Batch size by plan
10 items per call on Free, 50 on Basic, 100 on Pro, 500 on Enterprise.
Threat Intelligence
Bulk Check Mixed indicators, one API call.
Send domains, IPs, URLs and hashes in one request: 10 per call on Free, 100 on Pro, 500 on Enterprise.
No credit card required · Free API key
By the numbers
The dataset behind each item
Each item is looked up in the same database as a single lookup.
Current data sample
public samplepublic sample
30 014 020
Total threats
20 474 358
Malicious domains
9 539 662
Malicious IPs
591
Sources in the corpus
By the numbersUpdated Oct 16, 15:29 UTC · Counters read at 2026-10-16T18:46:44.974Z. Indicator dates vary by source.public sample
Create free account
No credit card required · Free: a 10% sample of each list · full lists on paid plans
- Items per request (Pro)
- 100
- Pro requests per month
- 10K
- Pro burst limit
- 60/min
- Indicator types: IP, domain, URL, hash
- 4
Capabilities
Key features at a glance.
JSON in, JSON or CSV out
Send a JSON array of entities; get results back as JSON or CSV.
Mixed types
IPs, domains, URLs and hashes in one request, each type detected automatically.
Full results
Score, risk level, categories, source count and recommended action for each item.
Large jobs
Split long lists across calls within your per-minute and monthly limits.
Clean input
Duplicate and invalid entries are skipped and reported in the response.
Applications
Use cases to evaluate first.
Log enrichment
Enrich SIEM logs with threat data in bulk.
List validation
Validate blocklists and allowlists against threat intel.
Incident response
Check a set of IOCs during an investigation.
Email gateway
Check sender domains and URLs from email batches.
FAQ
Frequently asked questions.
How many items can I check at once?
Free: 10 per request. Basic: 50. Pro: 100. Enterprise: 500. Larger jobs are split across requests and count against your monthly quota.
What formats do you accept?
The request body is a JSON array of entities. Results come back as JSON, or as CSV when format is set to csv.
How fast is bulk processing?
It depends on batch size and enrichment. Each response reports its processing time; for large datasets, send parallel requests within your limits.
Can I mix domains and IPs in one request?
Yes. The bulk API detects the type of each item and routes it to the matching lookup.
Explore
Related tools and pages.
Research
Related articles from the research blog.
Blog post
Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume
One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Read more
Blog post
API Integration for Threat Intelligence: Automate Your Security
Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.
Read more
Blog post
Hash Reputation at Scale: Building Detection Rules That Survive Real Networks
Move beyond one-off hash blocks: design reputation pipelines, reduce false positives, and integrate file intelligence with IP and domain context for production-ready detection engineering.
Read moreTest it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key