IPQualityScore
This Integration is part of the IPQualityScore (IPQS) Threat Risk Scoring Pack.#
Supported versions
Available on Cortex XSOAR and Cortex XSIAM.
Overview#
IPQualityScore (IPQS) provides enterprise-grade real-time threat intelligence for IP addresses, email addresses, URLs, phone numbers, and files. Detect fraud, phishing, malware, leaked credentials, and abusive behavior using IPQS's global threat network.
This integration was integrated and tested with version 1.0 of IPQualityScore.
Getting an API Key#
- Register for a free account at https://www.ipqualityscore.com/create-account. Free accounts include 5,000 API lookups per month.
- After registering, log in and visit https://www.ipqualityscore.com/documentation/proxy-detection/overview. Your API key is listed under the Private Key subheading.
Configure IPQualityScore in Cortex#
| Parameter | Description | Required |
|---|---|---|
| API Key | Your IPQS private API key. | True |
| Trust any certificate (not secure) | Skip SSL certificate verification. | False |
| Use system proxy settings | Route requests through the system proxy. | False |
| IP Suspicious Score Threshold | Threshold for fraud score from IP lookup to be marked as suspicious. | False |
| IP Malicious Score Threshold | Threshold for fraud score from IP lookup to be marked as malicious. | False |
| Email Suspicious Score Threshold | Threshold for fraud score from Email lookup to be marked as suspicious. | False |
| Email Malicious Score Threshold | Threshold for fraud score from Email lookup to be marked as malicious. | False |
| Url Suspicious Score Threshold | Threshold for fraud score from Url lookup to be marked as suspicious. | False |
| Url Malicious Score Threshold | Threshold for fraud score from Url lookup to be marked as malicious. | False |
| Phone Suspicious Score Threshold | Threshold for fraud score from Phone lookup to be marked as suspicious. | False |
| Phone Malicious Score Threshold | Threshold for fraud score from Phone lookup to be marked as malicious. | False |
| Source Reliability | Reliability of the source providing the intelligence data. | True |
Commands#
You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
ipqs-ip-reputation#
Runs reputation on IPs.
Base Command#
ipqs-ip-reputation
Input#
| Argument Name | Description | Required |
|---|---|---|
| ip | IP address(es) to check. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.IP.success | Boolean | Was the request successful? |
| IPQualityScore.IP.message | String | A generic status message, either success or some form of an error notice. |
| IPQualityScore.IP.fraud_score | Number | The overall fraud score of the user based on the IP, user agent, language, and any other optionally passed variables. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent. We recommend flagging or blocking traffic with Fraud Scores >= 85, but you may find it beneficial to use a higher or lower threshold. |
| IPQualityScore.IP.country_code | String | Two character country code of IP address or "N/A" if unknown. |
| IPQualityScore.IP.region | String | Region (state) of IP address if available or "N/A" if unknown. |
| IPQualityScore.IP.city | String | City of IP address if available or "N/A" if unknown. |
| IPQualityScore.IP.ISP | String | ISP if one is known. Otherwise "N/A". |
| IPQualityScore.IP.ASN | Number | Autonomous System Number if one is known. Null if nonexistent. |
| IPQualityScore.IP.organization | String | Organization if one is known. Can be parent company or sub company of the listed ISP. Otherwise "N/A". |
| IPQualityScore.IP.latitude | Number | Latitude of IP address if available or "N/A" if unknown. |
| IPQualityScore.IP.longitude | Number | Longitude of IP address if available or "N/A" if unknown. |
| IPQualityScore.IP.is_crawler | Boolean | Is this IP associated with being a confirmed crawler from a mainstream search engine such as Googlebot, Bingbot, Yandex, etc. based on hostname or IP address verification. |
| IPQualityScore.IP.timezone | String | Timezone of IP address if available or "N/A" if unknown. |
| IPQualityScore.IP.mobile | Boolean | Is this user agent a mobile browser? (will always be false if the user agent is not passed in the API request) |
| IPQualityScore.IP.host | String | Hostname of the IP address if one is available. |
| IPQualityScore.IP.proxy | Boolean | Is this IP address suspected to be a proxy? (SOCKS, Elite, Anonymous, VPN, Tor, etc.) |
| IPQualityScore.IP.vpn | Boolean | Is this IP suspected of being a VPN connection? This can include data center ranges which can become active VPNs at any time. The "proxy" status will always be true when this value is true. |
| IPQualityScore.IP.tor | Boolean | Is this IP suspected of being a TOR connection? This can include previously active TOR nodes and exits which can become active TOR exits at any time. The "proxy" status will always be true when this value is true. |
| IPQualityScore.IP.active_vpn | Boolean | Premium Account Feature - Identifies active VPN connections used by popular VPN services and private VPN servers. |
| IPQualityScore.IP.active_tor | Boolean | Premium Account Feature - Identifies active TOR exits on the TOR network. |
| IPQualityScore.IP.recent_abuse | Boolean | This value will indicate if there has been any recently verified abuse across our network for this IP address. Abuse could be a confirmed chargeback, compromised device, fake app install, or similar malicious behavior within the past few days. |
| IPQualityScore.IP.bot_status | Boolean | Premium Account Feature - Indicates if bots or non-human traffic has recently used this IP address to engage in automated fraudulent behavior. Provides stronger confidence that the IP address is suspicious. |
| IPQualityScore.IP.connection_type | String | Classification of the IP address connection type as "Residential", "Corporate", "Education", "Mobile", or "Data Center". |
| IPQualityScore.IP.abuse_velocity | String | Premium Account Feature - How frequently the IP address is engaging in abuse across the IPQS threat network. Values can be "high", "medium", "low", or "none". Can be used in combination with the Fraud Score to identify bad behavior. |
| IPQualityScore.IP.request_id | String | A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice. |
| IPQualityScore.IP.address | String | The IP address that was queried. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| IP.Address | string | IP address |
| IP.ASN | string | The autonomous system name for the IP address, for example: "AS8948". |
| IP.Hostname | string | The hostname that is mapped to this IP address. |
| IP.Geo.Country | string | The country in which the IP address is located. |
| IP.Geo.Description | string | Additional information about the location. |
| IP.Malicious.Vendor | string | The vendor reporting the IP address as malicious. |
| IP.Malicious.Description | string | A description explaining why the IP address was reported as malicious. |
Command Example#
!ipqs-ip-reputation ip="8.8.8.8"
Context Example#
Human Readable Output#
IPQualityScore Results for 8.8.8.8#
success message fraud_score country_code region city ISP ASN organization latitude longitude is_crawler timezone mobile host proxy vpn tor active_vpn active_tor recent_abuse bot_status connection_type abuse_velocity request_id address true Success 100 US California Mountain View 15169 37.39 -122.07 false America/Los_Angeles false dns.google true true false false false true true Data Center high 4DpK9WpOZGPFSPg 8.8.8.8
ip#
Deprecated. Use ipqs-ip-reputation instead.
Base Command#
ip
Input#
| Argument Name | Description | Required |
|---|---|---|
| ip | IP address(es) to check. Supports comma-separated list. | Required |
Command Example#
!ip ip="8.8.8.8"
ipqs-email-reputation#
Runs reputation on email addresses.
Base Command#
ipqs-email-reputation
Input#
| Argument Name | Description | Required |
|---|---|---|
| Email address(es) to check. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.Email.message | String | A generic status message, either success or some form of an error notice. |
| IPQualityScore.Email.success | Boolean | Was the request successful? |
| IPQualityScore.Email.valid | Boolean | Does this email address appear valid? |
| IPQualityScore.Email.disposable | Boolean | Is this email suspected of belonging to a temporary or disposable mail service? Usually associated with fraudsters and scammers. |
| IPQualityScore.Email.smtp_score | Number | Validity score of email server's SMTP setup. Range: "-1" - "3". Scores above "-1" can be associated with a valid email. -1 = invalid email address 0 = mail server exists, but is rejecting all mail 1 = mail server exists, but is showing a temporary error 2 = mail server exists, but accepts all email 3 = mail server exists and has verified the email address |
| IPQualityScore.Email.overall_score | Number | Overall email validity score. Range: "0" - "4". Scores above "1" can be associated with a valid email. 0 = invalid email address 1 = dns valid, unreachable mail server 2 = dns valid, temporary mail rejection error 3 = dns valid, accepts all mail 4 = dns valid, verified email exists |
| IPQualityScore.Email.first_name | String | Suspected first name based on email. Returns "CORPORATE" if the email is suspected of being a generic company email. Returns "UNKNOWN" if the first name was not determinable. |
| IPQualityScore.Email.generic | Boolean | Is this email suspected as being a catch all or shared email for a domain? ("admin@", "webmaster@", "newsletter@", "sales@", "contact@", etc.) |
| IPQualityScore.Email.common | Boolean | Is this email from a common email provider? ("gmail.com", "yahoo.com", "hotmail.com", etc.) |
| IPQualityScore.Email.dns_valid | Boolean | Does the email's hostname have valid DNS entries? Partial indication of a valid email. |
| IPQualityScore.Email.honeypot | Boolean | Is this email believed to be a "honeypot" or "SPAM trap"? Bulk mail sent to these emails increases your risk of being added to block lists by large ISPs & ending up in the spam folder. |
| IPQualityScore.Email.deliverability | String | How likely is this email to be delivered to the user and land in their mailbox. Values can be "high", "medium", or "low". |
| IPQualityScore.Email.frequent_complainer | Boolean | Indicates if this email frequently unsubscribes from marketing lists or reports email as SPAM. |
| IPQualityScore.Email.spam_trap_score | String | Confidence level of the email address being an active SPAM trap. Values can be "high", "medium", "low", or "none". We recommend scrubbing emails with "high" or "medium" statuses. Avoid "low" emails whenever possible for any promotional mailings. |
| IPQualityScore.Email.catch_all | Boolean | Is this email likely to be a "catch all" where the mail server verifies all emails tested against it as valid? It is difficult to determine if the address is truly valid in these scenarios, since the email's server will not confirm the account's status. |
| IPQualityScore.Email.timed_out | Boolean | Did the connection to the mail service provider timeout during the verification? If so, we recommend increasing the "timeout" variable above the default 7 second value. Lookups that timeout with a "valid" result as false are most likely false and should be not be trusted. |
| IPQualityScore.Email.suspect | Boolean | This value indicates if the mail server is currently replying with a temporary error and unable to verify the email address. This status will also be true for "catch all" email addresses as defined below. If this value is true, then we suspect the "valid" result may be tainted and there is not a guarantee that the email address is truly valid. |
| IPQualityScore.Email.recent_abuse | Boolean | This value will indicate if there has been any recently verified abuse across our network for this email address. Abuse could be a confirmed chargeback, fake signup, compromised device, fake app install, or similar malicious behavior within the past few days. |
| IPQualityScore.Email.fraud_score | Number | The overall Fraud Score of the user based on the email's reputation and recent behavior across the IPQS threat network. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent. |
| IPQualityScore.Email.suggested_domain | String | Default value is "N/A". Indicates if this email's domain should in fact be corrected to a popular mail service. This field is useful for catching user typos. For example, an email address with "gmai.com", would display a suggested domain of "gmail.com". This feature supports all major mail service providers. |
| IPQualityScore.Email.leaked | Boolean | Was this email address associated with a recent database leak from a third party? Leaked accounts pose a risk as they may have become compromised during a database breach. |
| IPQualityScore.Email.domain_age.human | Date | A human description of when this domain was registered. (Ex: 3 months ago) |
| IPQualityScore.Email.domain_age.timestamp | Number | The unix time since epoch when this domain was first registered. (Ex: 1568061634) |
| IPQualityScore.Email.domain_age.iso | Date | The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) |
| IPQualityScore.Email.first_seen.human | Date | A human description of the email address age, using an estimation of the email creation date when IPQS first discovered this email address. (Ex: 3 months ago) |
| IPQualityScore.Email.first_seen.timestamp | Number | The unix time since epoch when this email was first analyzed by IPQS. (Ex: 1568061634) |
| IPQualityScore.Email.first_seen.iso | Date | The time this email was first analyzed by IPQS in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) |
| IPQualityScore.Email.sanitized_email | String | Sanitized email address with all aliases and masking removed, such as multiple periods for Gmail.com. |
| IPQualityScore.Email.request_id | String | A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice. |
| IPQualityScore.Email.address | String | The email address that was queried |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-email-reputation email="noreply@example.com"
Context Example#
Human Readable Output#
IPQualityScore Results for noreply@ipqualityscore.com#
message success valid disposable smtp_score overall_score first_name generic common dns_valid honeypot deliverability frequent_complainer spam_trap_score catch_all timed_out suspect recent_abuse fraud_score suggested_domain leaked domain_age first_seen sanitized_email request_id address Success. true true false 2 3 Corporate true false true true low false medium true false true true 95 N/A false human: 10 years ago
timestamp: 1302837997
iso: 2011-04-14T23:26:37-04:00human: 2 years ago
timestamp: 1557122946
iso: 2019-05-06T02:09:06-04:00noreply@ipqualityscore.com 4DpK9WpOZGQDnr7 noreply@ipqualityscore.com
email#
Deprecated. Use ipqs-email-reputation instead.
Base Command#
email
Input#
| Argument Name | Description | Required |
|---|---|---|
| Email address(es) to check. Supports comma-separated list. | Required |
Command Example#
!email email="noreply@example.com"
ipqs-url-reputation#
Runs reputation on URLs.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor's documentation for more details.
Base Command#
ipqs-url-reputation
Input#
| Argument Name | Description | Required |
|---|---|---|
| url | URL(s) to check. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.Url.message | String | A generic status message, either success or some form of an error notice. |
| IPQualityScore.Url.success | Boolean | Was the request successful? |
| IPQualityScore.Url.unsafe | Boolean | Is this domain suspected of being unsafe due to phishing, malware, spamming, or abusive behavior? View the confidence level by analyzing the "risk_score". |
| IPQualityScore.Url.domain | String | Domain name of the final destination URL of the scanned link, after following all redirects. |
| IPQualityScore.Url.ip_address | String | The IP address corresponding to the server of the domain name. |
| IPQualityScore.Url.server | String | The server banner of the domain's IP address. For example: "nginx/1.16.0". Value will be "N/A" if unavailable. |
| IPQualityScore.Url.content_type | String | MIME type of URL's content. For example "text/html; charset=UTF-8". Value will be "N/A" if unavailable. |
| IPQualityScore.Url.status_code | Number | HTTP Status Code of the URL's response. This value should be "200" for a valid website. Value is "0" if URL is unreachable. |
| IPQualityScore.Url.page_size | Number | Total number of bytes to download the URL's content. Value is "0" if URL is unreachable. |
| IPQualityScore.Url.domain_rank | Number | Estimated popularity rank of website globally. Value is "0" if the domain is unranked or has low traffic. |
| IPQualityScore.Url.dns_valid | Boolean | The domain of the URL has valid DNS records. |
| IPQualityScore.Url.parking | Boolean | Is the domain of this URL currently parked with a for sale notice? |
| IPQualityScore.Url.spamming | Boolean | Is the domain of this URL associated with email SPAM or abusive email addresses? |
| IPQualityScore.Url.malware | Boolean | Is this URL associated with malware or viruses? |
| IPQualityScore.Url.phishing | Boolean | Is this URL associated with malicious phishing behavior? |
| IPQualityScore.Url.suspicious | Boolean | Is this URL suspected of being malicious or used for phishing or abuse? Use in conjunction with the "risk_score" as a confidence level. |
| IPQualityScore.Url.risk_score | Number | The IPQS risk score which estimates the confidence level for malicious URL detection. Risk Scores 85+ are high risk, while Risk Scores = 100 are confirmed as accurate. |
| IPQualityScore.Url.request_id | String | A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice. |
| IPQualityScore.Url.url | String | The URL being queried. |
| IPQualityScore.Url.adult | Boolean | Is this URL or domain hosting dating or adult content? |
| IPQualityScore.Url.domain_age.human | Date | A human description of when this domain was registered. (Ex: 3 months ago) |
| IPQualityScore.Url.domain_age.timestamp | Number | The unix time since epoch when this domain was first registered. (Ex: 1568061634) |
| IPQualityScore.Url.domain_age.iso | Date | The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| URL.Data | String | The URL |
| URL.Malicious.Vendor | String | The vendor reporting the URL as malicious. |
Command Example#
!ipqs-url-reputation url="https://www.example.com"
Context Example#
Human Readable Output#
IPQualityScore Results for https://google.com#
message success unsafe domain ip_address server content_type status_code page_size domain_rank dns_valid parking spamming malware phishing suspicious adult risk_score domain_age request_id url Success. true false google.com 172.217.11.142 gws text/html; charset=UTF-8 200 39242 1 true false false false false false false 0 human: 24 years ago
timestamp: 874296000
iso: 1997-09-15T00:00:00-04:004DpK9WpOZGQFSPi https://google.com
url#
Deprecated. Use ipqs-url-reputation instead.
Base Command#
url
Input#
| Argument Name | Description | Required |
|---|---|---|
| url | URL(s) to check. Supports comma-separated list. | Required |
Command Example#
!url url="https://www.example.com"
ipqs-phone-reputation#
Runs validation and reputation on phone numbers.
Base Command#
ipqs-phone-reputation
Input#
| Argument Name | Description | Required |
|---|---|---|
| phone | Phone number(s) to check in international format (e.g. +14155552671). Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.Phone.success | Boolean | Was the request successful? |
| IPQualityScore.Phone.message | String | A generic status message. |
| IPQualityScore.Phone.formatted | String | Internationally formatted phone number. |
| IPQualityScore.Phone.local_format | String | Local format of the phone number. |
| IPQualityScore.Phone.valid | Boolean | Is the phone number valid? |
| IPQualityScore.Phone.fraud_score | Number | Overall fraud score (0–100). |
| IPQualityScore.Phone.recent_abuse | Boolean | Has there been recent abuse reported for this number? |
| IPQualityScore.Phone.VOIP | Boolean | Is the number a VOIP number? |
| IPQualityScore.Phone.prepaid | Boolean | Is this a prepaid phone number? |
| IPQualityScore.Phone.risky | Boolean | Is this number considered risky? |
| IPQualityScore.Phone.active | Boolean | Is this number currently active? |
| IPQualityScore.Phone.carrier | String | Carrier name. |
| IPQualityScore.Phone.line_type | String | Type of phone line (e.g., Landline, Mobile). |
| IPQualityScore.Phone.country | String | Country code or name associated with the number. |
| IPQualityScore.Phone.city | String | City associated with the number. |
| IPQualityScore.Phone.zip_code | String | Zip code associated with the number. |
| IPQualityScore.Phone.region | String | Region associated with the number. |
| IPQualityScore.Phone.dialing_code | Number | Country dialing code. |
| IPQualityScore.Phone.active_status | String | Active status description. |
| IPQualityScore.Phone.sms_domain | String | SMS domain for the number. |
| IPQualityScore.Phone.associated_email_addresses.status | String | Status of associated email addresses. |
| IPQualityScore.Phone.associated_email_addresses.emails | Unknown | List of email addresses associated with the number. |
| IPQualityScore.Phone.user_activity | String | User activity status. |
| IPQualityScore.Phone.mnc | String | Mobile Network Code. |
| IPQualityScore.Phone.mcc | String | Mobile Country Code. |
| IPQualityScore.Phone.leaked | Boolean | Was this number found in a known data leak? |
| IPQualityScore.Phone.spammer | Boolean | Is this number a known spammer? |
| IPQualityScore.Phone.do_not_call | Boolean | Is this number on a do-not-call list? |
| IPQualityScore.Phone.name | String | Name associated with the number. |
| IPQualityScore.Phone.timezone | String | Timezone for the number. |
| IPQualityScore.Phone.tcpa_blacklist | Boolean | Is the number on a TCPA blacklist? |
| IPQualityScore.Phone.accurate_country_code | Boolean | Is the country code accurate? |
| IPQualityScore.Phone.sms_email | String | SMS email address for the number. |
| IPQualityScore.Phone.number_recycling.message | String | Number recycling status message. |
| IPQualityScore.Phone.number_recycling.recently_recycled | Boolean | Was the number recently recycled? |
| IPQualityScore.Phone.number_recycling.last_ported_date | String | Last ported date for the number. |
| IPQualityScore.Phone.number_recycling.ported | Boolean | Was the number ported? |
| IPQualityScore.Phone.identity_data | String | Identity data associated with the number. |
| IPQualityScore.Phone.request_id | String | Unique request identifier. |
| IPQualityScore.Phone.phone | String | The phone number that was queried. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-phone-reputation phone="+15555555555"
Context Example#
Human Readable Output#
IPQualityScore Results for +15555555555#
fraud_score valid active VOIP prepaid risky carrier line_type country phone 20 true true false false false AT&T Mobile US +15555555555
ipqs-username-leaked#
Checks if a username has been exposed in known data breaches.
Base Command#
ipqs-username-leaked
Input#
| Argument Name | Description | Required |
|---|---|---|
| username | Username(s) to check for leaks. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.Username.success | Boolean | Was the request successful? |
| IPQualityScore.Username.message | String | Status message. |
| IPQualityScore.Username.request_hash | String | Unique hash for the request. |
| IPQualityScore.Username.source | Unknown | List of sources where the username was found. |
| IPQualityScore.Username.exposed | Boolean | Was the username found in a known leak? |
| IPQualityScore.Username.first_seen.human | String | Human-readable time when the leak was first seen. |
| IPQualityScore.Username.first_seen.timestamp | Number | Unix epoch when the leak was first seen. |
| IPQualityScore.Username.first_seen.iso | String | ISO8601 timestamp when the leak was first seen. |
| IPQualityScore.Username.request_id | String | Unique request identifier. |
| IPQualityScore.Username.username | String | The username that was queried. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-username-leaked username="user@123"
Context Example#
Human Readable Output#
IPQualityScore Results for testuser123#
success exposed source request_id username true false gOOSmfym49 testuser123
ipqs-password-leaked#
Checks if a password has been exposed in known data breaches.
Base Command#
ipqs-password-leaked
Input#
| Argument Name | Description | Required |
|---|---|---|
| password | Password(s) to check for leaks. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.Password.success | Boolean | Was the request successful? |
| IPQualityScore.Password.message | String | Status message. |
| IPQualityScore.Password.request_hash | String | Unique hash for the request. |
| IPQualityScore.Password.source | Unknown | List of sources where the password was found. |
| IPQualityScore.Password.exposed | Boolean | Was the password found in a known leak? |
| IPQualityScore.Password.first_seen.human | String | Human-readable time when the leak was first seen. |
| IPQualityScore.Password.first_seen.timestamp | Number | Unix epoch when the leak was first seen. |
| IPQualityScore.Password.first_seen.iso | String | ISO8601 timestamp when the leak was first seen. |
| IPQualityScore.Password.request_id | String | Unique request identifier. |
| IPQualityScore.Password.password | String | The password that was queried. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-password-leaked password="user123"
Context Example#
Human Readable Output#
IPQualityScore Results for provided password#
success exposed source request_id true true Exploit Antipublic, Dark Web Leaks gOOeuEg77u
ipqs-email-leaked#
Checks if an email address has been exposed in known data breaches.
Base Command#
ipqs-email-leaked
Input#
| Argument Name | Description | Required |
|---|---|---|
| Email address(es) to check for leaks. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.LeakedEmail.success | Boolean | Was the request successful? |
| IPQualityScore.LeakedEmail.message | String | Status message. |
| IPQualityScore.LeakedEmail.request_hash | String | Unique hash for the request. |
| IPQualityScore.LeakedEmail.source | Unknown | List of sources where the email was found. |
| IPQualityScore.LeakedEmail.exposed | Boolean | Was the email found in a known leak? |
| IPQualityScore.LeakedEmail.first_seen.human | String | Human-readable time when the leak was first seen. |
| IPQualityScore.LeakedEmail.first_seen.timestamp | Number | Unix epoch when the leak was first seen. |
| IPQualityScore.LeakedEmail.first_seen.iso | String | ISO8601 timestamp when the leak was first seen. |
| IPQualityScore.LeakedEmail.plain_text_password | String | Plain text password if found in the leak. |
| IPQualityScore.LeakedEmail.request_id | String | Unique request identifier. |
| IPQualityScore.LeakedEmail.email | String | The email address that was queried. |
| IPQualityScore.Email.exposed | Boolean | Was the email found in a known leak? |
| IPQualityScore.Email.success | Boolean | Was the request successful? |
| IPQualityScore.Email.plain_text_password | String | Plain text password if found in the leak. |
| IPQualityScore.Email.first_seen.human | String | Human-readable time when the leak was first seen. |
| IPQualityScore.Email.first_seen.iso | String | ISO8601 timestamp when the leak was first seen. |
| IPQualityScore.Email.first_seen.timestamp | Number | Unix epoch when the leak was first seen. |
| IPQualityScore.Email.request_hash | String | Unique hash for the request. |
| IPQualityScore.Email.source | Unknown | List of sources where the email was found. |
| IPQualityScore.Email.request_id | String | Unique request identifier. |
| IPQualityScore.Email.message | String | Status message. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-email-leaked email="user@example.com"
Context Example#
Human Readable Output#
IPQualityScore Results for user@example.com#
success exposed plain_text_password source request_id true true false Dark Web Leaks gOOsrUX4lK user@example.com
ipqs-file-scan#
Uploads a file and scans it using the IPQualityScore Malware File Scanner API. First attempts a cached lookup by file hash; if not cached, the file is submitted for scanning. Polls for results automatically if the scan is pending.
Base Command#
ipqs-file-scan
Input#
| Argument Name | Description | Required |
|---|---|---|
| entry_id | The entry id of the uploaded file in the War Room. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.FileScan.success | Boolean | Was the request successful? |
| IPQualityScore.FileScan.message | String | Status message. |
| IPQualityScore.FileScan.file_name | String | The file name that was scanned. |
| IPQualityScore.FileScan.file_hash | String | SHA256 hash of the file. |
| IPQualityScore.FileScan.type | String | Type of operation performed: "scan" or "lookup". |
| IPQualityScore.FileScan.status | String | Scan status: "pending" or "complete". |
| IPQualityScore.FileScan.detected | Boolean | Was the file detected as malicious? |
| IPQualityScore.FileScan.detected_scans | Number | Number of engines that detected the file as malicious. |
| IPQualityScore.FileScan.total_scans | Number | Total number of scan engines used. |
| IPQualityScore.FileScan.result | String | Detailed scan engine results. |
| IPQualityScore.FileScan.file_size | Number | File size in bytes. |
| IPQualityScore.FileScan.file_type | String | MIME type of the file. |
| IPQualityScore.FileScan.sha1 | String | SHA1 hash of the file. |
| IPQualityScore.FileScan.md5 | String | MD5 hash of the file. |
| IPQualityScore.FileScan.update_url | String | URL to poll for updated scan results. |
| IPQualityScore.FileScan.request_id | String | Unique request identifier. |
| File.SHA256 | String | SHA256 hash of the file. |
| File.SHA1 | String | SHA1 hash of the file. |
| File.MD5 | String | MD5 hash of the file. |
| File.Size | Number | File size in bytes. |
| File.Type | String | File MIME type. |
| File.Malicious.Count | Number | Number of detections. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type (file). |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-file-scan entry_id="212@_13"
Human Readable Output#
IPQualityScore File Scan Result#
file_name file_hash detected detected_scans total_scans status file_type file_size sha1 md5 request_id ipks.exe a35e17ca3d1c0d7363ad4a9c358260d1343033212299ac37cd43471aaa3478b9 false 0 7 done text/html 61049 6751c12507d83f850edaceea8bd51031d27ee363 942af291e78ae29787c0069611ec58e3 fmXlsRjJ4x
ipqs-url-file-scan#
Submits a URL to the IPQualityScore Malware File Scanner API. First attempts a cached lookup; if not cached, the URL is submitted for scanning. Polls for results automatically if the scan is pending.
Base Command#
ipqs-url-file-scan
Input#
| Argument Name | Description | Required |
|---|---|---|
| url | URL(s) to scan for malware. Supports comma-separated list. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| IPQualityScore.URLFileScan.success | Boolean | Was the request successful? |
| IPQualityScore.URLFileScan.message | String | Status message. |
| IPQualityScore.URLFileScan.file_name | String | The URL that was scanned. |
| IPQualityScore.URLFileScan.file_hash | String | SHA256 hash of the scanned content. |
| IPQualityScore.URLFileScan.type | String | Type of operation performed: "scan" or "lookup". |
| IPQualityScore.URLFileScan.status | String | Scan status: "pending" or "complete". |
| IPQualityScore.URLFileScan.detected | Boolean | Was the URL detected as malicious? |
| IPQualityScore.URLFileScan.detected_scans | Number | Number of engines that detected the URL as malicious. |
| IPQualityScore.URLFileScan.total_scans | Number | Total number of scan engines used. |
| IPQualityScore.URLFileScan.result | String | Detailed scan engine results. |
| IPQualityScore.URLFileScan.file_size | Number | Size of the scanned content in bytes. |
| IPQualityScore.URLFileScan.file_type | String | MIME type of the scanned content. |
| IPQualityScore.URLFileScan.sha1 | String | SHA1 hash of the scanned content. |
| IPQualityScore.URLFileScan.md5 | String | MD5 hash of the scanned content. |
| IPQualityScore.URLFileScan.update_url | String | URL to poll for updated scan results. |
| IPQualityScore.URLFileScan.scan_date | Unknown | Date and time when the scan was performed. |
| IPQualityScore.URLFileScan.request_id | String | Unique request identifier. |
| URL.Data | String | The URL that was scanned. |
| URL.Malicious.Description | String | Description of why the URL was flagged as malicious. |
| URL.Malicious.Vendor | String | The vendor that identified the URL as malicious. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type (URL). |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
Command Example#
!ipqs-url-file-scan url="http://www.example.com/"
Human Readable Output#
IPQualityScore URL Scan Result#
file_name file_hash detected detected_scans total_scans status file_type file_size sha1 md5 request_id M94scZj.exe a35e17ca3d1c0d7363ad4a9c358260d1343033212299ac37cd43471aaa3478b9 false 0 7 done text/html 61049 6751c12507d83f850edaceea8bd51031d27ee363 942af291e78ae29787c0069611ec58e3 fmXlsRjJ4x
Scoring Thresholds#
| Indicator Type | Suspicious (default) | Malicious (default) | Score Field |
|---|---|---|---|
| IP | 75 | 90 | fraud_score |
| 75 | 90 | fraud_score | |
| URL (reputation) | 75 | 90 | risk_score |
| Phone | 75 | 90 | fraud_score |
| File (malware scan) | 1 detection | 5 detections | detected_scans |
| URL (malware scan) | 1 detection | 5 detections | detected_scans |