IP Check

GET /v1/key/check/{ip} · Back to Overview

Endpoint

GET/v1/key/check/{ip}

Look up reputation data for an IPv4 or IPv6 address. Returns sensor-observed activity, contributor-reported data, and geolocation.

If the IP has no recorded activity, the response still returns HTTP 200 with found: false, confidenceLevel: 0, and geolocation data. Empty arrays are returned for protocols, behaviors, and primitives.

Request

curl "https://api.sikkerapi.com/v1/key/check/203.0.113.42" \
  -H "Authorization: Bearer sk_free_..."

import requests

response = requests.get(
    "https://api.sikkerapi.com/v1/key/check/203.0.113.42",
    headers={"Authorization": "Bearer sk_free_..."}
)

data = response.json()
print(f"Confidence: {data['confidenceLevel']}")

const response = await fetch(
  "https://api.sikkerapi.com/v1/key/check/203.0.113.42",
  {
    headers: {
      "Authorization": "Bearer sk_free_..."
    }
  }
);

const data = await response.json();
console.log(`Confidence: ${data.confidenceLevel}`);

<?php
$ch = curl_init("https://api.sikkerapi.com/v1/key/check/203.0.113.42");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_..."
    ]
]);

$response = curl_exec($ch);
$data = json_decode($response, true);
echo "Confidence: " . $data['confidenceLevel'];

package main

import (
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    req, _ := http.NewRequest("GET",
        "https://api.sikkerapi.com/v1/key/check/203.0.113.42", nil)
    req.Header.Set("Authorization", "Bearer sk_free_...")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var data map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&data)
    fmt.Printf("Confidence: %v\n", data["confidenceLevel"])
}

import java.net.http.*;
import java.net.URI;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.sikkerapi.com/v1/key/check/203.0.113.42"))
    .header("Authorization", "Bearer sk_free_...")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "sk_free_...");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/v1/key/check/203.0.113.42");
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(content);

import java.net.http.*
import java.net.URI

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.sikkerapi.com/v1/key/check/203.0.113.42"))
    .header("Authorization", "Bearer sk_free_...")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())
println(response.body())

require 'net/http'
require 'json'

uri = URI("https://api.sikkerapi.com/v1/key/check/203.0.113.42")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sk_free_..."

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

data = JSON.parse(response.body)
puts "Confidence: #{data['confidenceLevel']}"

use reqwest::header::{AUTHORIZATION, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, "Bearer sk_free_...".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/v1/key/check/203.0.113.42")
        .headers(headers)
        .send()
        .await?
        .json::<serde_json::Value>()
        .await?;

    println!("Confidence: {}", resp["confidenceLevel"]);
    Ok(())
}

Query Parameters

All parameters are optional. When omitted, the full response is returned with descriptions included.

Parameter	Type	Description
maxAge	integer	Only return data if the IP was last seen or reported within this many days. Range: 1-365.
exclude	string	Comma-separated sections to exclude: sensor, contributor.
verbose	boolean	Set to false to strip description fields from behaviors and primitives. Default: true.
protocols	string	Comma-separated protocol filter. Only include data for these protocols (e.g. ssh,http).
ignoreWhitelist	boolean	If true, returns the raw confidence level without whitelist discounting. Use this to see the undiscounted score for known-benign scanners (e.g. Googlebot, Censys). Default: false.

With parameters

curl "https://api.sikkerapi.com/v1/key/check/203.0.113.42?maxAge=7&verbose=false&protocols=ssh" \
  -H "Authorization: Bearer sk_free_..."

import requests

response = requests.get(
    "https://api.sikkerapi.com/v1/key/check/203.0.113.42",
    headers={"Authorization": "Bearer sk_free_..."},
    params={
        "maxAge": 7,
        "verbose": "false",
        "protocols": "ssh"
    }
)

data = response.json()

const params = new URLSearchParams({
  maxAge: "7",
  verbose: "false",
  protocols: "ssh"
});

const response = await fetch(
  `https://api.sikkerapi.com/v1/key/check/203.0.113.42?${params}`,
  {
    headers: {
      "Authorization": "Bearer sk_free_..."
    }
  }
);

const data = await response.json();

<?php
$params = http_build_query([
    'maxAge' => 7,
    'verbose' => 'false',
    'protocols' => 'ssh'
]);

$ch = curl_init("https://api.sikkerapi.com/v1/key/check/203.0.113.42?" . $params);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_..."
    ]
]);

$response = curl_exec($ch);
$data = json_decode($response, true);

package main

import (
    "encoding/json"
    "net/http"
    "net/url"
)

func main() {
    baseURL := "https://api.sikkerapi.com/v1/key/check/203.0.113.42"
    params := url.Values{}
    params.Add("maxAge", "7")
    params.Add("verbose", "false")
    params.Add("protocols", "ssh")

    req, _ := http.NewRequest("GET", baseURL+"?"+params.Encode(), nil)
    req.Header.Set("Authorization", "Bearer sk_free_...")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var data map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&data)
}

import java.net.http.*;
import java.net.URI;

String url = "https://api.sikkerapi.com/v1/key/check/203.0.113.42" +
    "?maxAge=7&verbose=false&protocols=ssh";

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(url))
    .header("Authorization", "Bearer sk_free_...")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "sk_free_...");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/v1/key/check/203.0.113.42" +
    "?maxAge=7&verbose=false&protocols=ssh");

import java.net.http.*
import java.net.URI

val url = "https://api.sikkerapi.com/v1/key/check/203.0.113.42" +
    "?maxAge=7&verbose=false&protocols=ssh"

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create(url))
    .header("Authorization", "Bearer sk_free_...")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())

require 'net/http'

uri = URI("https://api.sikkerapi.com/v1/key/check/203.0.113.42")
uri.query = URI.encode_www_form(
  maxAge: 7, verbose: "false", protocols: "ssh"
)

request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sk_free_..."

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

use reqwest::header::{AUTHORIZATION, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, "Bearer sk_free_...".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/v1/key/check/203.0.113.42")
        .query(&[("maxAge", "7"), ("verbose", "false"), ("protocols", "ssh")])
        .headers(headers)
        .send()
        .await?;

    Ok(())
}

Exclude contributor data

curl "https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor" \
  -H "Authorization: Bearer sk_free_..."

import requests

response = requests.get(
    "https://api.sikkerapi.com/v1/key/check/203.0.113.42",
    headers={"Authorization": "Bearer sk_free_..."},
    params={"exclude": "contributor"}
)

const response = await fetch(
  "https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor",
  {
    headers: {
      "Authorization": "Bearer sk_free_..."
    }
  }
);

<?php
$ch = curl_init("https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_..."
    ]
]);

$response = curl_exec($ch);

package main

import (
    "net/http"
)

func main() {
    req, _ := http.NewRequest("GET",
        "https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor", nil)
    req.Header.Set("Authorization", "Bearer sk_free_...")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()
}

import java.net.http.*;
import java.net.URI;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor"))
    .header("Authorization", "Bearer sk_free_...")
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "sk_free_...");

var response = await client.GetAsync(
    "https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor");

import java.net.http.*
import java.net.URI

val client = HttpClient.newHttpClient()
val request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor"))
    .header("Authorization", "Bearer sk_free_...")
    .build()

val response = client.send(request, HttpResponse.BodyHandlers.ofString())

require 'net/http'

uri = URI("https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sk_free_..."

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

use reqwest::header::{AUTHORIZATION, HeaderMap};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, "Bearer sk_free_...".parse()?);

    let client = reqwest::Client::new();
    let resp = client
        .get("https://api.sikkerapi.com/v1/key/check/203.0.113.42?exclude=contributor")
        .headers(headers)
        .send()
        .await?;

    Ok(())
}

Response

Top-level fields

Field	Type	Description
ip	string	The queried IP address.
confidenceLevel	integer	Confidence level (0-100). Includes whitelist discounting by default. Pass ignoreWhitelist=true for the raw score.
geo	object?	Geolocation data. Null if unavailable.
firstSeen	long?	First sensor observation (epoch ms).
lastSeen	long?	Most recent sensor observation (epoch ms).
totalSessions	integer	Total honeypot sessions.
totalEvents	integer	Total events across all sessions.
protocols	array	Activity breakdown by protocol.
behaviors	array	Classified attack patterns detected.
primitives	array	Atomic suspicious indicators matched.
contributor	object?	Community-reported data. Null if no reports.

geo

Field	Type	Description
countryCode	string?	ISO 3166-1 alpha-2 code.
countryName	string?	Full country name.
city	string?	City name.
asn	string?	Autonomous System Number.
asnOrg	string?	ASN organization name.
isTor	boolean	Whether this IP is a known Tor exit node.
isProxy	boolean	Whether this IP is a known anonymous proxy or VPN.

protocols[]

Field	Type	Description
protocol	string	Protocol name (e.g. ssh, http, ftp).
sessions	integer	Sessions on this protocol.
events	integer	Events on this protocol.

behaviors[]

Field	Type	Description
name	string	Behavior identifier (e.g. credential_stuffing).
severity	string	critical, high, medium, or low.
count	integer	Sessions where this behavior was detected.
protocol	string?	Protocol where this behavior was observed (e.g. ssh, http).
description	string?	Human-readable explanation. Omitted when verbose=false.

primitives[]

Field	Type	Description
name	string	Primitive identifier (e.g. wget_download).
count	integer	Sessions where this primitive was matched.
protocol	string?	Protocol where this primitive was observed (e.g. ssh, http).
description	string?	Human-readable explanation. Omitted when verbose=false.

contributor

Field	Type	Description
totalReports	integer	Total reports submitted for this IP.
uniqueReporters	integer	Distinct users who reported this IP.
categories	object	Report categories as {category_id: count}.
protocols	object	Reported protocols as {protocol: count}.
firstReportedAt	long?	First report timestamp (epoch ms).
lastReportedAt	long?	Most recent report timestamp (epoch ms).
reports	array?	Individual report details (max 25). Each contains category, categoryName, protocol, comment, and reportedAt.

200 - Found

{
  "ip": "203.0.113.42",
  "confidenceLevel": 78,
  "geo": {
    "countryCode": "US",
    "countryName": "United States",
    "city": "New York",
    "asn": "AS12345",
    "asnOrg": "Example ISP",
    "isTor": false,
    "isProxy": false
  },
  "firstSeen": 1705312425000,
  "lastSeen": 1706108532000,
  "totalSessions": 45,
  "totalEvents": 1250,
  "protocols": [
    { "protocol": "ssh", "sessions": 15, "events": 650 },
    { "protocol": "http", "sessions": 30, "events": 600 }
  ],
  "behaviors": [
    {
      "name": "credential_stuffing",
      "severity": "high",
      "count": 12,
      "protocol": "ssh",
      "description": "Multiple login attempts..."
    }
  ],
  "primitives": [
    {
      "name": "wget_download",
      "count": 5,
      "protocol": "ssh",
      "description": "wget used to fetch..."
    }
  ],
  "contributor": {
    "totalReports": 8,
    "uniqueReporters": 3,
    "categories": { "1": 5, "3": 3 },
    "protocols": { "ssh": 6, "http": 2 },
    "firstReportedAt": 1705400000000,
    "lastReportedAt": 1706100000000,
    "reports": [
      {
        "category": 1,
        "categoryName": "brute_force",
        "protocol": "ssh",
        "comment": "Multiple failed logins",
        "reportedAt": 1706100000000
      }
    ]
  }
}

200 - Not Found

{
  "ip": "203.0.113.42",
  "found": false,
  "confidenceLevel": 0,
  "geolocation": {
    "countryCode": "US",
    "countryName": "United States",
    "city": "New York",
    "asn": "AS12345",
    "asnOrg": "Example ISP",
    "isTor": false,
    "isProxy": false
  },
  "firstSeen": null,
  "lastSeen": null,
  "totalSessions": 0,
  "totalEvents": 0,
  "protocols": [],
  "behaviors": [],
  "primitives": [],
  "contributor": null
}

Get started — Create a free API key and start checking IPs in under a minute. Free tier includes 1,000 lookups per day. Create free API key →