API Documentation

IP Intelligence API

Free, public API for AI-powered IP threat intelligence. No API key required.

Overview

The SecureNow IP Intelligence API provides a comprehensive threat assessment for any IPv4 address. It combines data from AbuseIPDB, community reports, and SecureNow's proprietary AI analysis into a single response.

SecureNow Score

0 – 100 composite threat score

AI Analysis

Verdict, bot detection, attack types

AbuseIPDB

Confidence score, reports, geo

Rate Limits

Limit	Value
Requests per minute	10
Cache duration	24 hours
Authentication	None required
Supported IPs	IPv4 only

Exceeding the rate limit returns a 429 response with a retryAfter field.

Endpoint

GEThttps://api.securenow.ai/api/public/ip-intel/{ip}

Path Parameters

Parameter	Type	Description
ip	string	IPv4 address to analyze (e.g. `185.220.101.1`)

Response (200 OK)

json

{
  "ip": "185.220.101.1",
  "securenowScore": 87,
  "verdict": "Malicious - Automated Scanner",
  "isMalicious": true,
  "isBot": true,
  "activityType": "Automated Scanning",
  "attackTypes": [
    "Port Scan",
    "Brute Force",
    "Web Application Attack"
  ],
  "summary": "This IP has been widely reported for automated scanning and brute force attacks across multiple networks. Community reports indicate persistent malicious behavior with high confidence.",
  "riskFactors": [
    "High AbuseIPDB confidence score (95%)",
    "Known Tor exit node",
    "Over 500 community abuse reports"
  ],
  "botVsHumanAnalysis": "Traffic patterns are consistent with automated scanning tools. High request frequency with systematic port enumeration indicates bot-driven activity.",
  "abuseipdb": {
    "abuseConfidenceScore": 95,
    "countryCode": "DE",
    "countryName": "Germany",
    "domain": "torproject.org",
    "isp": "Tor Exit Node",
    "usageType": "Hosting/Transit/CDN",
    "totalReports": 543,
    "lastReportedAt": "2026-03-13T10:30:00Z",
    "recentReports": [
      {
        "reportedAt": "2026-03-13T10:30:00Z",
        "categories": [14, 15],
        "comment": "Port scan and SSH brute force attempts"
      }
    ]
  },
  "sources": ["abuseipdb", "securenow-internal", "securenow-ai"],
  "lastUpdatedAt": "2026-03-13T12:00:00Z"
}

Response Fields

Field	Type	Description
ip	string	The queried IP address
securenowScore	number	Composite threat score (0-100). Higher = more dangerous.
verdict	string	AI-generated verdict (e.g. 'Malicious - Automated Scanner', 'Clean')
isMalicious	boolean	Whether the IP is deemed malicious
isBot	boolean \| null	Whether the activity is automated/bot-driven
activityType	string	Type of activity (e.g. 'Automated Scanning', 'Brute Force', 'Normal Traffic')
attackTypes	string[]	Array of attack categories observed
summary	string	AI-generated summary (anonymized, no sensitive data)
riskFactors	string[]	List of risk factors contributing to the score
botVsHumanAnalysis	string	AI analysis of bot vs human traffic patterns
abuseipdb	object	AbuseIPDB data (confidence, geo, ISP, reports)
sources	string[]	Data sources used (abuseipdb, securenow-internal, securenow-ai)
lastUpdatedAt	string	ISO timestamp of last data refresh

Error Responses

400 Bad Request

json

{ "error": "Only IPv4 addresses are currently supported" }

429 Too Many Requests

json

{ "error": "Rate limit exceeded. Max 10 requests per minute.", "retryAfter": 60 }

500 Internal Server Error

json

{ "error": "Failed to fetch IP intelligence" }

Code Examples

cURL

bash

curl -s "https://api.securenow.ai/api/public/ip-intel/185.220.101.1" | jq .

JavaScript (fetch)

javascript

const ip = "185.220.101.1";

const res = await fetch(`https://api.securenow.ai/api/public/ip-intel/${ip}`);
const data = await res.json();

console.log(`SecureNow Score: ${data.securenowScore}/100`);
console.log(`Verdict: ${data.verdict}`);
console.log(`Is Bot: ${data.isBot}`);
console.log(`Attack Types: ${data.attackTypes.join(", ")}`);

if (data.securenowScore > 70) {
  console.log("HIGH RISK — consider blocking this IP");
}

Python

python

import requests

ip = "185.220.101.1"
url = f"https://api.securenow.ai/api/public/ip-intel/{ip}"

response = requests.get(url)
data = response.json()

print(f"SecureNow Score: {data['securenowScore']}/100")
print(f"Verdict: {data['verdict']}")
print(f"Is Bot: {data['isBot']}")
print(f"Attack Types: {', '.join(data['attackTypes'])}")

if data["securenowScore"] > 70:
    print("HIGH RISK — consider blocking this IP")

Go

package main

import (
    "encoding/json"
    "fmt"
    "net/http"
)

type IpIntel struct {
    IP             string   `json:"ip"`
    SecurenowScore int      `json:"securenowScore"`
    Verdict        string   `json:"verdict"`
    IsMalicious    bool     `json:"isMalicious"`
    IsBot          *bool    `json:"isBot"`
    AttackTypes    []string `json:"attackTypes"`
}

func main() {
    resp, _ := http.Get("https://api.securenow.ai/api/public/ip-intel/185.220.101.1")
    defer resp.Body.Close()

    var data IpIntel
    json.NewDecoder(resp.Body).Decode(&data)

    fmt.Printf("SecureNow Score: %d/100\n", data.SecurenowScore)
    fmt.Printf("Verdict: %s\n", data.Verdict)
}

Common Use Cases

Firewall Integration

Query the API on each incoming request to enrich your firewall rules with real-time threat intelligence.

SIEM Enrichment

Pipe IPs from your SIEM alerts through the API to automatically classify and score threats.

Bot Detection

Use the isBot and botVsHumanAnalysis fields to distinguish automated traffic from legitimate users.

Incident Response

During an incident, quickly assess whether an attacking IP is a known threat with attack type classification.

Need higher rate limits?

SecureNow's full platform provides unlimited IP lookups, real-time alerting, automated blocking, and detailed forensics.

Get Started Free

Terms of Use

This API is provided as-is with no guarantee of uptime or accuracy.
Data is aggregated from AbuseIPDB and SecureNow's internal intelligence.
Do not use this API for any illegal activities.
We reserve the right to revoke access for abuse or excessive usage.
Please respect rate limits to ensure fair access for all users.