Target Intelligence

VulnCheck Target Intelligence is a continuously updated index of internet-facing hosts confirmed to be running vulnerable software. Unlike traditional internet scanners that surface potentially vulnerable hosts, Target Intelligence applies fingerprinting and version detection techniques to identify hosts with a high degree of confidence, then maps those findings directly to CVEs.

This makes Target Intelligence useful as a stage 1 triage tool: before an attacker gets there, you can answer the question "which hosts on the internet are actually on the target list for this CVE right now?"

Base URL

https://api.vulncheck.com/v3/index/target-intel

Authentication

All requests require a bearer token in the Authorization header.

Authorization: Bearer <your_api_token>

Query Parameters

Parameters can be combined. All parameters are optional, but at least one should be provided for meaningful results.

Note on vendor, product, and version: These parameters work in any combination. Querying by vendor alone or version alone is supported but may return broad results. Combining two or more produces more targeted output.

Domain vs. Hostname

hostname and domain both search the reverse-DNS hostname observed at scan time. They differ only in where the value has to appear.

hostname matches the value anywhere in the hostname. hostname=test.com returns mail.test.com, and also test.com.example.net.

domain matches the value at the end of the hostname. domain=test.com returns mail.test.com but not test.com.example.net. Every domain result is therefore also a hostname result; domain is the stricter of the two.

Both parameters accept a comma-delimited list of values, which are OR'd together: domain=test.com,example.org.

Note on hostname coverage: only about a quarter of observed host-port records carry a hostname at all, so both parameters see the same limited slice of the index. A host with no reverse DNS cannot be found by either one, whatever its certificate says or whose network it sits in.

Note on what domain does not search: domain does not match the TLS certificate identity (metadata.cert_common_name, cert_subject_dn, cert_issuer_dn), and it does not match as_domain, the domain of the organization operating the host's Autonomous System. Those values are returned on each record but are not searchable. To find hosts by network operator, use asn.

Note on label boundaries: the suffix match is not aligned to a dot, so domain=test.com also matches a hostname ending in mytest.com.

Response Schema

Each result represents a single observed host-port-service tuple. Results are returned as a JSON array.

Top-Level Fields

fingerprints Array

Each element describes a single fingerprint match for the host-port.

summary Object

A pre-computed rollup of the CVE/fingerprint data on the record, so you don't have to count array lengths yourself.

Essential Product-Centric API Questions & Filters

Classification API Questions

Asset-Centric Queries

Example Requests

Look up a single IP using CIDR notation

curl -H "Authorization: Bearer <token>" \
  "https://api.vulncheck.com/v3/index/target-intel?cidr=203.0.113.42/32"

Find all hosts confirmed vulnerable to a specific CVE

curl -H "Authorization: Bearer <token>" \
  "https://api.vulncheck.com/v3/index/target-intel?cve=CVE-2024-21887"

Find all hosts running a specific product

curl -H "Authorization: Bearer <token>" \
  "https://api.vulncheck.com/v3/index/target-intel?vendor=ivanti&product=connect+secure"

Filter CVE results by country

curl -H "Authorization: Bearer <token>" \
  "https://api.vulncheck.com/v3/index/target-intel?cve=CVE-2024-21887&country_code=US"

Find hosts whose hostname ends in a domain

curl -H "Authorization: Bearer <token>" \
  "https://api.vulncheck.com/v3/index/target-intel?domain=test.com&contains_cve=true"

Example Response

{
  "data": [
    {
      "ip": "203.0.113.42",
      "hostname": "vpn.example.com",
      "port": 443,
      "timestamp": "2025-01-15T08:42:11Z",
      "date_added": "2025-01-15T08:42:11Z",
      "protocol": "http",
      "transport": "tcp",
      "cpe": ["cpe:2.3:a:ivanti:connect_secure:22.3.0:*:*:*:*:*:*:*"],
      "cve": ["CVE-2024-21887", "CVE-2023-46805"],
      "cve_confirmed": [
        { "cve_id": "CVE-2024-21887", "confirmed": true },
        { "cve_id": "CVE-2023-46805", "confirmed": true }
      ],
      "vendor": ["Ivanti"],
      "product": ["Connect Secure"],
      "version": ["22.3.0"],
      "fingerprints": [
        {
          "cpe": "cpe:2.3:a:ivanti:connect_secure:22.3.0:*:*:*:*:*:*:*",
          "vendor": "Ivanti",
          "product": "Connect Secure",
          "version": "22.3.0",
          "deprecated": false,
          "cves": [
            { "cve_id": "CVE-2024-21887", "confirmed": true },
            { "cve_id": "CVE-2023-46805", "confirmed": true }
          ]
        }
      ],
      "contains_cve": true,
      "summary": {
        "cve_count": 2,
        "confirmed_count": 2,
        "fingerprint_count": 1,
        "contains_cve": true
      },
      "asn": "AS64500",
      "as_name": "Example ISP",
      "as_domain": "example.com",
      "country": "United States",
      "country_code": "US",
      "classifications": ["c2:cobalt-strike"]
    }
  ]
}

When no CVE is associated with a fingerprinted service, the cve field is null (not an empty array) and contains_cve is false:

{
  "ip": "198.51.100.7",
  "hostname": "",
  "port": 80,
  "timestamp": "2025-01-15T09:10:00Z",
  "date_added": "2025-01-15T09:10:00Z",
  "protocol": "http",
  "transport": "tcp",
  "cpe": ["cpe:2.3:a:apache:tomcat:10.1.0:*:*:*:*:*:*:*"],
  "cve": null,
  "vendor": ["Apache"],
  "product": ["Tomcat"],
  "version": ["10.1.0"],
  "fingerprints": [
    {
      "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:*:*:*:*:*:*:*",
      "vendor": "Apache",
      "product": "Tomcat",
      "version": "10.1.0"
    }
  ],
  "contains_cve": false,
  "summary": {
    "cve_count": 0,
    "confirmed_count": 0,
    "fingerprint_count": 1,
    "contains_cve": false
  },
  "asn": "AS64501",
  "country": "Germany",
  "country_code": "DE"
}

Data Freshness

Target Intelligence maintains a rolling window of scan data. The index is continuously updated as new scan results arrive. Older observations are expired on a rolling basis to keep the dataset current and operationally relevant.

The unique key per record is the combination of IP + port + fingerprint/service information. If a host is re-scanned, its record is updated with the latest observation.

What This API Is and Is Not

Target Intelligence is:

• A confirmed exploitation target queue for known-vulnerable internet-facing hosts
• A pre-loss triage tool for understanding exposure at the moment a CVE is disclosed
• A source of high-confidence, CVE-mapped host data with version-level fingerprinting

Target Intelligence is not:

• An Attack Surface Management (ASM) tool it does not take a seed domain and enumerate assets
• A complete inventory of all internet-facing assets for a given organization
• A replacement for internal asset discovery

To look up hosts associated with an organization, query by ASN, CIDR range, or a list of known IPs.