Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
IP

Search for IP Address entities based on a filter

Find IP addresses by risk score, threat rules, dates, or geolocation with paginated enrichment results.

get/ip/search

Query parameters

fieldsstring

The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string.

See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.

{"stackTrail":"components:parameters:MetadataParameter:schema","oasType":"schema","type":"unknown"}

Annotates the response with additional metadata explaining the response data elements.

limitinteger

Maximum number of records returned,

frominteger

Offsets the pagination of the request. Note that there is a limit of returning only the top 10000 results from a search, meaning if limit plus from exceeds 10000, this will result in an Bad Request message.

rangestring

Range of IPs to search for, expressed as start-end or CIDR.

locationstring

Filters for IPs based on location expressed as RF ID (e.g. I2EnW4 is the RF_ID for Boston, Massachusetts).

riskScorestring

Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). '[' and ']' are inclusive while '(' and ')' are exclusive.

firstSeenstring

Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

lastSeenstring

Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

liststring

Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API

riskRule'recentValidatedCnc' | 'recentActiveCnc' | 'recentMaliciousInfrastructureAdminServer' | 'recentMaliciousScanner' | 'recentValidatedVulnerabilityScannerServer' | 'recentAnalystNote' | 'recentReportedCnc' | 'recentValidatedMaliciousRelayServer' | 'recentSuspectedCnc' | 'reportedCnc' | 'vulnerableHostObserved' | 'recentBotnet' | 'recentPhishingHost' | 'malwareDelivery' | 'cncNameserver' | 'recentSsl' | 'recentBruteForce' | 'recentDdos' | 'recentDnsAbuse' | 'recentExploitServer' | 'recentHoneypot' | 'recentMultiBlacklist' | 'recentOpenProxies' | 'recentPositiveMalwareVerdict' | 'recentSpam' | 'recentSshDictAttacker' | 'recentThreatResearcher' | 'recentScraping' | 'intermediateActiveCnc' | 'recentlyDefaced' | 'recentLinkedToAPT' | 'recentLinkedToCyberAttack' | 'recentLinkedIntrusion' | 'recentRelatedNote' | 'recentDhsAis' | 'maliciousPacketSource' | 'suspectedPhishingHost' | 'tor' | 'validatedCnc' | 'recentValidatedCncCommunication' | 'suspectedCnc' | 'cyberSignalCritical' | 'cyberSignalHigh' | 'cyberSignalMedium' | 'ssl' | 'botnet' | 'bruteForce' | 'possibleCnc' | 'ddos' | 'dnsAbuse' | 'exploitServer' | 'honeypot' | 'maliciousInfrastructureAdminServer' | 'multiBlacklist' | 'openProxies' | 'positiveMalwareVerdict' | 'spam' | 'sshDictAttacker' | 'threatResearcher' | 'phishingHost' | 'scraping' | 'linkedToAPT' | 'linkedToCyberAttack' | 'linkedIntrusion' | 'relatedNote' | 'defanged' | 'dhsAis' | 'analystNote' | 'historicalThreatListMembership' | 'honeypotHost' | 'bogusBgp' | 'validatedMaliciousRelayServer' | 'ddnsHost' | 'recentDefanged' | 'recentReportedCncCommunication' | 'predictionModelVerdict' | 'fastFluxResolution' | 'observedTelemetry' | 'maliciousScanner' | 'validatedVulnerabilityScannerServer' | 'actorInfrastructure' | 'rfTrending' | 'unusualIP' | 'vulnerableHost'

Filters for IPs based on a single risk rule.

orderBy'created' | 'modified' | 'sixtydayshits' | 'sevendayhits' | 'criticality' | 'riskscore' | 'totalhits' | 'firstseen' | 'lastseen' | 'rules'

Sorts the search according to the chosen parameter. Results are sorted before pagination.

direction'asc' | 'desc'

The direction of the sorting by the orderBy parameter, ascending or descending.

commentstring

Response

Result of operation