Types

The address that was looked up, as the API canonicalized it.

The network that announces the address, or null if the API has no network data.

The geolocation of the address, or null if the API has no location data.

The risk score and the proxy, VPN, and device observations for the address, or null if the API has no intelligence data.

The autonomous system number, or 0 if the address is not routed.

The name of the internet service provider.

The kind of network, such as NetworkType.Residential. See Enumerations.

The organization the address is registered to, or null if unknown.

The network operator's domain, or null if unknown.

The operator's abuse contact email, or null if unknown.

The operator's abuse contact phone number, or null if unknown.

The ISO 3166-1 alpha-2 country code.

The state or region.

The city.

The IANA time zone name.

The latitude in degrees.

The longitude in degrees.

The geohash of the coordinates.

The risk of the address, from 0 to 100.

The kinds of services seen on the address, such as "RESIDENTIAL_PROXY". New values may be added.

Behaviors observed from the address. New values may be added.

The proxy, VPN, and anonymizer services seen using the address. An empty list does not mean the address is clean.

The device types seen behind the address.

The service tag, such as "BRIGHTDATA". The API names this field provider. See Service Tags.

The service category.

When the service was last seen using the address.

The operating system, such as DeviceOS.Android. See Enumerations.

The operating system version.

When the device was last seen.

The domain that was looked up.

Whether the domain had events in the last 24 hours, DomainStatus.Active or DomainStatus.Inactive.

Aggregate event counts.

Daily event counts.

The number of distinct source addresses.

The network that sent the most events, or null if there were none.

The most targeted subdomains.

The most targeted ports.

Event counts by source country.

The last 30 days of events by UTC day of week and hour, indexed as HourDowHeatmap[day][hour]. Day 0 is Monday, unlike DayOfWeek, where 0 is Sunday.

The hourly activity pattern.

The most recent events, capped by the lookup's limit.

The number of events in the last 24 hours.

The number of events in the last 30 days.

The count for the last 24 hours.

The count for the last 30 days.

Hourly counts for the last 24 hours.

The start of the UTC day.

The number of events that day.

The number of distinct source addresses that day.

The autonomous system number.

The number of events from the network.

The targeted subdomain.

The number of events that targeted it.

The targeted port.

The number of events that targeted it.

The ISO 3166-1 alpha-2 country code.

The number of events from the country.

The number of distinct addresses from the country.

A sentence describing how events are spread over the last 30 days. See Enumerations.

The median number of events per hour.

The 95th percentile of events per hour.

The busiest UTC hour of the day.

The quietest UTC hour of the day.

When the event happened.

The full proxy exit address that carried the event. The API names the field source_ip_masked, but the address is not masked.

The subdomain that was targeted.

The source country.

The targeted port.

The account holder's email address.

The account holder's first name.

The account holder's last name.

The organization the account belongs to.

The permissions granted to the API key. See Enumerations.

The remaining lookup credit balance.

The API key used for the request, or null if the response omits it.

The organization's ID, a UUID.

The organization's name.

The account's role in the organization. See Enumerations.

The number of lookup credits remaining.

How long until the credits reset.

The key's ID, a UUID.

The key's display name.

When the key was created, parsed from the RFC 3339 string the API sends.

The feed's stream identifier, such as "proxies".

The exports on this page. The API names this field feeds.

Fetches the next page through the cursor parameter. It is null or empty on the last page.

Identifies the export for GetExportMetaAsync, GetDownloadUrlAsync, and DownloadAsync. On the first page, the newest hourly export may have the ID ExportId.Latest.

Whether the export covers an hour or a day, ExportKind.Hourly or ExportKind.Daily.

The UTC day of the export.

The UTC hour of an hourly export, or null for a daily export.

The size of the Parquet file in bytes.

The number of rows in the file.

The hex-encoded SHA-256 of the Parquet file.

When the export was produced.

The API path of the export's download, including the version prefix.

The export ID.

The feed's stream identifier.

Whether the export covers an hour or a day, ExportKind.Hourly or ExportKind.Daily.

The file format, "parquet".

The start of the export's UTC day or hour.

The UTC hour of an hourly export, or null for a daily export.

The number of rows in the file.

The size of the Parquet file in bytes.

The hex-encoded SHA-256 of the Parquet file.

When the export was produced.

The Parquet columns.

The columns in file order.

The column name.

The column type. See Enumerations.

The proxy exit address.

The proxy service tag.

The service category. See Enumerations.

The ISO 3166-1 alpha-2 country of the address.

The autonomous system number of the address.

When the proxy was seen.

The first address of the range.

The last address of the range.

The service tag.

The service category, such as ProxyType.CommercialVpn.

The ISO 3166-1 alpha-2 country of RangeStart.

The autonomous system number of RangeStart.

When the range was seen.

The hex-encoded SHA-1 info hash.

The torrent's name.

The torrent's magnet link.

The total size of the torrent's files in bytes.

The piece size in bytes.

The number of files in the torrent.

The files in the torrent.

The peers seen sharing the torrent.

When the torrent was seen.

The file path within the torrent.

The file size in bytes.

The peer's address.

The peer's port.

Where the peer was found, such as "DHT", "PEX", or "tracker".

Whether the peer supports encrypted connections.

The address the fingerprint was seen from.

The JA4T fingerprint.

The service tag of the address.

The service category, such as ProxyType.DatacenterProxy.

The ISO 3166-1 alpha-2 country of the address.

The autonomous system number of the address.

When the fingerprint was seen.

The proxy exit address the traffic arrived through.

The sensor that captured the traffic.

The sensor pool.

The proxy service the traffic arrived through.

When the request was captured.

Identifies the proxy tunnel the request arrived through. Live values use the full ulong range.

The host the tunnel was opened to.

The destination port.

The protocol, "http".

The capturing sensor.

The parsed request, or null if the API omits it.

The raw request bytes, decoded from the API's base64, or null if the API omits them.

The request method.

The request target.

The HTTP version, such as "HTTP/1.1".

The request headers.

When the handshake was captured.

Identifies the proxy tunnel the handshake arrived through. Live values use the full ulong range.

The host the tunnel was opened to.

The destination port.

The protocol, "https".

The capturing sensor.

The parsed ClientHello, or null if the sensor could not parse the handshake.

Always null, because the sensors do not capture handshake bytes.

The record layer version, such as "TLS 1.0".

The ClientHello version, such as "TLS 1.2".

The hex-encoded 32-byte client random.

The hex-encoded session ID.

The length of the session ID in bytes.

The offered cipher suites.

The offered compression methods.

The extensions in wire order.

The server_name extension value.

The offered application protocols.

The offered TLS versions.

The offered key exchange groups.

The offered signature algorithms.

The offered elliptic curve point formats.

The groups the client sent key shares for.

The offered pre-shared key exchange modes.

The offered certificate compression algorithms.

Whether the ClientHello contains GREASE values.

Whether the client offered application settings (ALPS).

Whether the client offered the delegated_credentials extension.

Whether the client offered the encrypt_then_mac extension.

Whether the client offered the extended_master_secret extension.

Whether the client offered the post_handshake_auth extension.

Whether the client offered the renegotiation_info extension.

Whether the client offered the signed_certificate_timestamp extension.

Whether the client requested OCSP stapling.

The code point.

The code point's registered name.

The extension type.

The extension's registered name.

The extension body length in bytes.

When the event was captured.

Identifies the proxy tunnel. Live values use the full ulong range.

The host name or address literal the tunnel was opened to.

The destination port.

The protocol, "dns".

The capturing sensor.

Identifies the ADB session as 32 hex characters.

The 1-based position of the command within its session.

The shell command. Invalid UTF-8 bytes are replaced with U+FFFD.

The hex-encoded SHA-256 the sensor assigns to the session's payload. It is not a hash of Command: every command in a session shares it, and sessions that replay the same script share it too.