Get query

cURL

curl --request GET \
  --url https://threat-intel-api.abusix.com/beta/query/{item}

{
  "status": "success",
  "statusCode": 200,
  "result": {
    "item": "<string>",
    "abusixMailBlocklist": "ACTIVE",
    "type": "IP",
    "bogon": false,
    "tags": [
      "<string>"
    ],
    "firstSeen": "2023-11-07T05:31:56Z",
    "lastSeen": "2023-11-07T05:31:56Z",
    "intent": "malicious",
    "reverseDns": {
      "current": [
        {
          "entry": "<string>"
        }
      ]
    },
    "abuseContact": {
      "email": "[email protected]",
      "status": "UNKNOWN",
      "lastVerification": "2023-11-07T05:31:56Z"
    },
    "asn": {
      "countryCode": "US",
      "asn": "AS1234",
      "name": "ACME Corporation"
    },
    "observedActivity": {
      "honeypotInteractions": {
        "firstSeen": "2023-11-07T05:31:56Z",
        "lastSeen": "2023-11-07T05:31:56Z",
        "observations": [
          {
            "firstSeen": "2023-11-07T05:31:56Z",
            "lastSeen": "2023-11-07T05:31:56Z",
            "service": "ssh",
            "type": "login-attack"
          }
        ]
      },
      "spamtrapInteractions": {
        "firstSeen": "2023-11-07T05:31:56Z",
        "lastSeen": "2023-11-07T05:31:56Z",
        "observations": [
          {
            "firstSeen": "2023-11-07T05:31:56Z",
            "lastSeen": "2023-11-07T05:31:56Z",
            "type": "pristine-spamtrap"
          }
        ]
      }
    }
  }
}

GET

query

{item}

cURL

curl --request GET \
  --url https://threat-intel-api.abusix.com/beta/query/{item}

{
  "status": "success",
  "statusCode": 200,
  "result": {
    "item": "<string>",
    "abusixMailBlocklist": "ACTIVE",
    "type": "IP",
    "bogon": false,
    "tags": [
      "<string>"
    ],
    "firstSeen": "2023-11-07T05:31:56Z",
    "lastSeen": "2023-11-07T05:31:56Z",
    "intent": "malicious",
    "reverseDns": {
      "current": [
        {
          "entry": "<string>"
        }
      ]
    },
    "abuseContact": {
      "email": "[email protected]",
      "status": "UNKNOWN",
      "lastVerification": "2023-11-07T05:31:56Z"
    },
    "asn": {
      "countryCode": "US",
      "asn": "AS1234",
      "name": "ACME Corporation"
    },
    "observedActivity": {
      "honeypotInteractions": {
        "firstSeen": "2023-11-07T05:31:56Z",
        "lastSeen": "2023-11-07T05:31:56Z",
        "observations": [
          {
            "firstSeen": "2023-11-07T05:31:56Z",
            "lastSeen": "2023-11-07T05:31:56Z",
            "service": "ssh",
            "type": "login-attack"
          }
        ]
      },
      "spamtrapInteractions": {
        "firstSeen": "2023-11-07T05:31:56Z",
        "lastSeen": "2023-11-07T05:31:56Z",
        "observations": [
          {
            "firstSeen": "2023-11-07T05:31:56Z",
            "lastSeen": "2023-11-07T05:31:56Z",
            "type": "pristine-spamtrap"
          }
        ]
      }
    }
  }
}

Path Parameters

item

string

required

IP to look up

Example:

"1.1.1.1"

Response

Query result

status

enum<string>

required

Available options:

success

statusCode

number

required

Required range: x > 0

Example:

200

result

object

required

Option 1
Option 2
Option 3
Option 4
Option 5
Option 6
Option 7

Show child attributes

result.item

string

required

normalized representation of requested item

result.abusixMailBlocklist

enum<string> | null

required

Available options:

ACTIVE,

ALLOWLIST,

INFORMATIONAL,

NOT_LISTED,

PASSIVE

result.type

enum<string>

required

Available options:

IP

result.bogon

enum<boolean>

required

Available options:

true,

false

result.tags

string[]

required

result.firstSeen

string<date-time> | null

required

result.lastSeen

string<date-time> | null

required

result.intent

enum<string> | null

required

Available options:

malicious,

suspicious,

unknown,

none

result.reverseDns

object

required

Show child attributes

result.reverseDns.current

object[] | null

required

Show child attributes

result.reverseDns.current.entry

string

required

result.abuseContact

object

required

Show child attributes

result.abuseContact.email

string<email> | null

required

May be null, if status is "UNKNOWN".

Example:

"[email protected]"

result.abuseContact.status

enum<string>

required

Available options:

UNKNOWN,

INVALID,

RESOLVE_FAILED,

CONNECT_FAILED,

RECIPIENT_FAILED,

WORKING

result.abuseContact.lastVerification

string<date-time> | null

required

result.asn

object

required

Show child attributes

result.asn.countryCode

string | null

required

Two letter country code (ISO 3166-1 alpha-2)

Example:

"US"

result.asn.asn

string | null

required

Example:

"AS1234"

result.asn.name

string | null

required

Example:

"ACME Corporation"

result.observedActivity

object

required

Show child attributes

result.observedActivity.honeypotInteractions

object

required

Show child attributes

result.observedActivity.honeypotInteractions.firstSeen

string<date-time> | null

required

result.observedActivity.honeypotInteractions.lastSeen

string<date-time> | null

required

result.observedActivity.honeypotInteractions.observations

object[]

required

Show child attributes

result.observedActivity.honeypotInteractions.observations.firstSeen

string<date-time>

required

result.observedActivity.honeypotInteractions.observations.lastSeen

string<date-time>

required

result.observedActivity.honeypotInteractions.observations.service

string

required

Example:

"ssh"

result.observedActivity.honeypotInteractions.observations.type

string

required

Example:

"login-attack"

result.observedActivity.spamtrapInteractions

object

required

Show child attributes

result.observedActivity.spamtrapInteractions.firstSeen

string<date-time> | null

required

result.observedActivity.spamtrapInteractions.lastSeen

string<date-time> | null

required

result.observedActivity.spamtrapInteractions.observations

object[]

required

Show child attributes

result.observedActivity.spamtrapInteractions.observations.firstSeen

string<date-time>

required

result.observedActivity.spamtrapInteractions.observations.lastSeen

string<date-time>

required

result.observedActivity.spamtrapInteractions.observations.type

string

required

Example:

"pristine-spamtrap"

Using the Abusix Guardian Intel Enterprise API Get quick check

⌘I

Getting Started with Guardian Intel

Lookup

API Reference

Path Parameters

Response