Choose Basic for everyday lookups or Pro for deeper investigation, with more monthly credits on Plus plans.
Core indicator intelligence for everyday lookups and API enrichment.
Monthly credits
10,000 credits / month
The same Basic intelligence, with more credits for regular research.
Monthly credits
30,000 credits / month
Enriched IOC profiles and behavioral evidence for deeper investigations.
Monthly credits
10,000 credits / month
The same Pro intelligence, with more credits for larger workflows.
Monthly credits
40,000 credits / month
Pro supports the same core IOC lookups and adds enriched context. Response fields and structure can differ between tiers. Actor context, behavior mappings and evidence depend on the intelligence available for each indicator.
Flexible API volumes, intelligence feeds and dedicated datasets for security teams and businesses.
Basic Plus includes the same permissions as Basic; Pro Plus includes the same permissions as Pro. Plus increases the monthly credits. Relationship queries are included in all four paid plans.
| API capability | Basic | Pro |
|---|---|---|
| Indicator profile | Core identity & attributes | Enriched file, network & web profiles |
| Threat assessment | Verdict, severity, confidence & family | Verdict, severity, confidence & family |
| Detection signals | Numeric detection percentage | Detection ratio |
| Related intelligence | Related objects with cursor pagination | Related objects with cursor pagination |
| File analysis | Hashes, names, type & size | PE structure, imports, exports & signing information |
| Network & web context | IP country, domain TLD & URL host | Ownership, DNS, WHOIS, certificates & HTTP details |
| Observed file behavior | Not included | Behavior evidence, MITRE ATT&CK, MBC & C2 candidates |
| APT / Actor context | Not included | Reported associations & supporting context |
| Structured output | JSON with core IOC data | JSON with enriched IOC data |
Representative fields for full IOC responses are listed below. Field names and structure can differ between Basic and Pro; compact views request reduced detail where supported.
Both tiers also include website access. Website reports provide a focused view of the intelligence; their field summaries and display counts do not define the API response.
Fields depend on the indicator, available intelligence, response view and account filtering. DNS and service observations do not imply complete historical coverage or an active scan. See the API documentation for requests, pagination and credit usage.
No. When online subscriptions are available, you can purchase directly using the links above. If you already have a key, use the same account email so we can match your purchase. Contact us if your payment email differs. Never send your API key in a payment note.
Yes. We confirm the account and adjust its access after verifying your purchase. If you already have a paid subscription, contact us first to arrange a plan change and avoid duplicate subscriptions.
Website investigations and API requests share your credits. At the standard rate, an IOC lookup costs 1 credit, plus 1 credit per started block of 20 requested relationships. With relationship access enabled, a website lookup normally costs 2 credits for either Basic or Pro (limit 20). Fewer displayed results do not reduce that charge. Standalone relationship requests are charged by their requested page size. See the API documentation for usage details.
Feeds, malware samples, historical datasets and bulk raw-data redistribution need separate arrangements. Paid API plans support research, internal business use, software/SaaS integration and MSSP services, including displaying intelligence to your customers. Sharing or reselling API keys and reselling standalone data access require a separate agreement.
Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.
