curl "https://pulsedive.com/api/indicator.php?iid=47936201"{
"qid": 123,
"iid": 123,
"indicator": "<string>",
"type": "domain",
"risk": "unknown",
"risk_recommended": "unknown",
"manualrisk": 0,
"retired": 0,
"stamp_added": "2025-05-19 14:23:45",
"stamp_updated": "2025-05-19 14:23:45",
"stamp_seen": "2025-05-19 14:23:45",
"stamp_probed": "2025-05-19 14:23:45",
"stamp_retired": "2025-05-19 14:23:45",
"recent": 0,
"submissions": 123,
"umbrella_rank": 11032,
"umbrella_domain": "<string>",
"riskfactors": [
{
"rfid": 123,
"description": "found in threat feeds",
"risk": "unknown"
}
],
"redirects": {
"from": [
{
"id": "<string>",
"indicator": "<string>"
}
],
"to": [
{
"iid": 123,
"indicator": "<string>"
}
]
},
"threats": [
{
"tid": 123,
"name": "Zeus",
"category": "malware",
"risk": "unknown",
"stamp_linked": "2025-05-19 14:23:45"
}
],
"feeds": [
{
"fid": 123,
"name": "Zeus Bad Domains",
"category": "malware",
"organization": "abuse.ch",
"pricing": "free",
"stamp_linked": "2025-05-19 14:23:45"
}
],
"comments": [
{
"cid": 123,
"username": "sherd",
"title": "Founder",
"comment": "Have you seen our Pro tier? 😎",
"stamp_added": "2025-05-19 14:23:45",
"stamp_updated": "2025-05-19 14:23:45",
"uid": 123
}
],
"attributes": {
"port": [
[
"443",
"80"
]
],
"protocol": [
[
"HTTP",
"HTTPS"
]
],
"technology": [
[
"Apache",
"jQuery"
]
]
},
"properties": {
"geo": {
"countrycode": "US",
"region": "CA",
"country": "United States of America",
"address": "221 Lombard Street",
"zip": "94102",
"city": "San Francisco",
"org": "Pulsedive"
},
"whois": {
"++abuse": "abuse-complaints@squarespace.com",
"++email": [
"username1@organization1.org"
],
"++expires": "2025-05-19 14:23:45",
"++gdpr": "0",
"++phone": [
"+1.646-693-5324"
],
"++privacy": "0",
"++registered": "2025-05-19 14:23:45",
"++registrant": [
"Zero Cool",
"Titan Digital"
],
"++registrar": "Squarespace Domains II LLC",
"++updated": "2025-05-19 14:23:45",
"registrant organization": "Titan Digital",
"name server": [
"ns1.example.com",
"ns2.example.com"
]
},
"http": {
"++code": "200",
"++status": "OK",
"++content-type": "text/html",
"++base": "https://pulsedive.com/",
"++target": "http://pulsedive.com/",
"++redirect": "https://pulsedive.com/",
"Content-Type": "application/json",
"Set-Cookie": [
"sessionid=abc123; Path=/; Secure",
"userid=42; Path=/; HttpOnly"
]
},
"ssl": {
"subject": "/CN=pulsedive.com",
"domain": [
[
"pulsedive.com",
"www.pulsedive.com"
]
],
"version": "v3",
"org": [
"WE1",
"R11"
],
"ip": [
"162.159.36.1",
"2606:4700:4700::1001"
],
"issuer": [
"/C=US/O=Google Trust Services/CN=WE1",
"/C=US/O=Let's Encrypt/CN=R11"
],
"expires": "2025-05-19 14:23:45",
"fingerprint": "c47649d46db4cf725334942920ccb076b331a5a60dc3f58608bbf72512d222cd",
"valid": "2025-05-19 14:23:45",
"email": "username@pulsedive.com"
},
"dns": {
"a": "142.250.190.14",
"aaaa": "2607:f8b0:4004:c1b::8e",
"mx": "alt3.aspmx.l.google.com",
"ns": [
"ns1.digitalocean.com",
"ns2.digitalocean.com",
"ns3.digitalocean.com"
],
"txt": [
"v=spf1 include:_spf.google.com ~all",
"google-site-verification=abc123"
]
},
"meta": {
"++title": "Threat Intelligence - Pulsedive",
"Content-Type": "text/html; charset=UTF-8",
"og:image": [
"https://example.com/image1.jpg",
"https://example.com/image2.jpg"
]
},
"banners": {
"22": "SSH-2.0-OpenSSH_7.4\n",
"143": [
"* OK [CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED] Dovecot ready.\n",
"* PREAUTH [CAPABILITY IMAP4rev1 SASL-IR] Logged in as user\n"
]
},
"cookies": {
"_ga": "GA1.1.1991921685.1744247816",
"_ga_g550td8bzn": "GS1.1.1744247869.1.0.1744247869.0.0.0",
"token": [
"abc",
"def"
]
},
"dom": {
"screenshot": "https://sandbox.pulsedive.com/screenshots/4179fbe377b84604ba4eaee47f5de9d2.jpeg"
}
}
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}Get Indicator by ID
Retrieve detailed threat intelligence information for a specific indicator by looking up the indicator’s unique identifier.
curl "https://pulsedive.com/api/indicator.php?iid=47936201"{
"qid": 123,
"iid": 123,
"indicator": "<string>",
"type": "domain",
"risk": "unknown",
"risk_recommended": "unknown",
"manualrisk": 0,
"retired": 0,
"stamp_added": "2025-05-19 14:23:45",
"stamp_updated": "2025-05-19 14:23:45",
"stamp_seen": "2025-05-19 14:23:45",
"stamp_probed": "2025-05-19 14:23:45",
"stamp_retired": "2025-05-19 14:23:45",
"recent": 0,
"submissions": 123,
"umbrella_rank": 11032,
"umbrella_domain": "<string>",
"riskfactors": [
{
"rfid": 123,
"description": "found in threat feeds",
"risk": "unknown"
}
],
"redirects": {
"from": [
{
"id": "<string>",
"indicator": "<string>"
}
],
"to": [
{
"iid": 123,
"indicator": "<string>"
}
]
},
"threats": [
{
"tid": 123,
"name": "Zeus",
"category": "malware",
"risk": "unknown",
"stamp_linked": "2025-05-19 14:23:45"
}
],
"feeds": [
{
"fid": 123,
"name": "Zeus Bad Domains",
"category": "malware",
"organization": "abuse.ch",
"pricing": "free",
"stamp_linked": "2025-05-19 14:23:45"
}
],
"comments": [
{
"cid": 123,
"username": "sherd",
"title": "Founder",
"comment": "Have you seen our Pro tier? 😎",
"stamp_added": "2025-05-19 14:23:45",
"stamp_updated": "2025-05-19 14:23:45",
"uid": 123
}
],
"attributes": {
"port": [
[
"443",
"80"
]
],
"protocol": [
[
"HTTP",
"HTTPS"
]
],
"technology": [
[
"Apache",
"jQuery"
]
]
},
"properties": {
"geo": {
"countrycode": "US",
"region": "CA",
"country": "United States of America",
"address": "221 Lombard Street",
"zip": "94102",
"city": "San Francisco",
"org": "Pulsedive"
},
"whois": {
"++abuse": "abuse-complaints@squarespace.com",
"++email": [
"username1@organization1.org"
],
"++expires": "2025-05-19 14:23:45",
"++gdpr": "0",
"++phone": [
"+1.646-693-5324"
],
"++privacy": "0",
"++registered": "2025-05-19 14:23:45",
"++registrant": [
"Zero Cool",
"Titan Digital"
],
"++registrar": "Squarespace Domains II LLC",
"++updated": "2025-05-19 14:23:45",
"registrant organization": "Titan Digital",
"name server": [
"ns1.example.com",
"ns2.example.com"
]
},
"http": {
"++code": "200",
"++status": "OK",
"++content-type": "text/html",
"++base": "https://pulsedive.com/",
"++target": "http://pulsedive.com/",
"++redirect": "https://pulsedive.com/",
"Content-Type": "application/json",
"Set-Cookie": [
"sessionid=abc123; Path=/; Secure",
"userid=42; Path=/; HttpOnly"
]
},
"ssl": {
"subject": "/CN=pulsedive.com",
"domain": [
[
"pulsedive.com",
"www.pulsedive.com"
]
],
"version": "v3",
"org": [
"WE1",
"R11"
],
"ip": [
"162.159.36.1",
"2606:4700:4700::1001"
],
"issuer": [
"/C=US/O=Google Trust Services/CN=WE1",
"/C=US/O=Let's Encrypt/CN=R11"
],
"expires": "2025-05-19 14:23:45",
"fingerprint": "c47649d46db4cf725334942920ccb076b331a5a60dc3f58608bbf72512d222cd",
"valid": "2025-05-19 14:23:45",
"email": "username@pulsedive.com"
},
"dns": {
"a": "142.250.190.14",
"aaaa": "2607:f8b0:4004:c1b::8e",
"mx": "alt3.aspmx.l.google.com",
"ns": [
"ns1.digitalocean.com",
"ns2.digitalocean.com",
"ns3.digitalocean.com"
],
"txt": [
"v=spf1 include:_spf.google.com ~all",
"google-site-verification=abc123"
]
},
"meta": {
"++title": "Threat Intelligence - Pulsedive",
"Content-Type": "text/html; charset=UTF-8",
"og:image": [
"https://example.com/image1.jpg",
"https://example.com/image2.jpg"
]
},
"banners": {
"22": "SSH-2.0-OpenSSH_7.4\n",
"143": [
"* OK [CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED] Dovecot ready.\n",
"* PREAUTH [CAPABILITY IMAP4rev1 SASL-IR] Logged in as user\n"
]
},
"cookies": {
"_ga": "GA1.1.1991921685.1744247816",
"_ga_g550td8bzn": "GS1.1.1744247869.1.0.1744247869.0.0.0",
"token": [
"abc",
"def"
]
},
"dom": {
"screenshot": "https://sandbox.pulsedive.com/screenshots/4179fbe377b84604ba4eaee47f5de9d2.jpeg"
}
}
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}Query Parameters
Your Pulsedive API key.
API key authentication is optional. However, requests without a key have stricter rate limits. We recommend including an API key for better performance and reliability.
Unique identifier of the indicator to retrieve.
47936201
Indicates whether to return indicator properties as they appeared in previous scans. Use to analyze trends or audit historical threat activity.
For historical data, set to 1. For recent data, set to 0.
0, 1 Indicates whether to return attributes associated with the indicator type you are querying.
To return associated attributes, set to 1. To return default data, set to 0.
0, 1 Indicates whether to format returned JSON results.
For pretty-printed output, set to 1.
For compact output, set to 0.
0, 1 Response
Successful request. Returns indicator information in JSON format.
Unique identifier of an associated previous submission request, if available.
Unique identifier of the indicator.
Value of the indicator.
Type of indicator.
domain, ip, url Final risk score for the indicator.
If a user has manually adjusted the risk score, this value may differ from the recommended risk score.
In this case, manualrisk is set to 1.
unknown, very low, low, medium, high, critical Recommended risk level based on Pulsedive automated risk scoring.
unknown, very low, low, medium, high, critical Indicates whether the risk score has been manually adjusted.
When set to 1, the risk score has been manually adjusted.
When set to 0, the risk score reflects Pulsedive's automated assessment.
0, 1 Indicates whether the indicator is inactive or obsolete.
An indicator is automatically retired if, in the past three months, it has not been:
- Reported using the Seen button in the Pulsedive UI
- Observed in any source feeds
- Submitted through the Analyze section of the Pulsedive UI
Pulsedive research can also retire indicators manually.
When set to 1, this indicator is retired.
When set to 0, this indicator is active.
0, 1 Timestamp when the indicator was first added to Pulsedive. 24-hour format, UTC time zone.
^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$"2025-05-19 14:23:45"
Timestamp when the indicator record was last updated in Pulsedive. 24-hour format, UTC time zone.
^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$"2025-05-19 14:23:45"
Timestamp when the indicator was last reported or seen in feeds or user submissions in Pulsedive. 24-hour format, UTC time zone.
^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$"2025-05-19 14:23:45"
Timestamp when the indicator was last actively scanned (probed) by Pulsedive. 24-hour format, UTC time zone.
^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$"2025-05-19 14:23:45"
Timestamp when the indicator was retired in Pulsedive, if applicable. 24-hour format, UTC time zone.
^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$"2025-05-19 14:23:45"
Indicates whether this indicator has had recent activity. Deprecated.
When set to 1, the indicator has had recent activity.
When set to 0, the indicator has not had recent activity.
0, 1 Number of times the indicator has been submitted by any user.
Rank of the indicator on Cisco Umbrella's top one million domains list. This list reflects the most frequently queried domains, based on passive DNS data across Cisco's global Umbrella network.
11032
Canonical (base) domain as recognized by Cisco Umbrella. Populated when umbrella_rank is present.
List of risk factors influencing this indicator's score.
Show child attributes
Show child attributes
Redirect relationships involving this indicator.
Show child attributes
Show child attributes
Known threats associated with this indicator.
Show child attributes
Show child attributes
Threat intelligence feeds that reference this indicator.
Show child attributes
Show child attributes
Comments submitted by Pulsedive contributors for this indicator.
Show child attributes
Show child attributes
Technical metadata observed for this indicator.
Show child attributes
Show child attributes
Detailed sub-properties for this indicator, grouped by type or data source.
Show child attributes
Show child attributes
Was this page helpful?