Types

The address that was looked up.

The network that announces the address, or nil if the API has no network data.

The geolocation of the address, or nil if the API has no location data.

The risk score and the proxy, VPN, and device observations for the address, or nil if the API has no intelligence data.

The autonomous system number, or 0 if the address is not routed.

The internet service provider that operates the network.

The organization the address is registered to, or empty if unknown.

The network operator's domain, or empty if unknown.

The kind of network, such as NetworkTypeResidential. See Enumerations.

The operator's abuse contact email, or empty if unknown.

The operator's abuse contact phone number, or empty if unknown.

The ISO 3166-1 alpha-2 country code.

The state or region.

The city.

The IANA time zone name.

The latitude in degrees.

The longitude in degrees.

The geohash of the coordinates.

The risk of the address, from 0 to 100.

The kinds of services seen on the address, such as "RESIDENTIAL_PROXY". New values may be added.

Behaviors observed from the address. New values may be added.

The proxy, VPN, and anonymizer services seen using the address. An empty list does not mean the address is clean.

The device types seen behind the address.

The service tag, such as "BRIGHTDATA". The API names this field provider. See Service Tags.

The service category.

When the service was last seen on the address.

The operating system. See Enumerations.

The operating system version.

When the device was last seen.

The domain that was looked up.

Whether the domain had events in the last 24 hours.

Aggregate event counts.

Counts of the distinct source addresses.

Daily event counts.

The network that sent the most events. It is zero when there are no events.

The most targeted subdomains.

The most targeted ports.

Event counts by source country.

The last 30 days of events by UTC day of week and hour, indexed as HourDOWHeatmap[day][hour]. Day 0 is Monday, unlike time.Weekday, where 0 is Sunday.

The hourly activity pattern.

The most recent events, capped by LookupDomainParams.Limit.

Events in the last 24 hours.

Events in the last 30 days.

Distinct source addresses in the last 24 hours.

Distinct source addresses in the last 30 days.

Hourly counts for the last 24 hours.

The start of the day.

Events that day.

The number of distinct source addresses that day.

The autonomous system number.

Events from that network.

The subdomain.

The number of events that targeted it.

The port.

The number of events that targeted it.

The ISO 3166-1 alpha-2 country code.

Events from that country.

Distinct source addresses from that country.

How events are spread over the last 30 days. See Enumerations.

The median number of events per hour.

The 95th percentile of events per hour.

The busiest UTC hour of the day.

The quietest UTC hour of the day.

When the event happened.

The full proxy exit address that carried the event. The API names the field source_ip_masked, but the address is not masked.

The subdomain that was targeted.

The source country.

The destination port.

The account's email address.

The account holder's first name.

The account holder's last name.

The organization the account belongs to.

The permissions granted to the API key. See Enumerations.

The remaining lookup credit balance.

The API key used for the request.

The organization's ID.

The organization's name.

The account's role in the organization. See Enumerations.

The number of lookup credits remaining.

The number of seconds until the credits reset.

Identifies the key. It is not the secret key itself.

The key's display name.

When the key was created.

The feed's stream identifier, such as "proxies".

The exports on this page. The API names this field feeds.

Fetches the next page through ListExportsParams.Cursor. It is empty on the last page.

Identifies the export for ExportMeta, Download, and DownloadURL. On the first page, the newest hourly export may have the ID LatestExport.

Whether the export covers an hour or a day.

The UTC day of the export as "YYYY-MM-DD".

The UTC hour of an hourly export, or nil for a daily export.

The size of the Parquet file in bytes.

The number of rows in the file.

The hex-encoded SHA-256 of the Parquet file.

When the export was created.

The API path of the export's download, including the version prefix.

The export ID.

The feed's stream identifier.

Whether the export covers an hour or a day.

The file format, "parquet".

The start of the export's UTC day or hour.

The UTC hour of an hourly export, or nil for a daily export.

The number of rows in the file.

The size of the Parquet file in bytes.

The hex-encoded SHA-256 of the Parquet file.

When the export was created.

The Parquet columns.

The columns in file order.

The column name.

The column type. See Enumerations.

The proxy exit address.

The proxy service tag.

The service category. See Enumerations.

The ISO 3166-1 alpha-2 country of the address.

The autonomous system number of the address.

When the proxy was seen, in Unix seconds.

The first address of the range.

The last address of the range.

The service tag.

The service category, such as ProxyTypeCommercialVPN.

The ISO 3166-1 alpha-2 country of RangeStart.

The autonomous system number of RangeStart.

When the range was seen, in Unix milliseconds.

The hex-encoded SHA-1 info hash.

The torrent's name.

The torrent's magnet link.

The total size of the torrent's files in bytes.

The piece size in bytes.

The number of files in the torrent.

The files in the torrent.

The peers seen sharing the torrent.

When the torrent was seen, in Unix seconds.

The file path within the torrent.

The file size in bytes.

The peer's address.

The peer's port.

Where the peer was found, such as "DHT", "PEX", or "tracker".

Whether the peer supports encrypted connections.

The address the fingerprint was seen from.

The JA4T fingerprint.

The service tag of the address.

The service category, such as ProxyTypeDatacenterProxy.

The ISO 3166-1 alpha-2 country of the address.

The autonomous system number of the address.

When the fingerprint was seen, in Unix seconds.

The proxy exit address the traffic arrived through.

The sensor that captured the traffic.

The sensor pool.

The proxy service the traffic arrived through.

When the request was captured, in Unix milliseconds.

Identifies the proxy tunnel the request arrived through. Live values use the full uint64 range.

The host the tunnel was opened to.

The destination port.

Always "http".

The capturing sensor.

The parsed request. It is a struct value, so it is the zero HTTPRequestDetails when the API omits it or sends null.

The raw request bytes, decoded from the API's base64.

The request method.

The request target.

The HTTP version, such as "HTTP/1.1".

The request headers.

When the handshake was captured, in Unix milliseconds.

Identifies the proxy tunnel the handshake arrived through. Live values use the full uint64 range.

The host the tunnel was opened to.

The destination port.

Always "https".

The capturing sensor.

The parsed ClientHello, or nil if the sensor could not parse the handshake.

Always empty, because the sensors do not capture handshake bytes.

The record layer version, such as "TLS 1.0".

The ClientHello version, such as "TLS 1.2".

The hex-encoded 32-byte client random.

The hex-encoded session ID.

The length of the session ID in bytes.

The offered cipher suites.

The offered compression methods.

The extensions in wire order.

The server_name extension value.

The offered application protocols.

The offered TLS versions.

The offered key exchange groups.

The offered signature algorithms.

The offered elliptic curve point formats.

The groups the client sent key shares for.

The offered pre-shared key exchange modes.

The offered certificate compression algorithms.

Whether the ClientHello contains GREASE values.

Whether the client offered application settings (ALPS).

Whether the client offered the delegated_credentials extension.

Whether the client offered the encrypt_then_mac extension.

Whether the client offered the extended_master_secret extension.

Whether the client offered the post_handshake_auth extension.

Whether the client offered the renegotiation_info extension.

Whether the client offered the signed_certificate_timestamp extension.

Whether the client requested OCSP stapling.

The code point.

The code point's registered name.

The extension type.

The extension's registered name.

The extension body length in bytes.

When the event was captured, in Unix milliseconds.

Identifies the proxy tunnel. Live values use the full uint64 range.

The host name or address literal the tunnel was opened to.

The destination port.

Always "dns".

The capturing sensor.

Identifies the ADB session as 32 hex characters.

The 1-based position of the command within its session.

The shell command. Invalid UTF-8 bytes are replaced with U+FFFD.

The hex-encoded SHA-256 the sensor assigns to the session's payload. It is not a hash of Command: every command in a session shares it, and sessions that replay the same script share it too.