DarkAPI · Security intelligence
Follow the signal.
Inspect the evidence.
Look up threat indicators, monitor your event sources, and investigate related activity through one API and console.
Start with an indicator
Search an IP address, domain, URL, or file hash.
A feed listing is evidence to investigate, not a guarantee of malicious activity.
Public intelligence index
Recorded public indicators and tracked CVEs · timestamps shown below
Public indicators
1,291,240
As of 10/19/2026, 4:04:23 PM UTC
Listed IP addresses
911,319
As of 10/19/2026, 4:04:23 PM UTC
Listed file hashes
49,489
As of 10/19/2026, 4:04:23 PM UTC
CVEs Tracked
0
As of 10/19/2026, 4:04:23 PM UTC
Recent source evidence
Explore indicators →| IOC | Type | Severity | Category | Source / last seen |
|---|---|---|---|---|
| 64.227.64.251 | IP | high | malicious | CINS Score |
| 5.226.140.16 | IP | high | malicious | CINS Score |
| 1.24.16.2 | IP | high | malicious | CINS Score |
| 5.252.83.94 | IP | high | malicious | CINS Score |
| 5.226.140.34 | IP | high | malicious | CINS Score |
| 20.150.212.101 | IP | high | malicious | CINS Score |
| 5.226.140.115 | IP | high | malicious | CINS Score |
| 121.197.0.214 | IP | high | malicious | CINS Score |
| 148.153.90.253 | IP | high | malicious | CINS Score |
| 64.94.153.131 | IP | high | malicious | CINS Score |
Investigation workflow
From collection
to context.
- 01Connect your sources →
Track collector reports, rejected records, and the last event received.
- 02Analyze related activity →
Explore event volume, shared identifiers, and explainable session and DNS signals.
- 03Inspect the original evidence →
Open source records and timestamps before deciding how to respond.