IP Reputation & Threat Intelligence API
🔍 IP Reputation & Threat Intelligence API The most comprehensive IP reputation API on RapidAPI. Check any IPv4 address against 25+ live threat intelligence feeds in real-time. 🛡️ WHAT YOU GET (17 Endpoints) 1. Full IP Reputation Report (GET /v1/ip/{ip}) The flagship endpoint. Returns a complete threat intelligence report in one call: Risk score (0-100) with confidence level Risk level: LOW /…
9 subscribers
9.5/10 popularity
968 ms avg latency
88% success rate
17 endpoints
The in-depth APIMemo review for this API hasn't been published yet —
the data below comes straight from the public marketplace listing.
IP Reputation & Threat Intelligence API endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET |
Full IP Report /v1/ip/{ip}/ |
Get the complete IP reputation report with risk score, 25+ blocklist sources, darkweb check, ML prediction, threat actor attribution, and infrastructure graph. Path: /v1/ip/{ip}… |
| GET |
IP Summary /v1/ip/{ip}/summary |
Lightweight summary — just the risk score, level, and verdict. 95% smaller payload than full report. |
| GET |
Blocklist Check /v1/ip/{ip}/blocklist-check |
Check IP against 25 blocklist feeds. Returns which lists matched. |
| GET |
Tor Check /v1/ip/{ip}/tor-check |
Check if IP is a Tor exit node. Uses official Tor Project exit list (1,200+ nodes). |
| GET |
Darkweb Check /v1/ip/{ip}/darkweb-check |
Search ransomware.live, Ahmia.fi, and Nitter RSS for darkweb mentions. Includes reverse-DNS pivot to .onion domains. |
| GET |
ASN Context /v1/ip/{ip}/asn-context |
Returns network context: ASN number, AS owner (ISP name), network prefix (CIDR), geolocation (country, city, lat/lon), hosting type (Hosting/CDN/DNS/ISP), and Tor exit status.… |
| GET |
Behavioral Fingerprint /v1/ip/{ip}/behavioral |
Analyzes IP event history for behavioral patterns: max burst per hour (detects automated tooling), periodicity (detects C2 beaconing), weekend ratio (corporate vs. automated),… |
| GET |
ML Predictive Risk /v1/ip/{ip}/predictive |
Machine learning-powered future risk prediction. Uses a Logistic Regression model trained on historical malicious IP data with 10 features (blocklist hits, ASN reputation, port… |
| GET |
OTX Threat Intel /v1/ip/{ip}/otx |
Returns AlienVault OTX (Open Threat Exchange) community threat intelligence: pulse count, malicious pulse count, OTX reputation score, associated adversaries, linked malware… |
| GET |
Digital Footprints /v1/ip/{ip}/footprints |
Returns historical digital traces: SSL certificates (from crt.sh), DNS records, Shodan scan history, and passive DNS mappings. Useful for tracking infrastructure changes over time. |
| GET |
Threat Actor Attribution /v1/ip/{ip}/threat-actors |
Maps IP to MITRE ATT&CK threat actors using 3-tier lookup: (1) DB-stored manual attribution, (2) main report malware family → MITRE actor mapping, (3) SSLBL seed data… |
| GET |
Infrastructure Graph /v1/ip/{ip}/infrastructure |
Visualizes infrastructure relationships: Shodan hostnames & domains, CVEs (known vulnerabilities), CPEs (software), reverse DNS, and blocklist co-occurrence (other IPs in the… |
| GET |
JA3 TLS Fingerprint /v1/ip/{ip}/ja3 |
Returns known-malicious JA3 TLS fingerprints associated with the IP. Uses 3-tier lookup: (1) DB IP-JA3 mappings, (2) SSLBL seed cross-reference with malware family correlation,… |
| GET |
TLS Certificate Fingerprint /v1/ip/{ip}/tls-fingerprint |
Returns SSL/TLS certificate details for the IP: issuer, subject, validity period (not_before/not_after), serial number, and certificate chain. Data sourced from crt.sh… |
| GET |
Historical Events /v1/ip/history/{ip} |
Returns the complete event history for an IP from the PostgreSQL database. Each event includes timestamp, event type (blocklist_hit, report_generated, etc.), and event metadata.… |
| GET |
Reputation Timeline /v1/ip/{ip}/timeline |
Returns chronological risk score data points for charting. Each point includes timestamp, risk_score, risk_level, and verdict. Perfect for visualizing reputation changes over… |
| GET |
CSV Export /v1/ip/{ip}/csv |
Exports the IP's reputation history as CSV format: timestamp, risk_score, risk_level, verdict, confidence. Perfect for importing into Excel, Splunk, SIEM, or other analytics… |
IP Reputation & Threat Intelligence API pricing
| Plan | Price | Rate limit | Quotas |
|---|---|---|---|
| BASIC | Free | — |
|
| PRO | $9 / month | 60 / minute |
|
| ULTRA | $49 / month | — |
|
