API docs by Redocly

PrecisionSec REST API Documentation (1.6.0)

Download OpenAPI specification:

API for querying PrecisionSec threat intelligence including malware samples, malicious URLs, domains, and IP addresses. Provides access to threat feeds and IOC (Indicator of Compromise) lookups.

To request an API key, please contact info@precisionsec.com.

Get IP feed

Serves a static feed of malicious IP addresses from the last 60 days

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
[
  • "192.168.1.1"
]

Get URL feed

Serves a static feed of malicious URLs from the last 60 days

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{ }

Get ClickFix URL feed

Serves the free ClickFix distribution/lure URL feed from the last 60 days, queried live. Allowlisted URLs are excluded.

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{}

Get ClickFix domain feed

Serves the free ClickFix lure domain feed from the last 60 days, queried live. Domains are lowercased, de-duplicated, and allowlisted domains are excluded.

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "domains": [
    ]
}

Get sample by MD5

Retrieve sample information by MD5 hash, including the PE imphash and any extracted malware configs

Authorizations:
ApiKeyAuth
path Parameters
md5
required
string
Example: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

MD5 hash of the sample

Responses

Response samples

Content type
application/json
{
  • "first_seen": 1633046400,
  • "md5": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
  • "sha256": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6",
  • "sample_download_available": true,
  • "tags": [
    ],
  • "magic": "PE32 executable for MS Windows",
  • "campaign_id": "campaign123",
  • "botnet_id": "botnet456",
  • "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  • "distribution_urls": [],
  • "c2_urls": [],
  • "malware_configs": [
    ]
}

Get sample by SHA256

Retrieve sample information by SHA256 hash, including the PE imphash and any extracted malware configs

Authorizations:
ApiKeyAuth
path Parameters
sha256
required
string
Example: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

SHA256 hash of the sample

Responses

Response samples

Content type
application/json
{
  • "first_seen": 1633046400,
  • "md5": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
  • "sha256": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6",
  • "sample_download_available": true,
  • "tags": [
    ],
  • "magic": "PE32 executable for MS Windows",
  • "campaign_id": "campaign123",
  • "botnet_id": "botnet456",
  • "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  • "distribution_urls": [],
  • "c2_urls": [],
  • "malware_configs": [
    ]
}

Search samples by botnet ID

Retrieve samples associated with a specific botnet ID

Authorizations:
ApiKeyAuth
path Parameters
botnet_id
required
string
Example: botnet456

Botnet ID to search for

Responses

Response samples

Content type
application/json
{
  • "samples": [
    ],
  • "result": "No result"
}

Search samples by imphash

Retrieve up to the newest 1000 samples sharing a PE import hash

Authorizations:
ApiKeyAuth
path Parameters
imphash
required
string^[0-9a-fA-F]{32}$
Example: f34d5f2d4577ed6d9ceec516c1f5a744

PE imphash to search for

Responses

Response samples

Content type
application/json
{
  • "samples": [
    ],
  • "result": "No result"
}

Get domain information

Retrieve information about a domain, including associated samples and resolutions

Authorizations:
ApiKeyAuth
path Parameters
domain
required
string
Example: malicious.example.com

Domain name to lookup

Responses

Response samples

Content type
application/json
{
  • "domain": "malicious.example.com",
  • "first_seen": 1633046400,
  • "tags": [
    ],
  • "communicating_samples": [
    ],
  • "resolutions": [
    ]
}

Get passive DNS history for an IPv4 address

Retrieve every observed domain relationship for an IPv4 address, including all known domain classification tags.

Authorizations:
ApiKeyAuth
path Parameters
ip
required
string <ipv4>
Example: 192.168.1.1

Responses

Response samples

Content type
application/json
{
  • "ip": "192.168.1.1",
  • "passive_dns": [
    ]
}

Get passive DNS history for a domain

Retrieve every observed IPv4 relationship for a domain, including each IP's classification tag.

Authorizations:
ApiKeyAuth
path Parameters
domain
required
string
Example: malicious.example.com

Responses

Response samples

Content type
application/json
{
  • "domain": "malicious.example.com",
  • "passive_dns": [
    ]
}

Get URL information

Retrieve information about a URL, including its detection date and associated tags

Authorizations:
ApiKeyAuth
path Parameters
url
required
string
Example: http://malicious.example.com/malware.exe

URL to lookup

Responses

Response samples

Content type
application/json
{
  • "url": "http://malicious.example.com/malware.exe",
  • "detection_date": 1633046400,
  • "tags": [
    ],
  • "distributed_samples": [
    ],
  • "communicating_samples": [
    ],
  • "result": "No result"
}

Check if URL is malicious

Check if a URL is known to be malicious

Authorizations:
ApiKeyAuth
path Parameters
url
required
string
Example: http://malicious.example.com/page

URL to check

Responses

Response samples

Content type
application/json
{
  • "result": "Malicious"
}

Check if domain is malicious

Check if a domain is known to be malicious

Authorizations:
ApiKeyAuth
path Parameters
domain
required
string
Example: malicious.example.com

Domain to check

Responses

Response samples

Content type
application/json
{
  • "result": "Malicious"
}

Get IPv4 information

Retrieve information about an IPv4 address, including associated samples, passive DNS, and detected URLs

Authorizations:
ApiKeyAuth
path Parameters
ip
required
string
Example: 192.168.1.1

IPv4 address to lookup

Responses

Response samples

Content type
application/json
{
  • "ip": "192.168.1.1",
  • "first_seen": 1633046400,
  • "tags": [
    ],
  • "allowlisted": false,
  • "confidence": "high",
  • "communicating_samples": [
    ],
  • "passive_dns": [
    ],
  • "detected_urls": []
}

Check if IPv4 addresses exist

Check if a list of IPv4 addresses exist in the database

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
Array
string

Responses

Request samples

Content type
application/json
[
  • "192.168.1.1"
]

Response samples

Content type
application/json
{
  • "results": {
    }
}

Bulk lookup of IPs, domains and URLs

Look up many indicators in one request. Returns a verdict, tags and first-seen time per indicator. For full enrichment (samples, passive DNS, ...) call the single-indicator endpoints for the indicators that matter.

At most 1000 items (ips + domains + urls combined) per request. Invalid items are reported under errors and do not fail the request.

Rate limits: this endpoint has its own limits, applied per API key and counted in indicators rather than requests: 2,000 indicators per minute and 20,000 per day. A request is charged one unit per IP, domain and URL it contains, so a 1,000-item request uses 1,000 units. These limits replace the default per-request limits that apply to other endpoints. When a limit is exceeded the API returns 429.

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
non-empty
ips
Array of strings
domains
Array of strings
urls
Array of strings

Responses

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
{
  • "ips": {
    },
  • "domains": {
    },
  • "urls": {
    },
  • "errors": {
    }
}

List available tags

List all available tags in the system

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
[
  • "ransomware"
]

Get TLS pivot data for a sample

Retrieve JA3/JA4 fingerprints and X.509 certificates observed for a sample by MD5 hash

Authorizations:
ApiKeyAuth
path Parameters
md5
required
string
Example: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

MD5 hash of the sample

Responses

Response samples

Content type
application/json
{
  • "tls_fingerprints": [
    ],
  • "tls_certificates": [
    ]
}

Get TLS certificates observed at an IP

Retrieve X.509 certificates observed at a destination IPv4 address, via the cert<->IP association -- covers every source (Suricata/CAPE, Shodan, and the active scanner alike), not only certificates that also happened to touch a sample.

Authorizations:
ApiKeyAuth
path Parameters
ip
required
string
Example: 192.168.1.1

IPv4 address to lookup

Responses

Response samples

Content type
application/json
{
  • "tls_certificates": [
    ]
}

Pivot on a JA3/JA4 fingerprint

Retrieve samples sharing a given JA3/JA3S/JA4 TLS fingerprint

Authorizations:
ApiKeyAuth
path Parameters
kind
required
string
Enum: "ja3" "ja3s" "ja4"
Example: ja3

Fingerprint kind

hash
required
string
Example: a0e9f5d64349fb13191bc781f81f42e1

Fingerprint hash value

Responses

Response samples

Content type
application/json
{
  • "samples": [
    ]
}

Pivot on a TLS certificate

Retrieve certificate detail and samples that presented a given X.509 certificate (by SHA1 fingerprint)

Authorizations:
ApiKeyAuth
path Parameters
cert_fingerprint
required
string
Example: 5ba765b8b66d1cd51d34725d9082f534fa82be2

SHA1 fingerprint of the certificate, lowercase, no colons

Responses

Response samples

Content type
application/json
{
  • "certificate": {
    },
  • "samples": [
    ],
  • "ips": [
    ]
}

Pivot on a certificate DN attribute

Retrieve certificates carrying a matching Distinguished Name attribute (e.g. issuer O=DigiCert Inc), plus samples that presented any of them. Certificates are looked up independent of any sample -- a Shodan/active-scan-only certificate with this attribute is still returned even with an empty samples list.

Authorizations:
ApiKeyAuth
path Parameters
side
required
string
Enum: "subject" "issuer"
Example: issuer

DN side to match

attribute
required
string
Example: O

DN attribute name (e.g. CN, O, OU, C, ST, L)

value
required
string
Example: DigiCert Inc

DN attribute value

Responses

Response samples

Content type
application/json
{
  • "certificates": [
    ],
  • "samples": [
    ],
  • "ips": [
    ]
}

Get IOCs for tag

Get all Indicators of Compromise (IOCs) associated with a specific tag. Allowlisted (CDN/cloud) IPs are excluded.

Authorizations:
ApiKeyAuth
path Parameters
tag
required
string
Example: ransomware

Tag to lookup

Responses

Response samples

Content type
application/json
{
  • "ips": [
    ],
  • "domains": [
    ],
  • "urls": [],
  • "samples": [
    ]
}