Look up an indicator in threat records

An IP, domain, URL, file hash (MD5/SHA-1/SHA-256) or email. Defanged input such as `hxxp://example[.]com` is accepted. `sonuc: "kayit-yok"` means nothing was found in the checked sources, not that the indicator is safe. Private network addresses are not looked up. Requires 360; an hourly limit applies (429).

GET/v1/ioc/search

GETLook up an indicator in threat records

curl -X GET "https://api.darkradar.com/api/public/v1/ioc/search?q=185.220.101.1" \
  -H "x-api-key: $DARKRADAR_API_KEY"

Response

Success

{
  "success": true,
  "data": {
    "tur": "ipv4",
    "deger": "185.220.101.1",
    "sonuc": "kayitli",
    "kaynaklar": [
      {
        "kod": "tor",
        "ad": "Tor çıkış düğümleri",
        "tehditTuru": "tor_exit_node",
        "zararliAile": null
      }
    ],
    "ilgili": {
      "gruplar": [],
      "kurbanlar": []
    },
    "bakilan": [
      {
        "kod": "tor",
        "ad": "Tor çıkış düğümleri",
        "durum": "ok"
      }
    ],
    "korpusBaglantisi": null
  }
}

Access

Scopeleaks:read

Plan entitlementintel_hunter

Query parameters

Fields	Values
`q` · string · required	Indicator to look up (max 2048 chars) · Example: `185.220.101.1`

Responses

200Success

400Invalid request (malformed id, missing or invalid field)

401Key missing, invalid, expired or revoked

403Insufficient scope, no API access in plan, or product not enabled

404Record not found or not owned by this key’s firm

408The request exceeded its maximum response time

429Rate limit exceeded; retry after a minute

Response limits

Rate limit500 requests per 15 min · per IP

Threat Investigation20 requests per 1 min · per firm