IP threat intelligence API
Ask one question about an address and get the whole answer
The CTIF REST API turns an IPv4 address into a decision. One call returns where it is, who runs it, whether it hides behind Tor, whether it is a CDN edge you must not block, which MITRE ATT&CK techniques we watched it use, the log line that flagged it, and a single 0 to 100 hostility score you can threshold on. It is JSON over HTTPS with a header key. There is no SDK to install and no connector to buy.
One call, one decision
curl -H "X-CTIF-Key: $CTIF_KEY" \
https://ctif.orvteam.com/api/ioc/185.220.101.4The same key reaches domain enrichment, WHOIS and RDAP, the STIX 2.1 bundle for an indicator, and the scored blocklist. The full endpoint reference lives in the documentation.
What comes back
| Field | What it is for |
|---|---|
| hostility_score | 0 to 100, recency-decayed. The one number you can sort or threshold on. |
| country / region / city | Geolocation of the source address. |
| asn / isp / org | Which network runs it, so you can see a whole hosting range at once. |
| reverse_lookup | rDNS where the operator publishes it. |
| is_tor_exit_node | Tor exit membership, scored as infrastructure rather than as an act. |
| is_cdn / is_known_scanner | The two categories you should almost never block. Score-capped, never silently removed. |
| attack_tactic / attack_technique | MITRE ATT&CK mapping derived from the behaviour we recorded. |
| reason_list / sample_event | What flagged it, down to the log line, so a finding can be argued with. |
| sighting_count | How many times our sensors saw it. |
| first_seen / last_seen | The window it has been active in. |
| source_sourcetype | Which sensor or public list produced the sighting. |
| targeted_countries | Where the sensor it hit is located. |
Why the score is the useful part
A membership list tells you an address is on a list. It does not tell you whether to act. CTIF ranks what our sensors observed above what an address merely is: an observed attack outweighs volume, volume outweighs category, and a CDN edge or a known research scanner is capped below any usable threshold no matter how noisy it gets, because blocking those costs you more than they cost the attacker. The total then decays with a 30-day half-life, so an address we stopped seeing quietly falls out of your enforcement without anyone maintaining a list. The exact weights are published on the methodology page.
Honest limits
It is IPv4 and IP-centric: no file hashes, no malware families, no passive DNS, no IPv6. Collection runs every 6 hours, so last-seen times can trail the event by that much, and we publish real per-sensor freshness on the status page instead of the phrase "real time". Coverage is what our sensors saw, which is a real but finite slice of the internet, so an address missing from the feed is not evidence that it is safe. STIX 2.1 is a per-indicator bundle over REST, not a TAXII collection.
Getting a key
API access starts at the SMB plan (2,000 requests a day) and runs to SOC at 10,000. Before paying anything, any free account can activate a 7-day trial with a working key, every sensor, STIX and the blocklist, so you can point it at a real alert queue rather than take our word for it.