DarkAPI · Security intelligence
Follow the signal.
Inspect the evidence.
Look up threat indicators, monitor your event sources, and investigate related activity through one API and console.
Start with an indicator
Search an IP address, domain, URL, or file hash.
A feed listing is evidence to investigate, not a guarantee of malicious activity.
Public intelligence index
Recorded public indicators and tracked CVEs · timestamps shown below
Public indicators
1,266,184
As of 10/15/2026, 4:40:26 PM UTC
Listed IP addresses
896,189
As of 10/15/2026, 4:40:26 PM UTC
Listed file hashes
47,221
As of 10/15/2026, 4:40:26 PM UTC
CVEs Tracked
0
As of 10/15/2026, 4:40:26 PM UTC
Recent source evidence
Explore indicators →| IOC | Type | Severity | Category | Source / last seen |
|---|---|---|---|---|
| 77.91.71.90 | IP | high | compromised_host | Emerging Threats |
| 34.156.143.100 | IP | high | compromised_host | Emerging Threats |
| 123.180.188.162 | IP | high | compromised_host | Emerging Threats |
| 103.228.36.205 | IP | high | compromised_host | Emerging Threats |
| 45.156.87.209 | IP | high | compromised_host | Emerging Threats |
| 154.18.197.29 | IP | high | compromised_host | Emerging Threats |
| 89.126.222.163 | IP | high | compromised_host | Emerging Threats |
| 209.99.186.149 | IP | high | compromised_host | Emerging Threats |
| 59.24.28.114 | IP | high | compromised_host | Emerging Threats |
| 102.220.161.28 | IP | high | compromised_host | Emerging Threats |
Investigation workflow
From collection
to context.
- 01Connect your sources →
Track collector reports, rejected records, and the last event received.
- 02Analyze related activity →
Explore event volume, shared identifiers, and explainable session and DNS signals.
- 03Inspect the original evidence →
Open source records and timestamps before deciding how to respond.