 {
        log.Fatal(err)
    }

    prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
    if err != nil {
        log.Fatalf("Failed to generate JSON: %v", err)
        return
    }

    fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    indices_client = vulncheck_sdk.IndicesApi(api_client)

    api_response = indices_client.index_ipintel3d_get(id="c2", country="Sweden")

    print(api_response)

vulncheck index browse ipintel-3d --id c2 --country Sweden

Example API Response for IP Intel-3D

After calling the /v3/index/ipintel-3d?id=c2&country=:country API endpoint with a valid country, a response similar to the below will be returned:

{
  "_benchmark": 0.04378,
  "_meta": {
    "timestamp": "2025-10-27T23:18:59.172188696Z",
    "index": "ipintel-3d",
    //...
  },
  "data": [
    {
      "ip": "46.22.115.147",
      "port": 443,
      "ssl": true,
      "lastSeen": "2025-10-27T07:55:47.459042",
      "asn": "AS43853",
      "country": "Sweden",
      "country_code": "SE",
      "city": "Huddinge",
      "cve": [],
      "matches": [
        "SoftEther"
      ],
      "hostnames": [
        "46-22-115-147.ip.axbyte.se"
      ],
      "type": {
        "id": "c2",
        "kind": "Proxy",
        "finding": "command and control infrastructure"
      },
      "feed_ids": [
        "a93a3bdd-c625-4128-a15b-e99e2ca93d62"
      ],
      "_timestamp": "2025-10-27T09:05:50.858661971Z"
    },
    {
      "ip": "185.232.44.180",
      "port": 443,
      "ssl": true,
      "lastSeen": "2025-10-27T07:24:52.904576",
      "asn": "AS209209",
      "country": "Sweden",
      "country_code": "SE",
      "city": "Västerås",
      "cve": [],
      "matches": [
        "Interactsh"
      ],
      "hostnames": [],
      "type": {
        "id": "c2",
        "kind": "Attack Infrastructure",
        "finding": "command and control infrastructure"
      },
      "feed_ids": [
        "7f6bc0e7-8064-40f8-b7d4-c4ebc17cf997"
      ],
      "_timestamp": "2025-10-27T09:04:42.629323571Z"
    },
    //...
  ]
}

API Query Parameters

VulnCheck IP Intelligence makes it easy to query our IP data set with a number of API query parameters, useful for filtering the results. Supported API query parameters are as follows:

Query Parameter	Description
asn	Filter based on ASN: e.g., "AS719"
cidr	Filter based on IP address or range: e.g., "165.227.231.125"
country	Filter based on country_code: e.g., "Australia"
country_code	Filter based on country_code: e.g., "AU"
hostname	Filter based on keyword or FQDN: e.g., "google" or "amazonaws.com"
id	Filter based on supported detection types: e.g., "c2", "honeypot", or "initial-access"

Offline Backups Available

Offline Backup	Description
ipintel-3d	IP Intelligence detections for the past 3 days
ipintel-10d	IP Intelligence detections for the past 10 days
ipintel-30d	IP Intelligence detections for the past 30 days
ipintel-90d	IP Intelligence detections for the past 90 days

To request a specific offline backup, simply call /v3/backup/:index as follows (ipintel-3d shown below):

curl --request GET \
    --url https://api.vulncheck.com/v3/backup/ipintel-3d \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"

    vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
    configuration := vulncheck.NewConfiguration()
    configuration.Scheme = "https"
    configuration.Host = "api.vulncheck.com"

    client := vulncheck.NewAPIClient(configuration)

    token := os.Getenv("VULNCHECK_API_TOKEN")
    auth := context.WithValue(
        context.Background(),
        vulncheck.ContextAPIKeys,
        map[string]vulncheck.APIKey{
            "Bearer": {Key: token},
        },
    )
    resp, httpRes, err := client.EndpointsAPI.BackupIndexGet(auth, "ipintel-3d").Execute()

    if err != nil || httpRes.StatusCode != 200 {
        log.Fatal(err)
    }

    prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
    if err != nil {
        log.Fatalf("Failed to generate JSON: %v", err)
        return
    }

    fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    endpoints_client = vulncheck_sdk.EndpointsApi(api_client)

    api_response = endpoints_client.backup_index_get("ipintel-3d")

    print(api_response.data[0].url)

vulncheck backup download ipintel-3d

IP Intelligence

Firewall Dynamic Blocklists