Check IP reputation (Maltiverse)
maltiverse_check_ipRead-onlyIdempotent
Look up an IP address's threat-intel reputation to get its classification, associated threats and feeds, ASN, and behavior flags such as C2, scanner, TOR, VPN, or proxy.
Instructions
Look up the threat-intel reputation of an IP address in Maltiverse.
Use this when you have an IP and need its classification (malicious / suspicious / neutral / whitelist), associated threats and feeds, ASN, and behaviour flags (C2, scanner, TOR, VPN, proxy, etc.). For domains use maltiverse_check_hostname; if you don't know the indicator type, use maltiverse_check_indicator.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"ip": "<ip>"
},
"name": "maltiverse_check_ip"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IPv4 or IPv6 address, e.g. '8.8.8.8' or '2001:4860:4860::8888'. | |
| response_format | No | concise |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| type | Yes | ||
| value | Yes | The indicator that was looked up. | |
| as_name | No | ||
| sources | No | Distinct feeds that reported this indicator. | |
| summary | Yes | One-line human-readable summary of the verdict. | |
| av_ratio | No | ||
| filetype | No | ||
| hostname | No | ||
| blacklist | No | Full per-feed attributions (detailed mode only). | |
| last_seen | No | ||
| first_seen | No | ||
| active_flags | No | Behaviour flags that are true, e.g. 'is_cnc', 'is_tor_node'. | |
| country_code | No | ||
| is_malicious | Yes | True when classification is 'malicious'. | |
| threat_names | No | Distinct threat/campaign names across all feeds. | |
| classification | Yes | Maltiverse verdict: malicious, suspicious, neutral, whitelist, or unknown. |