Callback IP Lookup
callback-ip-lookupRead-only
Retrieve detailed threat intelligence for a callback IP, including attack stage, scanner associations, and malware files.
Instructions
Look up a single callback/C2 IP: attack stage, scanner associations, RIOT status, geo/network enrichment, and downloaded malware files.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | The callback IP address to look up |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | ||
| is_riot | No | ||
| last_seen | No | ||
| enrichment | No | ||
| file_count | No | ||
| first_seen | No | ||
| is_stage_1 | No | ||
| is_stage_2 | No | ||
| scanner_ips | No | ||
| active_files | No | ||
| attack_stage | No | ||
| scanner_count | No | ||
| riot_trust_level | No | ||
| source_workspaces | No |