Types

The address that was looked up.

The network that announces the address, or nil if the API has no network data.

The geolocation of the address, or nil if the API has no location data.

The risk score and the proxy, VPN, and device observations for the address, or nil if the API has no intelligence data.

The autonomous system number, or 0 if the address is not routed.

The internet service provider that operates the network.

The organization the address is registered to, or nil if unknown.

The network operator's domain, or nil if unknown.

The kind of network, such as NetworkType::RESIDENTIAL. See Enumerations.

The operator's abuse contact email, or nil if unknown.

The operator's abuse contact phone number, or nil if unknown.

The ISO 3166-1 alpha-2 country code.

The state or region.

The city.

The IANA time zone name.

The latitude in degrees.

The longitude in degrees.

The geohash of the coordinates.

The risk of the address, from 0 to 100.

The kinds of services seen on the address. New values may be added.

Behaviors observed from the address. New values may be added.

The proxy, VPN, and anonymizer services seen using the address. An empty list does not mean the address is clean.

The device types seen behind the address.

The service tag, such as "BRIGHTDATA". The API names this field provider. See Service Tags.

The service category.

When the service was last seen on the address.

The operating system, such as OS::ANDROID. See Enumerations.

The operating system version.

When the device was last seen.

The domain that was looked up.

Whether the domain had events in the last 24 hours, as a DomainStatus value.

Aggregate event counts.

Counts of the distinct source addresses.

Daily event counts.

The network that sent the most events, or nil when there were no events.

The most targeted subdomains.

The most targeted ports.

Event counts by source country.

The last 30 days of events as 7 rows, Monday first, of 24 UTC hourly counts, indexed as hour_dow_heatmap[day][hour]. Day 0 is Monday, unlike Time#wday, where 0 is Sunday.

The hourly activity pattern.

The most recent events, capped by the limit: passed to lookup_domain.

Events in the last 24 hours.

Events in the last 30 days.

Distinct source addresses in the last 24 hours.

Distinct source addresses in the last 30 days.

Hourly counts for the last 24 hours, oldest first.

The start of the day.

Events that day.

The number of distinct source addresses that day.

The autonomous system number.

Events from that network.

The subdomain.

The number of events that targeted it.

The port.

The number of events that targeted it.

The ISO 3166-1 alpha-2 country code.

Events from that country.

Distinct source addresses from that country.

How events are spread over the last 30 days, as a Cadence sentence. See Enumerations.

The median number of events per hour.

The 95th percentile of events per hour.

The busiest UTC hour of the day.

The quietest UTC hour of the day.

When the event happened.

The full proxy exit address that carried the event. The API names the field source_ip_masked, but the address is not masked.

The subdomain that was targeted.

The source country.

The destination port.

The account's email address.

The account holder's first name.

The account holder's last name.

The organization the account belongs to.

The permissions granted to the API key, as Scope values. See Enumerations.

The remaining lookup credit balance.

The API key used for the request, or nil if the API omits it.

The organization's ID.

The organization's name.

The account's role in the organization, as a Relation value. See Enumerations.

The number of lookup credits remaining.

The number of seconds until the credits reset.

The key's ID.

The key's display name.

When the key was created, parsed from the API's RFC 3339 string.

The feed's stream identifier, such as "proxies".

The exports on this page. The API names this field feeds.

Fetches the next page when passed as cursor:. It is nil on the last page.

Identifies the export for export_meta, download_url, and download, which accept it as is. On the first page, the newest hourly export may have the ID "latest".

Whether the export covers an hour or a day, as an ExportKind value.

The UTC day of the export.

The UTC hour of an hourly export, or nil for a daily export.

The size of the Parquet file in bytes.

The number of rows in the file.

The hex-encoded SHA-256 of the Parquet file.

When the export was created.

The API path of the export's download, including the /api/v4 prefix.

The export ID.

The feed's stream identifier.

Whether the export covers an hour or a day, as an ExportKind value.

The file format.

The start of the export's UTC day or hour.

The UTC hour of an hourly export, or nil for a daily export.

The number of rows in the file.

The size of the Parquet file in bytes.

The hex-encoded SHA-256 of the Parquet file.

When the export was created.

The Parquet columns.

The columns of the export.

The column name.

The column type, as a ParquetType value. See Enumerations.

The proxy exit address.

The proxy service tag.

The service category, as a ProxyType value. See Enumerations.

The ISO 3166-1 alpha-2 country of the address.

The autonomous system number of the address.

When the proxy was seen.

The first address of the range.

The last address of the range.

The service tag.

The service category, such as ProxyType::COMMERCIAL_VPN.

The ISO 3166-1 alpha-2 country of range_start.

The autonomous system number of range_start.

When the range was seen.

The hex-encoded SHA-1 info hash.

The torrent's name.

The torrent's magnet link.

The total size of the torrent's files in bytes.

The piece size in bytes.

The number of files in the torrent.

The files in the torrent.

The peers seen sharing the torrent.

When the torrent was seen.

The file path within the torrent.

The file size in bytes.

The peer's address.

The peer's port.

Where the peer was found, such as "DHT", "PEX", or "tracker".

Whether the peer supports encrypted connections.

The address the fingerprint was seen from.

The JA4T fingerprint.

The service tag of the address.

The service category, such as ProxyType::DATACENTER_PROXY.

The ISO 3166-1 alpha-2 country of the address.

The autonomous system number of the address.

When the fingerprint was seen.

The proxy exit address the traffic arrived through.

The sensor that captured the traffic.

The sensor pool.

The proxy service the traffic arrived through.

When the request was captured.

Identifies the proxy tunnel the request arrived through. Live values use the full unsigned 64-bit range.

The host the tunnel was opened to.

The destination port.

Always "http".

The capturing sensor.

The parsed request.

The raw request bytes as a binary String, decoded from the API's base64.

The request method. The API names this field method.

The request target.

The HTTP version, such as "HTTP/1.1".

The request headers.

When the handshake was captured.

Identifies the proxy tunnel the handshake arrived through. Live values use the full unsigned 64-bit range.

The host the tunnel was opened to.

The destination port.

Always "https".

The capturing sensor.

The parsed ClientHello, or nil if the sensor could not parse the handshake.

Always nil, because the sensors do not capture handshake bytes.

The record layer version, such as "TLS 1.0".

The ClientHello version, such as "TLS 1.2".

The hex-encoded 32-byte client random.

The hex-encoded session ID.

The length of the session ID in bytes.

The offered cipher suites.

The offered compression methods.

The extensions in wire order.

The server_name extension value.

The offered application protocols.

The offered TLS versions.

The offered key exchange groups.

The offered signature algorithms.

The offered elliptic curve point formats.

The groups the client sent key shares for.

The offered pre-shared key exchange modes.

The offered certificate compression algorithms.

Whether the ClientHello contains GREASE values.

Whether the client offered application settings (ALPS).

Whether the client offered the delegated_credentials extension.

Whether the client offered the encrypt_then_mac extension.

Whether the client offered the extended_master_secret extension.

Whether the client offered the post_handshake_auth extension.

Whether the client offered the renegotiation_info extension.

Whether the client offered the signed_certificate_timestamp extension.

Whether the client requested OCSP stapling.

The code point.

The code point's registered name.

The extension type.

The extension's registered name.

The extension body length in bytes.

When the event was captured.

Identifies the proxy tunnel. Live values use the full unsigned 64-bit range.

The host name or address literal the tunnel was opened to.

The destination port.

Always "dns".

The capturing sensor.

Identifies the ADB session as 32 hex characters.

The 1-based position of the command within its session.

The shell command. Invalid UTF-8 bytes are replaced with U+FFFD.

The hex-encoded SHA-256 the sensor assigns to the session's payload. The API names this field hash. It is not a hash of command: every command in a session shares it, and sessions that replay the same script share it too.