Check indicator reputation
check_indicatorThe one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number. Defanged input (hxxp://, [.], [@]) is accepted. Returns a verdict (malicious, suspicious, clean or unknown), a headline you can relay as is, recommendedAction (block, review, allow or unverified), a 0-100 risk score, the threat blocklists that cite it, up to three evidence reasons, first/last seen, and network, registration or file context. An email address or phone number is never called clean: not being in our sources is unknown / unverified; its answer adds the sender domain's reputation, disposable and MX facts, or the E.164 form of the number. infrastructure says what the entity is known as (cloud range, CDN, Tor exit, VPN, crawler, allowlist) without being a verdict. SHA-512, TLSH, ssdeep and input that is none of the six kinds (an address in a form the API cannot read, digits that are not a phone number, a number written with letters, a host that is not a dotted domain name) are refused before any request, at no cost. The default level, fast, answers from cached intelligence without a live DNS, WHOIS or OTX call (a hash nobody has cached may wait up to ~2.5 s on CIRCL); facets not cached yet are listed in meta.pending, and one re-check after a few seconds may complete them; if they are still pending then, keep the answer and do not re-check again. Costs one request of the monthly quota; check_url is the cheaper pre-fetch gate for a link.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| country | No | ISO 3166-1 alpha-2 country (FR, GB, DE…) for a phone number written in national format, e.g. 06 12 34 56 78 with FR. Not needed for +… or 00… numbers; without it a 10-digit number is read as North American. Ignored for other indicators. | |
| indicator | Yes | The IP, domain, URL, file hash (MD5, SHA-1 or SHA-256), email address or phone number to check. Defanged forms are accepted, and so are full-width characters, a display-name address (Name <user@example.com>), a mailto:, tel:, sms: or callto: link, and a labelled hash (sha256:…). | |
| enrichment | No | "fast" (default): cached intelligence only, no live upstream call before the answer; facets not cached yet are listed in meta.pending and fetched in the background, so one re-check after a few seconds may complete them (a hash no source has cached may wait up to a few seconds on CIRCL). "standard": may call live upstreams (DNS, OTX, CIRCL) before answering; seconds on an entity nobody has checked recently. "basic": verdict and blocklists only, no risk score. Email addresses and phone numbers are answered from cached data at every level. |