Skip to main content
GET
/
api
/
v1
/
lookup
curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/lookup?ioc=110.36.30.112"
{
  "meta": {
    "generated_at": "2026-05-16T05:00:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "found": true,
    "ioc_value": "110.36.30.112",
    "ioc_type": "ipv4",
    "confidence": "high",
    "first_seen": "2026-05-16T04:23:18Z",
    "last_seen": "2026-05-16T04:23:18Z",
    "total_occurrences": 3,
    "reporting_sources": 2,
    "threat_type": "malware_hosting",
    "malware_family": "Mozi",
    "tags": [
      "32-bit",
      "elf",
      "mips",
      "Mozi"
    ],
    "mitre_techniques": [],
    "risk": {
      "score": 78,
      "level": "high"
    },
    "hunting": {
      "detection_guidance": "Alert on outbound connections to this IP from production servers...",
      "splunk_query": "index=firewall dest_ip=110.36.30.112",
      "kql_query": "DeviceNetworkEvents | where RemoteIP == '110.36.30.112'"
    },
    "sources": [
      {
        "source_feed": "URLhaus",
        "source_category": "threat-feed",
        "reference_url": "https://urlhaus.abuse.ch/host/110.36.30.112/",
        "first_seen": "2026-05-16T04:23:18Z",
        "last_seen": "2026-05-16T04:23:18Z",
        "occurrence_count": 1,
        "confidence": "high",
        "context": "malware_hosting: 32-bit, elf, mips, Mozi"
      }
    ]
  }
}

Documentation Index

Fetch the complete documentation index at: https://docs.socdefenders.ai/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
X-API-Key
string
header
required

API key in X-API-Key header

Query Parameters

​
ioc
string
required

The indicator value to look up. Accepts any type — IPv4/IPv6 address, domain, URL, MD5/SHA1/SHA256/SHA512 hash, CVE ID, MITRE technique ID, or email address.

Maximum string length: 2048
Example:

"110.36.30.112"

​
type
enum<string>

Override the auto-detected type. Useful for ambiguous values (e.g., a short hex string that could be a hash prefix or a domain).

Available options:
ipv4,
ipv6,
domain,
url,
md5,
sha1,
sha256,
sha512,
email,
cve,
mitre_attack
Example:

"ipv4"

Response

Lookup result. The data.found field is true when at least one source reported this IOC; false means we have no record (which is not the same as "safe").

​
meta
object
​
data
object