IP addresses | VirusSign API Documentation

This reference covers the indicator object in a lookup response. See request parameters, response metadata and response conventions. Pro fields provide additional context where available; compact views contain fewer fields.

Fields are conditional unless stated otherwise. Types below describe populated values; optional values may also be null. Access labels describe capability, not guaranteed data for every indicator.

IP fields

indicator

Fields in indicator
Field	Type	Meaning
`type`	string	IP record.
`value`	string	Canonical indicator value. File records normally use SHA-256; URL records use an opaque identifier.
`analysis`	object	Threat assessment. Field reference →
`first_seen`	string	First observation time. ISO 8601 timestamp with timezone.
`last_seen`	string	Latest observation time. ISO 8601 timestamp with timezone.
`tags`	array<string>	Descriptive indicator labels.
`crowd_context`	object · Pro	Community and actor context, where available. Field reference →
`relations`	object	Related object groups when requested with full+relations and authorized. See Relationships. Field reference →
`version`	string	IP version.
`country`	string · Basic	Country code or label.
`is_public`	boolean · Pro	Whether the address is globally routable.
`cidr`	string · Pro	Associated network in CIDR notation.
`network_range`	string · Pro	Associated start–end address range.

indicator.contextobject

Context for an object returned through a relationship.

Fields in indicator.context
Field	Type	Meaning
`relationship`	string	Relationship connecting this object to the source indicator.

indicator.linksobject

Optional navigation links.

Fields in indicator.links
Field	Type	Meaning
`self`	string	Canonical resource link, when provided.

Network context

indicator.locationobject · Pro

Approximate IP geolocation.

Fields in indicator.location
Field	Type	Meaning
`latitude`	number	Approximate latitude.
`longitude`	number	Approximate longitude.
`region`	string	Region label.
`country`	string	Country code or label.
`administrative_area`	string	State, province or administrative area.
`city`	string	City label.
`continent`	string	Continent label.

indicator.ownershipobject · Pro

Network ownership and classification.

Fields in indicator.ownership
Field	Type	Meaning
`asn`	integer / string	Autonomous System Number (ASN).
`as_owner`	string	Autonomous system owner.
`isp`	string	Internet service provider.
`organization`	string	Associated organization.
`hosting_provider`	string	Hosting provider label.
`network_type`	string	Network category, such as residential, mobile or datacenter.
`network_type_confidence`	string	Qualitative network-classification confidence label, not a numeric percentage.

indicator.servicesobject · Pro

Observed network services.

Fields in indicator.services
Field	Type	Meaning
`open_ports`	array<integer>	Observed open ports.
`protocols`	array<string>	Observed protocols.
`banners`	array<string>	Observed service banners.

indicator.services.services[]array<object> · Pro

Observed service names and versions.

Fields in indicator.services.services[]
Field	Type	Meaning
`name`	string	Service name.
`version`	string	Observed service version.

indicator.whois_infoobject · Pro

Common network registration attributes. Fields vary by record and may contain one value or multiple values; additional keys may be present.

Fields in indicator.whois_info
Field	Type	Meaning
`network_range`	string / array	Registered network address range.
`cidr`	string / array	Registered network in CIDR notation.
`net_name`	string / array	Registered network name.
`organization`	string / array	Registered organization name or names.
`country`	string / array	Country recorded in the registration; distinct from IP geolocation.
`origin_as`	string / array	Origin autonomous system identifier.
`status`	string / array	Registration status label or labels.
`registered_at`	string / array	Registration date or dates as recorded.
`updated_at`	string / array	Registration update date or dates as recorded.
`address`	string / array	Registration contact address.
`phone`	string / array	Registration contact telephone number or numbers.

DNS observations

indicator

Fields in indicator
Field	Type	Meaning
`dns_resolutions`	array<string> · Pro	Associated DNS names.
`reverse_dns`	array<string> · Pro	Reverse DNS names.
`hostnames`	array<string> · Pro	Associated hostnames.

indicator.passive_dns[]array<object> · Pro

Passive DNS observations.

Fields in indicator.passive_dns[]
Field	Type	Meaning
`hostname`	string	Observed hostname.
`resolved_ip`	string	Resolved IP address.
`record_type`	string	DNS record type.
`first_seen`	string	First observation time. ISO 8601 timestamp with timezone.
`last_seen`	string	Latest observation time. ISO 8601 timestamp with timezone.
`source`	string	Observation category label.

Certificates

indicator.ssl_certificates[]array<object> · Pro

TLS certificate summaries.

Fields in indicator.ssl_certificates[]
Field	Type	Meaning
`issuer`	object	Issuer distinguished-name attributes, such as CN, O and C.
`subject`	object	Subject distinguished-name attributes, such as CN, O and C.
`validity`	string	Certificate validity range as a display string. For individual date fields, see certificate relationship records.
`tls_certificate_fingerprints`	array<string>	Certificate fingerprints.

Illustrative response

Illustrative data showing the response structure. Optional fields may be omitted.

JSON · illustrative ip addresses

{
  "meta": {
    "request_id": "example-request",
    "timestamp": "2026-01-15T12:00:00Z",
    "quota_remaining": 100,
    "took_ms": 12
  },
  "indicator": {
    "type": "ip",
    "value": "192.0.2.10",
    "version": "v4",
    "analysis": {
      "malicious": true,
      "severity": "medium",
      "confidence": 60,
      "detections": "28/32",
      "family": "ExampleFamily",
      "has_actor": false
    },
    "first_seen": "2026-01-15T12:00:00Z",
    "last_seen": "2026-01-15T12:00:00Z",
    "whois_info": {
      "cidr": "192.0.2.0/24",
      "net_name": "EXAMPLE-NET",
      "organization": [
        "Example Research Network"
      ],
      "country": [
        "CA"
      ],
      "registered_at": [
        "2025-06-10T00:00:00Z"
      ]
    },
    "services": {
      "open_ports": [
        443
      ],
      "protocols": [
        "https"
      ],
      "services": [
        {
          "name": "https"
        }
      ]
    },
    "passive_dns": [
      {
        "hostname": "beacon.example",
        "resolved_ip": "192.0.2.10",
        "record_type": "A",
        "first_seen": "2026-01-15T12:00:00Z",
        "last_seen": "2026-01-15T12:00:00Z"
      }
    ]
  }
}

Appearance

IP intelligence

Search results

IP fields

Network context

DNS observations

Certificates

Illustrative response

A quick security check