curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/lookup?ioc=110.36.30.112"

{
  "meta": {
    "generated_at": "2026-05-16T05:00:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "found": true,
    "ioc_value": "110.36.30.112",
    "ioc_type": "ipv4",
    "confidence": "high",
    "first_seen": "2026-05-16T04:23:18Z",
    "last_seen": "2026-05-16T04:23:18Z",
    "total_occurrences": 3,
    "reporting_sources": 2,
    "threat_type": "malware_hosting",
    "malware_family": "Mozi",
    "tags": [
      "32-bit",
      "elf",
      "mips",
      "Mozi"
    ],
    "mitre_techniques": [],
    "risk": {
      "score": 78,
      "level": "high"
    },
    "hunting": {
      "detection_guidance": "Alert on outbound connections to this IP from production servers...",
      "splunk_query": "index=firewall dest_ip=110.36.30.112",
      "kql_query": "DeviceNetworkEvents | where RemoteIP == '110.36.30.112'"
    },
    "sources": [
      {
        "source_feed": "URLhaus",
        "source_category": "threat-feed",
        "reference_url": "https://urlhaus.abuse.ch/host/110.36.30.112/",
        "first_seen": "2026-05-16T04:23:18Z",
        "last_seen": "2026-05-16T04:23:18Z",
        "occurrence_count": 1,
        "confidence": "high",
        "context": "malware_hosting: 32-bit, elf, mips, Mozi"
      }
    ]
  }
}

Lookup

Single-IOC enrichment with AI risk + hunting queries

VirusTotal-style enrichment for one indicator. Auto-detects the type from the value (no need to pass type= unless overriding).

What you get

Aggregated source reports: every feed that has seen this indicator
First/last seen timestamps across all sources
Confidence (high/medium/low) — calculated from source reputation + recency
Tags + malware family (when available)
MITRE ATT&CK techniques referenced in the source articles
AI risk score (0-100) and risk level
Hunting queries: ready-to-paste Splunk SPL and Sentinel KQL

When `found: false`

A “not found” response is not “this is safe” — it just means we have no record. Combine with reputation services (VT, GreyNoise, etc.) for negative conclusions.

Common use cases

1. SOC triage (paste the alert IP)

GET /api/v1/lookup?ioc=110.36.30.112

2. Hash triage from sandbox detonation

GET /api/v1/lookup?ioc=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

3. CVE risk assessment

GET /api/v1/lookup?ioc=CVE-2024-12345

Returns CVE + recent articles mentioning it (proxy for “is this actively exploited”).

4. Auto-type-detect override

GET /api/v1/lookup?ioc=internal.example.com&type=domain

Avoids ambiguous detection for short or unusual strings.

Available on the Free plan with standard 10 req/min limit.

GET

api

lookup

curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/lookup?ioc=110.36.30.112"

{
  "meta": {
    "generated_at": "2026-05-16T05:00:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "found": true,
    "ioc_value": "110.36.30.112",
    "ioc_type": "ipv4",
    "confidence": "high",
    "first_seen": "2026-05-16T04:23:18Z",
    "last_seen": "2026-05-16T04:23:18Z",
    "total_occurrences": 3,
    "reporting_sources": 2,
    "threat_type": "malware_hosting",
    "malware_family": "Mozi",
    "tags": [
      "32-bit",
      "elf",
      "mips",
      "Mozi"
    ],
    "mitre_techniques": [],
    "risk": {
      "score": 78,
      "level": "high"
    },
    "hunting": {
      "detection_guidance": "Alert on outbound connections to this IP from production servers...",
      "splunk_query": "index=firewall dest_ip=110.36.30.112",
      "kql_query": "DeviceNetworkEvents | where RemoteIP == '110.36.30.112'"
    },
    "sources": [
      {
        "source_feed": "URLhaus",
        "source_category": "threat-feed",
        "reference_url": "https://urlhaus.abuse.ch/host/110.36.30.112/",
        "first_seen": "2026-05-16T04:23:18Z",
        "last_seen": "2026-05-16T04:23:18Z",
        "occurrence_count": 1,
        "confidence": "high",
        "context": "malware_hosting: 32-bit, elf, mips, Mozi"
      }
    ]
  }
}

Authorizations

X-API-Key

string

header

required

API key in X-API-Key header

Query Parameters

ioc

string

required

The indicator value to look up. Accepts any type — IPv4/IPv6 address, domain, URL, MD5/SHA1/SHA256/SHA512 hash, CVE ID, MITRE technique ID, or email address.

Maximum string length: 2048

Example:

"110.36.30.112"

type

enum<string>

Override the auto-detected type. Useful for ambiguous values (e.g., a short hex string that could be a hash prefix or a domain).

Available options:

ipv4,

ipv6,

domain,

url,

md5,

sha1,

sha256,

sha512,

email,

cve,

mitre_attack

Example:

"ipv4"

Response

Lookup result. The data.found field is true when at least one source reported this IOC; false means we have no record (which is not the same as "safe").