IPQualityScore

Proactively Prevent Fraud.

Data Enrichment & Threat Intelligence · IPQualityScore (IPQS) Threat Risk Scoring

Details

IDIPQualityScore
ProviderIPQualityScore
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10230415
Supported ModulesAgentix XSIAM

README

Overview

IPQualityScore (IPQS) provides enterprise-grade real-time threat intelligence for IP addresses, email addresses, URLs, phone numbers, and files. Detect fraud, phishing, malware, leaked credentials, and abusive behavior using IPQS’s global threat network.

This integration was integrated and tested with version 1.0 of IPQualityScore.

Getting an API Key

  1. Register for a free account at https://www.ipqualityscore.com/create-account. Free accounts include 5,000 API lookups per month.
  2. After registering, log in and visit https://www.ipqualityscore.com/documentation/proxy-detection/overview. Your API key is listed under the Private Key subheading.

Configure IPQualityScore in Cortex

Parameter Description Required
API Key Your IPQS private API key. True
Trust any certificate (not secure) Skip SSL certificate verification. False
Use system proxy settings Route requests through the system proxy. False
IP Suspicious Score Threshold Threshold for fraud score from IP lookup to be marked as suspicious. False
IP Malicious Score Threshold Threshold for fraud score from IP lookup to be marked as malicious. False
Email Suspicious Score Threshold Threshold for fraud score from Email lookup to be marked as suspicious. False
Email Malicious Score Threshold Threshold for fraud score from Email lookup to be marked as malicious. False
Url Suspicious Score Threshold Threshold for fraud score from Url lookup to be marked as suspicious. False
Url Malicious Score Threshold Threshold for fraud score from Url lookup to be marked as malicious. False
Phone Suspicious Score Threshold Threshold for fraud score from Phone lookup to be marked as suspicious. False
Phone Malicious Score Threshold Threshold for fraud score from Phone lookup to be marked as malicious. False
Source Reliability Reliability of the source providing the intelligence data. True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ipqs-ip-reputation

Runs reputation on IPs.

Base Command

ipqs-ip-reputation

Input

Argument Name Description Required
ip IP address(es) to check. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.IP.success Boolean Was the request successful?
IPQualityScore.IP.message String A generic status message, either success or some form of an error notice.
IPQualityScore.IP.fraud_score Number The overall fraud score of the user based on the IP, user agent, language, and any other optionally passed variables. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent. We recommend flagging or blocking traffic with Fraud Scores >= 85, but you may find it beneficial to use a higher or lower threshold.
IPQualityScore.IP.country_code String Two character country code of IP address or “N/A” if unknown.
IPQualityScore.IP.region String Region (state) of IP address if available or “N/A” if unknown.
IPQualityScore.IP.city String City of IP address if available or “N/A” if unknown.
IPQualityScore.IP.ISP String ISP if one is known. Otherwise “N/A”.
IPQualityScore.IP.ASN Number Autonomous System Number if one is known. Null if nonexistent.
IPQualityScore.IP.organization String Organization if one is known. Can be parent company or sub company of the listed ISP. Otherwise “N/A”.
IPQualityScore.IP.latitude Number Latitude of IP address if available or “N/A” if unknown.
IPQualityScore.IP.longitude Number Longitude of IP address if available or “N/A” if unknown.
IPQualityScore.IP.is_crawler Boolean Is this IP associated with being a confirmed crawler from a mainstream search engine such as Googlebot, Bingbot, Yandex, etc. based on hostname or IP address verification.
IPQualityScore.IP.timezone String Timezone of IP address if available or “N/A” if unknown.
IPQualityScore.IP.mobile Boolean Is this user agent a mobile browser? (will always be false if the user agent is not passed in the API request)
IPQualityScore.IP.host String Hostname of the IP address if one is available.
IPQualityScore.IP.proxy Boolean Is this IP address suspected to be a proxy? (SOCKS, Elite, Anonymous, VPN, Tor, etc.)
IPQualityScore.IP.vpn Boolean Is this IP suspected of being a VPN connection? This can include data center ranges which can become active VPNs at any time. The “proxy” status will always be true when this value is true.
IPQualityScore.IP.tor Boolean Is this IP suspected of being a TOR connection? This can include previously active TOR nodes and exits which can become active TOR exits at any time. The “proxy” status will always be true when this value is true.
IPQualityScore.IP.active_vpn Boolean Premium Account Feature - Identifies active VPN connections used by popular VPN services and private VPN servers.
IPQualityScore.IP.active_tor Boolean Premium Account Feature - Identifies active TOR exits on the TOR network.
IPQualityScore.IP.recent_abuse Boolean This value will indicate if there has been any recently verified abuse across our network for this IP address. Abuse could be a confirmed chargeback, compromised device, fake app install, or similar malicious behavior within the past few days.
IPQualityScore.IP.bot_status Boolean Premium Account Feature - Indicates if bots or non-human traffic has recently used this IP address to engage in automated fraudulent behavior. Provides stronger confidence that the IP address is suspicious.
IPQualityScore.IP.connection_type String Classification of the IP address connection type as “Residential”, “Corporate”, “Education”, “Mobile”, or “Data Center”.
IPQualityScore.IP.abuse_velocity String Premium Account Feature - How frequently the IP address is engaging in abuse across the IPQS threat network. Values can be “high”, “medium”, “low”, or “none”. Can be used in combination with the Fraud Score to identify bad behavior.
IPQualityScore.IP.request_id String A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice.
IPQualityScore.IP.address String The IP address that was queried.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
IP.Address string IP address
IP.ASN string The autonomous system name for the IP address, for example: “AS8948”.
IP.Hostname string The hostname that is mapped to this IP address.
IP.Geo.Country string The country in which the IP address is located.
IP.Geo.Description string Additional information about the location.
IP.Malicious.Vendor string The vendor reporting the IP address as malicious.
IP.Malicious.Description string A description explaining why the IP address was reported as malicious.

Command Example

!ipqs-ip-reputation ip="8.8.8.8"

Context Example

{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Reliability": "A - Completely reliable",
        "Score": 3,
        "Type": "ip",
        "Vendor": "IPQualityScore"
    },
    "IP": {
        "ASN": 15169,
        "Address": "8.8.8.8",
        "Geo": {
            "Country": "US",
            "Location": "37.39:-122.07"
        },
        "Hostname": "dns.google",
        "Malicious": {
            "Description": null,
            "Vendor": "IPQualityScore"
        }
    },
    "IPQualityScore": {
        "IP": {
            "ASN": 15169,
            "ISP": "Google",
            "Malicious": {
                "Vendor": "IPQualityScore"
            },
            "abuse_velocity": "high",
            "active_tor": false,
            "active_vpn": false,
            "address": "8.8.8.8",
            "bot_status": true,
            "city": "Mountain View",
            "connection_type": "Data Center",
            "country_code": "US",
            "fraud_score": 100,
            "host": "dns.google",
            "is_crawler": false,
            "latitude": 37.39,
            "longitude": -122.07,
            "message": "Success",
            "mobile": false,
            "organization": "Google",
            "proxy": true,
            "recent_abuse": true,
            "region": "California",
            "request_id": "4DpK9WpOZGPFSPg",
            "success": true,
            "timezone": "America/Los_Angeles",
            "tor": false,
            "vpn": true
        }
    }
}

Human Readable Output

IPQualityScore Results for 8.8.8.8

success message fraud_score country_code region city ISP ASN organization latitude longitude is_crawler timezone mobile host proxy vpn tor active_vpn active_tor recent_abuse bot_status connection_type abuse_velocity request_id address
true Success 100 US California Mountain View Google 15169 Google 37.39 -122.07 false America/Los_Angeles false dns.google true true false false false true true Data Center high 4DpK9WpOZGPFSPg 8.8.8.8

ip

Deprecated. Use ipqs-ip-reputation instead.

Base Command

ip

Input

Argument Name Description Required
ip IP address(es) to check. Supports comma-separated list. Required

Command Example

!ip ip="8.8.8.8"

ipqs-email-reputation

Runs reputation on email addresses.

Base Command

ipqs-email-reputation

Input

Argument Name Description Required
email Email address(es) to check. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.Email.message String A generic status message, either success or some form of an error notice.
IPQualityScore.Email.success Boolean Was the request successful?
IPQualityScore.Email.valid Boolean Does this email address appear valid?
IPQualityScore.Email.disposable Boolean Is this email suspected of belonging to a temporary or disposable mail service? Usually associated with fraudsters and scammers.
IPQualityScore.Email.smtp_score Number Validity score of email server’s SMTP setup. Range: “-1” - “3”. Scores above “-1” can be associated with a valid email. -1 = invalid email address 0 = mail server exists, but is rejecting all mail 1 = mail server exists, but is showing a temporary error 2 = mail server exists, but accepts all email 3 = mail server exists and has verified the email address
IPQualityScore.Email.overall_score Number Overall email validity score. Range: “0” - “4”. Scores above “1” can be associated with a valid email. 0 = invalid email address 1 = dns valid, unreachable mail server 2 = dns valid, temporary mail rejection error 3 = dns valid, accepts all mail 4 = dns valid, verified email exists
IPQualityScore.Email.first_name String Suspected first name based on email. Returns “CORPORATE” if the email is suspected of being a generic company email. Returns “UNKNOWN” if the first name was not determinable.
IPQualityScore.Email.generic Boolean Is this email suspected as being a catch all or shared email for a domain? (“admin@”, “webmaster@”, “newsletter@”, “sales@”, “contact@”, etc.)
IPQualityScore.Email.common Boolean Is this email from a common email provider? (“gmail.com”, “yahoo.com”, “hotmail.com”, etc.)
IPQualityScore.Email.dns_valid Boolean Does the email’s hostname have valid DNS entries? Partial indication of a valid email.
IPQualityScore.Email.honeypot Boolean Is this email believed to be a “honeypot” or “SPAM trap”? Bulk mail sent to these emails increases your risk of being added to block lists by large ISPs & ending up in the spam folder.
IPQualityScore.Email.deliverability String How likely is this email to be delivered to the user and land in their mailbox. Values can be “high”, “medium”, or “low”.
IPQualityScore.Email.frequent_complainer Boolean Indicates if this email frequently unsubscribes from marketing lists or reports email as SPAM.
IPQualityScore.Email.spam_trap_score String Confidence level of the email address being an active SPAM trap. Values can be “high”, “medium”, “low”, or “none”. We recommend scrubbing emails with “high” or “medium” statuses. Avoid “low” emails whenever possible for any promotional mailings.
IPQualityScore.Email.catch_all Boolean Is this email likely to be a “catch all” where the mail server verifies all emails tested against it as valid? It is difficult to determine if the address is truly valid in these scenarios, since the email’s server will not confirm the account’s status.
IPQualityScore.Email.timed_out Boolean Did the connection to the mail service provider timeout during the verification? If so, we recommend increasing the “timeout” variable above the default 7 second value. Lookups that timeout with a “valid” result as false are most likely false and should be not be trusted.
IPQualityScore.Email.suspect Boolean This value indicates if the mail server is currently replying with a temporary error and unable to verify the email address. This status will also be true for “catch all” email addresses as defined below. If this value is true, then we suspect the “valid” result may be tainted and there is not a guarantee that the email address is truly valid.
IPQualityScore.Email.recent_abuse Boolean This value will indicate if there has been any recently verified abuse across our network for this email address. Abuse could be a confirmed chargeback, fake signup, compromised device, fake app install, or similar malicious behavior within the past few days.
IPQualityScore.Email.fraud_score Number The overall Fraud Score of the user based on the email’s reputation and recent behavior across the IPQS threat network. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent.
IPQualityScore.Email.suggested_domain String Default value is “N/A”. Indicates if this email’s domain should in fact be corrected to a popular mail service. This field is useful for catching user typos. For example, an email address with “gmai.com”, would display a suggested domain of “gmail.com”. This feature supports all major mail service providers.
IPQualityScore.Email.leaked Boolean Was this email address associated with a recent database leak from a third party? Leaked accounts pose a risk as they may have become compromised during a database breach.
IPQualityScore.Email.domain_age.human Date A human description of when this domain was registered. (Ex: 3 months ago)
IPQualityScore.Email.domain_age.timestamp Number The unix time since epoch when this domain was first registered. (Ex: 1568061634)
IPQualityScore.Email.domain_age.iso Date The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00)
IPQualityScore.Email.first_seen.human Date A human description of the email address age, using an estimation of the email creation date when IPQS first discovered this email address. (Ex: 3 months ago)
IPQualityScore.Email.first_seen.timestamp Number The unix time since epoch when this email was first analyzed by IPQS. (Ex: 1568061634)
IPQualityScore.Email.first_seen.iso Date The time this email was first analyzed by IPQS in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00)
IPQualityScore.Email.sanitized_email String Sanitized email address with all aliases and masking removed, such as multiple periods for Gmail.com.
IPQualityScore.Email.request_id String A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice.
IPQualityScore.Email.address String The email address that was queried
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-email-reputation email="noreply@example.com"

Context Example

{
    "DBotScore": {
        "Indicator": "noreply@ipqualityscore.com",
        "Reliability": "A - Completely reliable",
        "Score": 3,
        "Type": "email",
        "Vendor": "IPQualityScore"
    },
    "Email": {
        "Address": "noreply@ipqualityscore.com",
        "Domain": "ipqualityscore.com"
    },
    "IPQualityScore": {
        "Email": {
            "Malicious": {
                "Vendor": "IPQualityScore"
            },
            "address": "noreply@ipqualityscore.com",
            "catch_all": true,
            "common": false,
            "deliverability": "low",
            "disposable": false,
            "dns_valid": true,
            "domain_age": {
                "human": "10 years ago",
                "iso": "2011-04-14T23:26:37-04:00",
                "timestamp": 1302837997
            },
            "first_name": "Corporate",
            "first_seen": {
                "human": "2 years ago",
                "iso": "2019-05-06T02:09:06-04:00",
                "timestamp": 1557122946
            },
            "fraud_score": 95,
            "frequent_complainer": false,
            "generic": true,
            "honeypot": true,
            "leaked": false,
            "message": "Success.",
            "overall_score": 3,
            "recent_abuse": true,
            "request_id": "4DpK9WpOZGQDnr7",
            "sanitized_email": "noreply@ipqualityscore.com",
            "smtp_score": 2,
            "spam_trap_score": "medium",
            "success": true,
            "suggested_domain": "N/A",
            "suspect": true,
            "timed_out": false,
            "valid": true
        }
    }
}

Human Readable Output

IPQualityScore Results for noreply@ipqualityscore.com

message success valid disposable smtp_score overall_score first_name generic common dns_valid honeypot deliverability frequent_complainer spam_trap_score catch_all timed_out suspect recent_abuse fraud_score suggested_domain leaked domain_age first_seen sanitized_email request_id address
Success. true true false 2 3 Corporate true false true true low false medium true false true true 95 N/A false human: 10 years ago
timestamp: 1302837997
iso: 2011-04-14T23:26:37-04:00		 human: 2 years ago
timestamp: 1557122946
iso: 2019-05-06T02:09:06-04:00		 noreply@ipqualityscore.com 4DpK9WpOZGQDnr7 noreply@ipqualityscore.com

email

Deprecated. Use ipqs-email-reputation instead.

Base Command

email

Input

Argument Name Description Required
email Email address(es) to check. Supports comma-separated list. Required

Command Example

!email email="noreply@example.com"

ipqs-url-reputation

Runs reputation on URLs.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

ipqs-url-reputation

Input

Argument Name Description Required
url URL(s) to check. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.Url.message String A generic status message, either success or some form of an error notice.
IPQualityScore.Url.success Boolean Was the request successful?
IPQualityScore.Url.unsafe Boolean Is this domain suspected of being unsafe due to phishing, malware, spamming, or abusive behavior? View the confidence level by analyzing the “risk_score”.
IPQualityScore.Url.domain String Domain name of the final destination URL of the scanned link, after following all redirects.
IPQualityScore.Url.ip_address String The IP address corresponding to the server of the domain name.
IPQualityScore.Url.server String The server banner of the domain’s IP address. For example: “nginx/1.16.0”. Value will be “N/A” if unavailable.
IPQualityScore.Url.content_type String MIME type of URL’s content. For example “text/html; charset=UTF-8”. Value will be “N/A” if unavailable.
IPQualityScore.Url.status_code Number HTTP Status Code of the URL’s response. This value should be “200” for a valid website. Value is “0” if URL is unreachable.
IPQualityScore.Url.page_size Number Total number of bytes to download the URL’s content. Value is “0” if URL is unreachable.
IPQualityScore.Url.domain_rank Number Estimated popularity rank of website globally. Value is “0” if the domain is unranked or has low traffic.
IPQualityScore.Url.dns_valid Boolean The domain of the URL has valid DNS records.
IPQualityScore.Url.parking Boolean Is the domain of this URL currently parked with a for sale notice?
IPQualityScore.Url.spamming Boolean Is the domain of this URL associated with email SPAM or abusive email addresses?
IPQualityScore.Url.malware Boolean Is this URL associated with malware or viruses?
IPQualityScore.Url.phishing Boolean Is this URL associated with malicious phishing behavior?
IPQualityScore.Url.suspicious Boolean Is this URL suspected of being malicious or used for phishing or abuse? Use in conjunction with the “risk_score” as a confidence level.
IPQualityScore.Url.risk_score Number The IPQS risk score which estimates the confidence level for malicious URL detection. Risk Scores 85+ are high risk, while Risk Scores = 100 are confirmed as accurate.
IPQualityScore.Url.request_id String A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice.
IPQualityScore.Url.url String The URL being queried.
IPQualityScore.Url.adult Boolean Is this URL or domain hosting dating or adult content?
IPQualityScore.Url.domain_age.human Date A human description of when this domain was registered. (Ex: 3 months ago)
IPQualityScore.Url.domain_age.timestamp Number The unix time since epoch when this domain was first registered. (Ex: 1568061634)
IPQualityScore.Url.domain_age.iso Date The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00)
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
URL.Data String The URL
URL.Malicious.Vendor String The vendor reporting the URL as malicious.

Command Example

!ipqs-url-reputation url="https://www.example.com"

Context Example

{
    "DBotScore": {
        "Indicator": "https://google.com",
        "Reliability": "A - Completely reliable",
        "Score": 0,
        "Type": "url",
        "Vendor": "IPQualityScore"
    },
    "IPQualityScore": {
        "Url": {
            "adult": false,
            "content_type": "text/html; charset=UTF-8",
            "dns_valid": true,
            "domain": "google.com",
            "domain_age": {
                "human": "24 years ago",
                "iso": "1997-09-15T00:00:00-04:00",
                "timestamp": 874296000
            },
            "domain_rank": 1,
            "ip_address": "172.217.11.142",
            "malware": false,
            "message": "Success.",
            "page_size": 39242,
            "parking": false,
            "phishing": false,
            "request_id": "4DpK9WpOZGQFSPi",
            "risk_score": 0,
            "server": " gws\r\n",
            "spamming": false,
            "status_code": 200,
            "success": true,
            "suspicious": false,
            "unsafe": false,
            "url": "https://google.com"
        }
    },
    "URL": {
        "Data": "https://google.com"
    }
}

Human Readable Output

IPQualityScore Results for https://google.com

message success unsafe domain ip_address server content_type status_code page_size domain_rank dns_valid parking spamming malware phishing suspicious adult risk_score domain_age request_id url
Success. true false google.com 172.217.11.142 gws
 text/html; charset=UTF-8 200 39242 1 true false false false false false false 0 human: 24 years ago
timestamp: 874296000
iso: 1997-09-15T00:00:00-04:00		 4DpK9WpOZGQFSPi https://google.com

url

Deprecated. Use ipqs-url-reputation instead.

Base Command

url

Input

Argument Name Description Required
url URL(s) to check. Supports comma-separated list. Required

Command Example

!url url="https://www.example.com"

ipqs-phone-reputation

Runs validation and reputation on phone numbers.

Base Command

ipqs-phone-reputation

Input

Argument Name Description Required
phone Phone number(s) to check in international format (e.g. +14155552671). Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.Phone.success Boolean Was the request successful?
IPQualityScore.Phone.message String A generic status message.
IPQualityScore.Phone.formatted String Internationally formatted phone number.
IPQualityScore.Phone.local_format String Local format of the phone number.
IPQualityScore.Phone.valid Boolean Is the phone number valid?
IPQualityScore.Phone.fraud_score Number Overall fraud score (0–100).
IPQualityScore.Phone.recent_abuse Boolean Has there been recent abuse reported for this number?
IPQualityScore.Phone.VOIP Boolean Is the number a VOIP number?
IPQualityScore.Phone.prepaid Boolean Is this a prepaid phone number?
IPQualityScore.Phone.risky Boolean Is this number considered risky?
IPQualityScore.Phone.active Boolean Is this number currently active?
IPQualityScore.Phone.carrier String Carrier name.
IPQualityScore.Phone.line_type String Type of phone line (e.g., Landline, Mobile).
IPQualityScore.Phone.country String Country code or name associated with the number.
IPQualityScore.Phone.city String City associated with the number.
IPQualityScore.Phone.zip_code String Zip code associated with the number.
IPQualityScore.Phone.region String Region associated with the number.
IPQualityScore.Phone.dialing_code Number Country dialing code.
IPQualityScore.Phone.active_status String Active status description.
IPQualityScore.Phone.sms_domain String SMS domain for the number.
IPQualityScore.Phone.associated_email_addresses.status String Status of associated email addresses.
IPQualityScore.Phone.associated_email_addresses.emails Unknown List of email addresses associated with the number.
IPQualityScore.Phone.user_activity String User activity status.
IPQualityScore.Phone.mnc String Mobile Network Code.
IPQualityScore.Phone.mcc String Mobile Country Code.
IPQualityScore.Phone.leaked Boolean Was this number found in a known data leak?
IPQualityScore.Phone.spammer Boolean Is this number a known spammer?
IPQualityScore.Phone.do_not_call Boolean Is this number on a do-not-call list?
IPQualityScore.Phone.name String Name associated with the number.
IPQualityScore.Phone.timezone String Timezone for the number.
IPQualityScore.Phone.tcpa_blacklist Boolean Is the number on a TCPA blacklist?
IPQualityScore.Phone.accurate_country_code Boolean Is the country code accurate?
IPQualityScore.Phone.sms_email String SMS email address for the number.
IPQualityScore.Phone.number_recycling.message String Number recycling status message.
IPQualityScore.Phone.number_recycling.recently_recycled Boolean Was the number recently recycled?
IPQualityScore.Phone.number_recycling.last_ported_date String Last ported date for the number.
IPQualityScore.Phone.number_recycling.ported Boolean Was the number ported?
IPQualityScore.Phone.identity_data String Identity data associated with the number.
IPQualityScore.Phone.request_id String Unique request identifier.
IPQualityScore.Phone.phone String The phone number that was queried.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-phone-reputation phone="+15555555555"

Context Example

{
    "DBotScore": {
        "Indicator": "+916300445124",
        "Reliability": "A - Completely reliable",
        "Score": 0,
        "Type": "phone",
        "Vendor": "IPQualityScore"
    },
    "IPQualityScore": {
        "Phone": {
            "message": "Phone is valid.",
            "success": true,
            "formatted": "+916300445124",
            "local_format": "063004 45124",
            "valid": true,
            "fraud_score": 0,
            "recent_abuse": false,
            "VOIP": false,
            "prepaid": false,
            "risky": false,
            "active": true,
            "carrier": "Reliance (JIO)",
            "line_type": "Wireless",
            "country": "IN",
            "city": "N/A",
            "zip_code": "N/A",
            "region": "India",
            "dialing_code": 91,
            "active_status": "N/A",
            "sms_domain": "N/A",
            "associated_email_addresses": {
                "status": "No associated emails found.",
                "emails": []
            },
            "user_activity": "high",
            "mnc": "854",
            "mcc": "405",
            "leaked": true,
            "spammer": false,
            "request_id": "gOODapX9Cj",
            "name": "CHETHAN SWAROOP",
            "timezone": "Asia/Kolkata",
            "do_not_call": false,
            "tcpa_blacklist": false,
            "accurate_country_code": false,
            "sms_email": "N/A",
            "number_recycling": {
                "message": "Number recycling feature disabled. Please contact support to activate.",
                "recently_recycled": null,
                "last_ported_date": null,
                "ported": null
            },
            "identity_data": []
        }
    },
    "Phone": {
        "Number": "+916300445124"
    }
}

Human Readable Output

IPQualityScore Results for +15555555555

fraud_score valid active VOIP prepaid risky carrier line_type country phone
20 true true false false false AT&T Mobile US +15555555555

ipqs-username-leaked

Checks if a username has been exposed in known data breaches.

Base Command

ipqs-username-leaked

Input

Argument Name Description Required
username Username(s) to check for leaks. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.Username.success Boolean Was the request successful?
IPQualityScore.Username.message String Status message.
IPQualityScore.Username.request_hash String Unique hash for the request.
IPQualityScore.Username.source Unknown List of sources where the username was found.
IPQualityScore.Username.exposed Boolean Was the username found in a known leak?
IPQualityScore.Username.first_seen.human String Human-readable time when the leak was first seen.
IPQualityScore.Username.first_seen.timestamp Number Unix epoch when the leak was first seen.
IPQualityScore.Username.first_seen.iso String ISO8601 timestamp when the leak was first seen.
IPQualityScore.Username.request_id String Unique request identifier.
IPQualityScore.Username.username String The username that was queried.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-username-leaked username="user@123"

Context Example

{
    "DBotScore": {
        "Indicator": "testuser123",
        "Reliability": "A - Completely reliable",
        "Score": 0,
        "Type": "username",
        "Vendor": "IPQualityScore"
    },
    "IPQualityScore": {
        "Username": {
            "success": true,
            "message": "Success",
            "request_hash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
            "source": [],
            "exposed": false,
            "first_seen": {
                "human": "just now",
                "timestamp": 1776841128,
                "iso": "2026-04-22T02:58:48-04:00"
            },
            "request_id": "gOOSmfym49"
        }
    },
    "Account": {
        "Username": "testuser123"
    }
}

Human Readable Output

IPQualityScore Results for testuser123

success exposed source request_id username
true false   gOOSmfym49 testuser123

ipqs-password-leaked

Checks if a password has been exposed in known data breaches.

Base Command

ipqs-password-leaked

Input

Argument Name Description Required
password Password(s) to check for leaks. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.Password.success Boolean Was the request successful?
IPQualityScore.Password.message String Status message.
IPQualityScore.Password.request_hash String Unique hash for the request.
IPQualityScore.Password.source Unknown List of sources where the password was found.
IPQualityScore.Password.exposed Boolean Was the password found in a known leak?
IPQualityScore.Password.first_seen.human String Human-readable time when the leak was first seen.
IPQualityScore.Password.first_seen.timestamp Number Unix epoch when the leak was first seen.
IPQualityScore.Password.first_seen.iso String ISO8601 timestamp when the leak was first seen.
IPQualityScore.Password.request_id String Unique request identifier.
IPQualityScore.Password.password String The password that was queried.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-password-leaked password="user123"

Context Example

{
    "DBotScore": {
        "Indicator": "abc@123",
        "Reliability": "A - Completely reliable",
        "Score": 3,
        "Type": "password",
        "Vendor": "IPQualityScore"
    },
    "IPQualityScore": {
        "Password": {
            "success": true,
            "message": "Success",
            "request_hash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
            "source": ["Exploit Antipublic", "Dark Web Leaks"],
            "exposed": true,
            "first_seen": {
                "human": "3 years ago",
                "timestamp": 1681115849,
                "iso": "2023-04-10T04:37:29-04:00"
            },
            "request_id": "gOOeuEg77u"
        }
    }
}

Human Readable Output

IPQualityScore Results for provided password

success exposed source request_id
true true Exploit Antipublic, Dark Web Leaks gOOeuEg77u

ipqs-email-leaked

Checks if an email address has been exposed in known data breaches.

Base Command

ipqs-email-leaked

Input

Argument Name Description Required
email Email address(es) to check for leaks. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.LeakedEmail.success Boolean Was the request successful?
IPQualityScore.LeakedEmail.message String Status message.
IPQualityScore.LeakedEmail.request_hash String Unique hash for the request.
IPQualityScore.LeakedEmail.source Unknown List of sources where the email was found.
IPQualityScore.LeakedEmail.exposed Boolean Was the email found in a known leak?
IPQualityScore.LeakedEmail.first_seen.human String Human-readable time when the leak was first seen.
IPQualityScore.LeakedEmail.first_seen.timestamp Number Unix epoch when the leak was first seen.
IPQualityScore.LeakedEmail.first_seen.iso String ISO8601 timestamp when the leak was first seen.
IPQualityScore.LeakedEmail.plain_text_password String Plain text password if found in the leak.
IPQualityScore.LeakedEmail.request_id String Unique request identifier.
IPQualityScore.LeakedEmail.email String The email address that was queried.
IPQualityScore.Email.exposed Boolean Was the email found in a known leak?
IPQualityScore.Email.success Boolean Was the request successful?
IPQualityScore.Email.plain_text_password String Plain text password if found in the leak.
IPQualityScore.Email.first_seen.human String Human-readable time when the leak was first seen.
IPQualityScore.Email.first_seen.iso String ISO8601 timestamp when the leak was first seen.
IPQualityScore.Email.first_seen.timestamp Number Unix epoch when the leak was first seen.
IPQualityScore.Email.request_hash String Unique hash for the request.
IPQualityScore.Email.source Unknown List of sources where the email was found.
IPQualityScore.Email.request_id String Unique request identifier.
IPQualityScore.Email.message String Status message.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-email-leaked email="user@example.com"

Context Example

{
    "DBotScore": {
        "Indicator": "user@example.com",
        "Reliability": "A - Completely reliable",
        "Score": 3,
        "Type": "email",
        "Vendor": "IPQualityScore"
    },
    "IPQualityScore": {
        "LeakedEmail": {
            "success": true,
            "message": "Success",
            "request_hash": "d2b6ff2e611edf5bb40014608a84d75a5b30773272248c28fa79db3bd5739677",
            "source": ["Dark Web Leaks"],
            "exposed": true,
            "first_seen": {
                "human": "6 years ago",
                "timestamp": 1591641120,
                "iso": "2020-06-08T14:32:00-04:00"
            },
            "plain_text_password": false,
            "request_id": "gOOsrUX4lK",
            "email": "user@example.com"
        }
    },
    "Email": {
        "Address": "user@example.com"
    }
}

Human Readable Output

IPQualityScore Results for user@example.com

success exposed plain_text_password source request_id email
true true false Dark Web Leaks gOOsrUX4lK user@example.com

ipqs-file-scan

Uploads a file and scans it using the IPQualityScore Malware File Scanner API. First attempts a cached lookup by file hash; if not cached, the file is submitted for scanning. Polls for results automatically if the scan is pending.

Base Command

ipqs-file-scan

Input

Argument Name Description Required
entry_id The entry id of the uploaded file in the War Room. Required

Context Output

Path Type Description
IPQualityScore.FileScan.success Boolean Was the request successful?
IPQualityScore.FileScan.message String Status message.
IPQualityScore.FileScan.file_name String The file name that was scanned.
IPQualityScore.FileScan.file_hash String SHA256 hash of the file.
IPQualityScore.FileScan.type String Type of operation performed: “scan” or “lookup”.
IPQualityScore.FileScan.status String Scan status: “pending” or “complete”.
IPQualityScore.FileScan.detected Boolean Was the file detected as malicious?
IPQualityScore.FileScan.detected_scans Number Number of engines that detected the file as malicious.
IPQualityScore.FileScan.total_scans Number Total number of scan engines used.
IPQualityScore.FileScan.result String Detailed scan engine results.
IPQualityScore.FileScan.file_size Number File size in bytes.
IPQualityScore.FileScan.file_type String MIME type of the file.
IPQualityScore.FileScan.sha1 String SHA1 hash of the file.
IPQualityScore.FileScan.md5 String MD5 hash of the file.
IPQualityScore.FileScan.update_url String URL to poll for updated scan results.
IPQualityScore.FileScan.request_id String Unique request identifier.
File.SHA256 String SHA256 hash of the file.
File.SHA1 String SHA1 hash of the file.
File.MD5 String MD5 hash of the file.
File.Size Number File size in bytes.
File.Type String File MIME type.
File.Malicious.Count Number Number of detections.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type (file).
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-file-scan entry_id="212@_13"

Human Readable Output

IPQualityScore File Scan Result

file_name file_hash detected detected_scans total_scans status file_type file_size sha1 md5 request_id
ipks.exe a35e17ca3d1c0d7363ad4a9c358260d1343033212299ac37cd43471aaa3478b9 false 0 7 done text/html 61049 6751c12507d83f850edaceea8bd51031d27ee363 942af291e78ae29787c0069611ec58e3 fmXlsRjJ4x

ipqs-url-file-scan

Submits a URL to the IPQualityScore Malware File Scanner API. First attempts a cached lookup; if not cached, the URL is submitted for scanning. Polls for results automatically if the scan is pending.

Base Command

ipqs-url-file-scan

Input

Argument Name Description Required
url URL(s) to scan for malware. Supports comma-separated list. Required

Context Output

Path Type Description
IPQualityScore.URLFileScan.success Boolean Was the request successful?
IPQualityScore.URLFileScan.message String Status message.
IPQualityScore.URLFileScan.file_name String The URL that was scanned.
IPQualityScore.URLFileScan.file_hash String SHA256 hash of the scanned content.
IPQualityScore.URLFileScan.type String Type of operation performed: “scan” or “lookup”.
IPQualityScore.URLFileScan.status String Scan status: “pending” or “complete”.
IPQualityScore.URLFileScan.detected Boolean Was the URL detected as malicious?
IPQualityScore.URLFileScan.detected_scans Number Number of engines that detected the URL as malicious.
IPQualityScore.URLFileScan.total_scans Number Total number of scan engines used.
IPQualityScore.URLFileScan.result String Detailed scan engine results.
IPQualityScore.URLFileScan.file_size Number Size of the scanned content in bytes.
IPQualityScore.URLFileScan.file_type String MIME type of the scanned content.
IPQualityScore.URLFileScan.sha1 String SHA1 hash of the scanned content.
IPQualityScore.URLFileScan.md5 String MD5 hash of the scanned content.
IPQualityScore.URLFileScan.update_url String URL to poll for updated scan results.
IPQualityScore.URLFileScan.scan_date Unknown Date and time when the scan was performed.
IPQualityScore.URLFileScan.request_id String Unique request identifier.
URL.Data String The URL that was scanned.
URL.Malicious.Description String Description of why the URL was flagged as malicious.
URL.Malicious.Vendor String The vendor that identified the URL as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type (URL).
DBotScore.Vendor String The vendor used to calculate the score.

Command Example

!ipqs-url-file-scan url="http://www.example.com/"

Human Readable Output

IPQualityScore URL Scan Result

file_name file_hash detected detected_scans total_scans status file_type file_size sha1 md5 request_id
M94scZj.exe a35e17ca3d1c0d7363ad4a9c358260d1343033212299ac37cd43471aaa3478b9 false 0 7 done text/html 61049 6751c12507d83f850edaceea8bd51031d27ee363 942af291e78ae29787c0069611ec58e3 fmXlsRjJ4x

Scoring Thresholds

Indicator Type Suspicious (default) Malicious (default) Score Field
IP 75 90 fraud_score
Email 75 90 fraud_score
URL (reputation) 75 90 risk_score
Phone 75 90 fraud_score
File (malware scan) 1 detection 5 detections detected_scans
URL (malware scan) 1 detection 5 detections detected_scans

Configuration parameters

  • apikey — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • ip_suspicious_score_threshold — IP Suspicious Score Threshold
  • ip_malicious_score_threshold — IP Malicious Score Threshold
  • email_suspicious_score_threshold — Email Suspicious Score Threshold
  • email_malicious_score_threshold — Email Malicious Score Threshold
  • url_suspicious_score_threshold — Url Suspicious Score Threshold
  • url_malicious_score_threshold — Url Malicious Score Threshold
  • phone_suspicious_score_threshold — Phone Suspicious Score Threshold
  • phone_malicious_score_threshold — Phone Malicious Score Threshold
  • feedReliability — Source Reliability (required)

Commands (12)

  • email Deprecated

    Deprecated. Use ipqs-email-reputation instead.

  • ip Deprecated

    Deprecated. Use ipqs-ip-reputation instead.

  • ipqs-email-leaked

    Checks if an email has been leaked in known breaches.

  • ipqs-email-reputation

    Runs reputation on email addresses.

  • ipqs-file-scan

    Uploads and scans a file using IPQualityScore Malware File Scanner API.

  • ipqs-ip-reputation

    Runs reputation on IPs.

  • ipqs-password-leaked

    Checks if a password has been leaked in known breaches.

  • ipqs-phone-reputation

    Runs validation and reputation on phone numbers.

  • ipqs-url-file-scan

    Scans a URL using IPQualityScore Malware File Scanner API.

  • ipqs-url-reputation

    Runs reputation on URLs.

  • ipqs-username-leaked

    Checks if a username has been leaked in known breaches.

  • url Deprecated

    Deprecated. Use ipqs-url-reputation instead.

Source

IPQualityScore.py IPQualityScore_test.py IPQualityScore.yml IPQualityScore_description.md command_examples.txt
Download History Raw 
name: IPQualityScore
display: IPQualityScore
category: Data Enrichment & Threat Intelligence
provider: IPQualityScore
sectionorder:
  - Connect
  - Collect
commonfields:
  id: IPQualityScore
  version: -1
fromversion: 5.0.0
configuration:
  - display: API Key
    name: apikey
    required: true
    type: 4
    section: Connect
  - display: Trust any certificate (not secure)
    name: insecure
    type: 8
    required: false
    section: Connect
  - display: Use system proxy settings
    name: proxy
    type: 8
    required: false
    section: Connect
  - additionalinfo: Threshold for fraud score from IP lookup to be marked as suspicious
    defaultvalue: "75"
    display: IP Suspicious Score Threshold
    name: ip_suspicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from IP lookup to be marked as malicious
    defaultvalue: "90"
    display: IP Malicious Score Threshold
    name: ip_malicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from Email lookup to be marked as suspicious
    defaultvalue: "75"
    display: Email Suspicious Score Threshold
    name: email_suspicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from Email lookup to be marked as malicious
    defaultvalue: "90"
    display: Email Malicious Score Threshold
    name: email_malicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from Url lookup to be marked as suspicious
    defaultvalue: "75"
    display: Url Suspicious Score Threshold
    name: url_suspicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from Url lookup to be marked as malicious
    defaultvalue: "90"
    display: Url Malicious Score Threshold
    name: url_malicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from Phone lookup to be marked as suspicious
    defaultvalue: "75"
    display: Phone Suspicious Score Threshold
    name: phone_suspicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Threshold for fraud score from Phone lookup to be marked as malicious
    defaultvalue: "90"
    display: Phone Malicious Score Threshold
    name: phone_malicious_score_threshold
    type: 0
    required: false
    section: Collect
  - additionalinfo: Reliability of the source providing the intelligence data
    defaultvalue: F - Reliability cannot be judged
    display: Source Reliability
    name: feedReliability
    options:
      - A - Completely reliable
      - B - Usually reliable
      - C - Fairly reliable
      - D - Not usually reliable
      - E - Unreliable
      - F - Reliability cannot be judged
    required: true
    type: 15
    section: Collect
description: Proactively Prevent Fraud.
script:
  commands:
    - arguments:
        - default: true
          description: Phone number to check.
          isArray: true
          name: phone
          required: true
      description: Runs validation and reputation on phone numbers.
      name: ipqs-phone-reputation
      outputs:
        - contextPath: IPQualityScore.Phone.message
          type: String
          description: Status message for the phone check.
        - contextPath: IPQualityScore.Phone.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.Phone.formatted
          type: String
          description: Internationally formatted phone number.
        - contextPath: IPQualityScore.Phone.local_format
          type: String
          description: Local format of the phone number.
        - contextPath: IPQualityScore.Phone.valid
          type: Boolean
          description: Is the phone number valid?
        - contextPath: IPQualityScore.Phone.fraud_score
          type: Number
          description: Fraud score for the phone number.
        - contextPath: IPQualityScore.Phone.recent_abuse
          type: Boolean
          description: Has there been recent abuse for this number?
        - contextPath: IPQualityScore.Phone.VOIP
          type: Boolean
          description: Is the number a VOIP?
        - contextPath: IPQualityScore.Phone.prepaid
          type: Boolean
          description: Is the number prepaid?
        - contextPath: IPQualityScore.Phone.risky
          type: Boolean
          description: Is the number considered risky?
        - contextPath: IPQualityScore.Phone.active
          type: Boolean
          description: Is the number currently active?
        - contextPath: IPQualityScore.Phone.carrier
          type: String
          description: Carrier name.
        - contextPath: IPQualityScore.Phone.line_type
          type: String
          description: Type of phone line (e.g., Landline, Mobile).
        - contextPath: IPQualityScore.Phone.country
          type: String
          description: Country code or name.
        - contextPath: IPQualityScore.Phone.city
          type: String
          description: City for the phone number.
        - contextPath: IPQualityScore.Phone.zip_code
          type: String
          description: Zip code for the phone number.
        - contextPath: IPQualityScore.Phone.region
          type: String
          description: Region for the phone number.
        - contextPath: IPQualityScore.Phone.dialing_code
          type: Number
          description: Country dialing code.
        - contextPath: IPQualityScore.Phone.active_status
          type: String
          description: Active status string.
        - contextPath: IPQualityScore.Phone.sms_domain
          type: String
          description: SMS domain for the number.
        - contextPath: IPQualityScore.Phone.associated_email_addresses.status
          type: String
          description: Status of associated email addresses.
        - contextPath: IPQualityScore.Phone.associated_email_addresses.emails
          type: String
          description: List of associated emails.
        - contextPath: IPQualityScore.Phone.user_activity
          type: String
          description: User activity status.
        - contextPath: IPQualityScore.Phone.mnc
          type: String
          description: Mobile network code.
        - contextPath: IPQualityScore.Phone.mcc
          type: String
          description: Mobile country code.
        - contextPath: IPQualityScore.Phone.leaked
          type: Boolean
          description: Was the number found in a leak?
        - contextPath: IPQualityScore.Phone.spammer
          type: Boolean
          description: Is the number a known spammer?
        - contextPath: IPQualityScore.Phone.request_id
          type: String
          description: Unique request ID.
        - contextPath: IPQualityScore.Phone.name
          type: String
          description: Name associated with the number.
        - contextPath: IPQualityScore.Phone.timezone
          type: String
          description: Timezone for the number.
        - contextPath: IPQualityScore.Phone.do_not_call
          type: Boolean
          description: Is the number on a do-not-call list?
        - contextPath: IPQualityScore.Phone.tcpa_blacklist
          type: Boolean
          description: Is the number on a TCPA blacklist?
        - contextPath: IPQualityScore.Phone.accurate_country_code
          type: Boolean
          description: Is the country code accurate?
        - contextPath: IPQualityScore.Phone.sms_email
          type: String
          description: SMS email address for the number.
        - contextPath: IPQualityScore.Phone.number_recycling.message
          type: String
          description: Number recycling message.
        - contextPath: IPQualityScore.Phone.number_recycling.recently_recycled
          type: Boolean
          description: Was the number recently recycled?
        - contextPath: IPQualityScore.Phone.number_recycling.last_ported_date
          type: String
          description: Last ported date.
        - contextPath: IPQualityScore.Phone.number_recycling.ported
          type: Boolean
          description: Was the number ported?
        - contextPath: IPQualityScore.Phone.identity_data
          type: String
          description: Identity data array.
        - contextPath: IPQualityScore.Phone.phone
          type: String
          description: The phone number that was queried.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
    - arguments:
        - default: true
          description: IP address to check.
          isArray: true
          name: ip
          required: true
      description: Runs reputation on IPs.
      name: ipqs-ip-reputation
      outputs:
        - contextPath: IPQualityScore.IP.success
          type: Boolean
          description: "Was the request successful?"
        - contextPath: IPQualityScore.IP.message
          type: String
          description: "A generic status message, either success or some form of an error notice."
        - contextPath: IPQualityScore.IP.fraud_score
          type: Number
          description: "The overall fraud score of the user based on the IP, user agent, language, and any other optionally passed variables. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent. We recommend flagging or blocking traffic with Fraud Scores >= 85, but you may find it beneficial to use a higher or lower threshold."
        - contextPath: IPQualityScore.IP.country_code
          type: String
          description: 'Two character country code of IP address or "N/A" if unknown.'
        - contextPath: IPQualityScore.IP.region
          type: String
          description: 'Region (state) of IP address if available or "N/A" if unknown.'
        - contextPath: IPQualityScore.IP.city
          type: String
          description: 'City of IP address if available or "N/A" if unknown.'
        - contextPath: IPQualityScore.IP.ISP
          type: String
          description: 'ISP if one is known. Otherwise "N/A".'
        - contextPath: IPQualityScore.IP.ASN
          type: Number
          description: "Autonomous System Number if one is known. Null if nonexistent."
        - contextPath: IPQualityScore.IP.organization
          type: String
          description: 'Organization if one is known. Can be parent company or sub company of the listed ISP. Otherwise "N/A".'
        - contextPath: IPQualityScore.IP.latitude
          type: Number
          description: 'Latitude of IP address if available or "N/A" if unknown.'
        - contextPath: IPQualityScore.IP.longitude
          type: Number
          description: 'Longitude of IP address if available or "N/A" if unknown.'
        - contextPath: IPQualityScore.IP.is_crawler
          type: Boolean
          description: "Is this IP associated with being a confirmed crawler from a mainstream search engine such as Googlebot, Bingbot, Yandex, etc. based on hostname or IP address verification."
        - contextPath: IPQualityScore.IP.timezone
          type: String
          description: 'Timezone of IP address if available or "N/A" if unknown.'
        - contextPath: IPQualityScore.IP.mobile
          type: Boolean
          description: "Is this user agent a mobile browser? (will always be false if the user agent is not passed in the API request)."
        - contextPath: IPQualityScore.IP.host
          type: String
          description: "Hostname of the IP address if one is available."
        - contextPath: IPQualityScore.IP.proxy
          type: Boolean
          description: "Is this IP address suspected to be a proxy? (SOCKS, Elite, Anonymous, VPN, Tor, etc.)"
        - contextPath: IPQualityScore.IP.vpn
          type: Boolean
          description: 'Is this IP suspected of being a VPN connection? This can include data center ranges which can become active VPNs at any time. The "proxy" status will always be true when this value is true.'
        - contextPath: IPQualityScore.IP.tor
          type: Boolean
          description: 'Is this IP suspected of being a TOR connection? This can include previously active TOR nodes and exits which can become active TOR exits at any time. The "proxy" status will always be true when this value is true.'
        - contextPath: IPQualityScore.IP.active_vpn
          type: Boolean
          description: "Premium Account Feature - Identifies active VPN connections used by popular VPN services and private VPN servers."
        - contextPath: IPQualityScore.IP.active_tor
          type: Boolean
          description: "Premium Account Feature - Identifies active TOR exits on the TOR network."
        - contextPath: IPQualityScore.IP.recent_abuse
          type: Boolean
          description: "This value will indicate if there has been any recently verified abuse across our network for this IP address. Abuse could be a confirmed chargeback, compromised device, fake app install, or similar malicious behavior within the past few days."
        - contextPath: IPQualityScore.IP.bot_status
          type: Boolean
          description: "Premium Account Feature - Indicates if bots or non-human traffic has recently used this IP address to engage in automated fraudulent behavior. Provides stronger confidence that the IP address is suspicious."
        - contextPath: IPQualityScore.IP.connection_type
          type: String
          description: 'Classification of the IP address connection type as "Residential", "Corporate", "Education", "Mobile", or "Data Center".'
        - contextPath: IPQualityScore.IP.abuse_velocity
          type: String
          description: 'Premium Account Feature - How frequently the IP address is engaging in abuse across the IPQS threat network. Values can be "high", "medium", "low", or "none". Can be used in combination with the Fraud Score to identify bad behavior.'
        - contextPath: IPQualityScore.IP.request_id
          type: String
          description: "A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice."
        - contextPath: IPQualityScore.IP.address
          type: String
          description: "The IP address that was queried."
        - contextPath: DBotScore.Indicator
          type: String
          description: "The indicator that was tested."
        - contextPath: DBotScore.Score
          type: Number
          description: "The actual score."
        - contextPath: DBotScore.Type
          type: String
          description: "The indicator type."
        - contextPath: DBotScore.Vendor
          type: String
          description: "The vendor used to calculate the score."
        - contextPath: IP.Address
          type: string
          description: "The IP address."
        - contextPath: IP.ASN
          type: string
          description: 'The autonomous system name for the IP address, for example: "AS8948".'
        - contextPath: IP.Hostname
          type: string
          description: "The hostname that is mapped to this IP address."
        - contextPath: IP.Geo.Country
          type: string
          description: "The country in which the IP address is located."
        - contextPath: IP.Geo.Description
          type: string
          description: "Additional information about the location."
        - contextPath: IP.Malicious.Vendor
          type: string
          description: "The vendor reporting the IP address as malicious."
        - contextPath: IP.Malicious.Description
          type: string
          description: "A description explaining why the IP address was reported as malicious."
    - arguments:
        - default: true
          description: Email address to check.
          isArray: true
          name: email
          required: true
      description: Runs reputation on email addresses.
      name: ipqs-email-reputation
      outputs:
        - contextPath: IPQualityScore.Email.message
          type: String
          description: "A generic status message, either success or some form of an error notice."
        - contextPath: IPQualityScore.Email.success
          type: Boolean
          description: "Was the request successful?"
        - contextPath: IPQualityScore.Email.valid
          type: Boolean
          description: "Does this email address appear valid?"
        - contextPath: IPQualityScore.Email.disposable
          type: Boolean
          description: "Is this email suspected of belonging to a temporary or disposable mail service? Usually associated with fraudsters and scammers."
        - contextPath: IPQualityScore.Email.smtp_score
          type: Number
          description: 'Validity score of email server''s SMTP setup. Range: "-1" - "3". Scores above "-1" can be associated with a valid email. -1 = invalid email address 0 = mail server exists, but is rejecting all mail 1 = mail server exists, but is showing a temporary error 2 = mail server exists, but accepts all email 3 = mail server exists and has verified the email address.'
        - contextPath: IPQualityScore.Email.overall_score
          type: Number
          description: 'Overall email validity score. Range: "0" - "4". Scores above "1" can be associated with a valid email. 0 = invalid email address 1 = dns valid, unreachable mail server 2 = dns valid, temporary mail rejection error 3 = dns valid, accepts all mail 4 = dns valid, verified email exists.'
        - contextPath: IPQualityScore.Email.first_name
          type: String
          description: 'Suspected first name based on email. Returns "CORPORATE" if the email is suspected of being a generic company email. Returns "UNKNOWN" if the first name was not determinable.'
        - contextPath: IPQualityScore.Email.generic
          type: Boolean
          description: 'Is this email suspected as being a catch all or shared email for a domain? ("admin@", "webmaster@", "newsletter@", "sales@", "contact@", etc.)'
        - contextPath: IPQualityScore.Email.common
          type: Boolean
          description: 'Is this email from a common email provider? ("gmail.com", "yahoo.com", "hotmail.com", etc.)'
        - contextPath: IPQualityScore.Email.dns_valid
          type: Boolean
          description: "Does the email's hostname have valid DNS entries? Partial indication of a valid email."
        - contextPath: IPQualityScore.Email.honeypot
          type: Boolean
          description: 'Is this email believed to be a "honeypot" or "SPAM trap"? Bulk mail sent to these emails increases your risk of being added to block lists by large ISPs & ending up in the spam folder.'
        - contextPath: IPQualityScore.Email.deliverability
          type: String
          description: "How likely is this email to be delivered to the user and land in their mailbox. Values can be \"high\", \"medium\", or \"low\".\t"
        - contextPath: IPQualityScore.Email.frequent_complainer
          type: Boolean
          description: "Indicates if this email frequently unsubscribes from marketing lists or reports email as SPAM."
        - contextPath: IPQualityScore.Email.spam_trap_score
          type: String
          description: 'Confidence level of the email address being an active SPAM trap. Values can be "high", "medium", "low", or "none". We recommend scrubbing emails with "high" or "medium" statuses. Avoid "low" emails whenever possible for any promotional mailings.'
        - contextPath: IPQualityScore.Email.catch_all
          type: Boolean
          description: 'Is this email likely to be a "catch all" where the mail server verifies all emails tested against it as valid? It is difficult to determine if the address is truly valid in these scenarios, since the email''s server will not confirm the account''s status.'
        - contextPath: IPQualityScore.Email.timed_out
          type: Boolean
          description: 'Did the connection to the mail service provider timeout during the verification? If so, we recommend increasing the "timeout" variable above the default 7 second value. Lookups that timeout with a "valid" result as false are most likely false and should be not be trusted.'
        - contextPath: IPQualityScore.Email.suspect
          type: Boolean
          description: 'This value indicates if the mail server is currently replying with a temporary error and unable to verify the email address. This status will also be true for "catch all" email addresses as defined below. If this value is true, then we suspect the "valid" result may be tainted and there is not a guarantee that the email address is truly valid.'
        - contextPath: IPQualityScore.Email.recent_abuse
          type: Boolean
          description: "This value will indicate if there has been any recently verified abuse across our network for this email address. Abuse could be a confirmed chargeback, fake signup, compromised device, fake app install, or similar malicious behavior within the past few days."
        - contextPath: IPQualityScore.Email.fraud_score
          type: Number
          description: "The overall Fraud Score of the user based on the email's reputation and recent behavior across the IPQS threat network. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent."
        - contextPath: IPQualityScore.Email.suggested_domain
          type: String
          description: 'Default value is "N/A". Indicates if this email''s domain should in fact be corrected to a popular mail service. This field is useful for catching user typos. For example, an email address with "gmai.com", would display a suggested domain of "gmail.com". This feature supports all major mail service providers.'
        - contextPath: IPQualityScore.Email.leaked
          type: Boolean
          description: "Was this email address associated with a recent database leak from a third party? Leaked accounts pose a risk as they may have become compromised during a database breach.\t"
        - contextPath: IPQualityScore.Email.domain_age.human
          type: Date
          description: "A human description of when this domain was registered. (Ex: 3 months ago)."
        - contextPath: IPQualityScore.Email.domain_age.timestamp
          type: Number
          description: "The unix time since epoch when this domain was first registered. (Ex: 1568061634)."
        - contextPath: IPQualityScore.Email.domain_age.iso
          type: Date
          description: "The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00)."
        - contextPath: IPQualityScore.Email.first_seen.human
          type: Date
          description: "A human description of the email address age, using an estimation of the email creation date when IPQS first discovered this email address. (Ex: 3 months ago)."
        - contextPath: IPQualityScore.Email.first_seen.timestamp
          type: Number
          description: "The unix time since epoch when this email was first analyzed by IPQS. (Ex: 1568061634)."
        - contextPath: IPQualityScore.Email.first_seen.iso
          type: Date
          description: "The time this email was first analyzed by IPQS in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00)."
        - contextPath: IPQualityScore.Email.sanitized_email
          type: String
          description: "Sanitized email address with all aliases and masking removed, such as multiple periods for Gmail.com."
        - contextPath: IPQualityScore.Email.request_id
          type: String
          description: "A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice."
        - contextPath: IPQualityScore.Email.address
          type: String
          description: "The email address that was queried."
        - contextPath: DBotScore.Indicator
          type: String
          description: "The indicator that was tested."
        - contextPath: DBotScore.Score
          type: Number
          description: "The actual score."
        - contextPath: DBotScore.Type
          type: String
          description: "The indicator type."
        - contextPath: DBotScore.Vendor
          type: String
          description: "The vendor used to calculate the score."
    - arguments:
        - default: true
          description: Url address to check.
          isArray: true
          name: url
          required: true
      description: Runs reputation on URLs.
      name: ipqs-url-reputation
      outputs:
        - contextPath: IPQualityScore.Url.message
          type: String
          description: "A generic status message, either success or some form of an error notice."
        - contextPath: IPQualityScore.Url.success
          type: Boolean
          description: "Was the request successful?"
        - contextPath: IPQualityScore.Url.unsafe
          type: Boolean
          description: 'Is this domain suspected of being unsafe due to phishing, malware, spamming, or abusive behavior? View the confidence level by analyzing the "risk_score".'
        - contextPath: IPQualityScore.Url.domain
          type: String
          description: "Domain name of the final destination URL of the scanned link, after following all redirects."
        - contextPath: IPQualityScore.Url.ip_address
          type: String
          description: "The IP address corresponding to the server of the domain name."
        - contextPath: IPQualityScore.Url.server
          type: String
          description: 'The server banner of the domain''s IP address. For example: "nginx/1.16.0". Value will be "N/A" if unavailable.'
        - contextPath: IPQualityScore.Url.content_type
          type: String
          description: 'MIME type of URL''s content. For example "text/html; charset=UTF-8". Value will be "N/A" if unavailable.'
        - contextPath: IPQualityScore.Url.status_code
          type: Number
          description: 'HTTP Status Code of the URL''s response. This value should be "200" for a valid website. Value is "0" if URL is unreachable.'
        - contextPath: IPQualityScore.Url.page_size
          type: Number
          description: 'Total number of bytes to download the URL''s content. Value is "0" if URL is unreachable.'
        - contextPath: IPQualityScore.Url.domain_rank
          type: Number
          description: 'Estimated popularity rank of website globally. Value is "0" if the domain is unranked or has low traffic.'
        - contextPath: IPQualityScore.Url.dns_valid
          type: Boolean
          description: "The domain of the URL has valid DNS records."
        - contextPath: IPQualityScore.Url.parking
          type: Boolean
          description: "Is the domain of this URL currently parked with a for sale notice?"
        - contextPath: IPQualityScore.Url.spamming
          type: Boolean
          description: "Is the domain of this URL associated with email SPAM or abusive email addresses?"
        - contextPath: IPQualityScore.Url.malware
          type: Boolean
          description: "Is this URL associated with malware or viruses?"
        - contextPath: IPQualityScore.Url.phishing
          type: Boolean
          description: "Is this URL associated with malicious phishing behavior?"
        - contextPath: IPQualityScore.Url.suspicious
          type: Boolean
          description: 'Is this URL suspected of being malicious or used for phishing or abuse? Use in conjunction with the "risk_score" as a confidence level.'
        - contextPath: IPQualityScore.Url.risk_score
          type: Number
          description: "The IPQS risk score which estimates the confidence level for malicious URL detection. Risk Scores 85+ are high risk, while Risk Scores = 100 are confirmed as accurate."
        - contextPath: IPQualityScore.Url.request_id
          type: String
          description: "A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice."
        - contextPath: IPQualityScore.Url.url
          type: String
          description: "The URL being queried."
        - contextPath: IPQualityScore.Url.adult
          type: Boolean
          description: "Is this URL or domain hosting dating or adult content?"
        - contextPath: IPQualityScore.Url.domain_age.human
          type: Date
          description: "A human description of when this domain was registered. (Ex: 3 months ago)."
        - contextPath: IPQualityScore.Url.domain_age.timestamp
          type: Number
          description: "The unix time since epoch when this domain was first registered. (Ex: 1568061634)."
        - contextPath: IPQualityScore.Url.domain_age.iso
          type: Date
          description: "The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00)."
        - contextPath: DBotScore.Indicator
          type: String
          description: "The indicator that was tested."
        - contextPath: DBotScore.Score
          type: Number
          description: "The actual score."
        - contextPath: DBotScore.Type
          type: String
          description: "The indicator type."
        - contextPath: DBotScore.Vendor
          type: String
          description: "The vendor used to calculate the score."
        - contextPath: URL.Data
          description: The URL.
          type: String
        - contextPath: URL.Malicious.Vendor
          description: The vendor reporting the URL as malicious.
          type: String
    - arguments:
        - default: true
          description: Username to check for leaks.
          isArray: true
          name: username
          required: true
      description: Checks if a username has been leaked in known breaches.
      name: ipqs-username-leaked
      outputs:
        - contextPath: IPQualityScore.Username.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.Username.message
          type: String
          description: Status message for the username check.
        - contextPath: IPQualityScore.Username.request_hash
          type: String
          description: Unique hash for the request.
        - contextPath: IPQualityScore.Username.source
          type: String
          description: List of sources where the username was found (can be empty).
        - contextPath: IPQualityScore.Username.exposed
          type: Boolean
          description: Whether the username was found in a leak.
        - contextPath: IPQualityScore.Username.first_seen.human
          type: String
          description: Human-readable time when first seen.
        - contextPath: IPQualityScore.Username.first_seen.timestamp
          type: Number
          description: Timestamp when first seen.
        - contextPath: IPQualityScore.Username.first_seen.iso
          type: String
          description: ISO8601 time when first seen.
        - contextPath: IPQualityScore.Username.request_id
          type: String
          description: Unique request ID.
        - contextPath: IPQualityScore.Username.username
          type: String
          description: The username that was queried.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
    - arguments:
        - default: true
          description: Password to check for leaks.
          isArray: true
          name: password
          required: true
      description: Checks if a password has been leaked in known breaches.
      name: ipqs-password-leaked
      outputs:
        - contextPath: IPQualityScore.Password.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.Password.message
          type: String
          description: Status message for the password check.
        - contextPath: IPQualityScore.Password.request_hash
          type: String
          description: Unique hash for the request.
        - contextPath: IPQualityScore.Password.source
          type: String
          description: List of sources where the password was found (can be empty).
        - contextPath: IPQualityScore.Password.exposed
          type: Boolean
          description: Whether the password was found in a leak.
        - contextPath: IPQualityScore.Password.first_seen.human
          type: String
          description: Human-readable time when first seen.
        - contextPath: IPQualityScore.Password.first_seen.timestamp
          type: Number
          description: Timestamp when first seen.
        - contextPath: IPQualityScore.Password.first_seen.iso
          type: String
          description: ISO8601 time when first seen.
        - contextPath: IPQualityScore.Password.request_id
          type: String
          description: Unique request ID.
        - contextPath: IPQualityScore.Password.password
          type: String
          description: The password that was queried.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
    - arguments:
        - default: true
          description: Email to check for leaks.
          isArray: true
          name: email
          required: true
      description: Checks if an email has been leaked in known breaches.
      name: ipqs-email-leaked
      outputs:
        - contextPath: IPQualityScore.Email.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.Email.message
          type: String
          description: Status message for the email check.
        - contextPath: IPQualityScore.Email.request_hash
          type: String
          description: Unique hash for the request.
        - contextPath: IPQualityScore.Email.source
          type: String
          description: List of sources where the email was found (can be empty).
        - contextPath: IPQualityScore.Email.exposed
          type: Boolean
          description: Whether the email was found in a leak.
        - contextPath: IPQualityScore.Email.first_seen.human
          type: String
          description: Human-readable time when first seen.
        - contextPath: IPQualityScore.Email.first_seen.timestamp
          type: Number
          description: Timestamp when first seen.
        - contextPath: IPQualityScore.Email.first_seen.iso
          type: String
          description: ISO8601 time when first seen.
        - contextPath: IPQualityScore.Email.plain_text_password
          type: String
          description: The plain text password if it was found in a leak.
        - contextPath: IPQualityScore.Email.request_id
          type: String
          description: Unique request ID.
        - contextPath: IPQualityScore.LeakedEmail.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.LeakedEmail.message
          type: String
          description: Status message for the email check.
        - contextPath: IPQualityScore.LeakedEmail.request_hash
          type: String
          description: Unique hash for the request.
        - contextPath: IPQualityScore.LeakedEmail.source
          type: String
          description: List of sources where the email was found (can be empty).
        - contextPath: IPQualityScore.LeakedEmail.exposed
          type: Boolean
          description: Whether the email was found in a leak.
        - contextPath: IPQualityScore.LeakedEmail.first_seen.human
          type: String
          description: Human-readable time when first seen.
        - contextPath: IPQualityScore.LeakedEmail.first_seen.timestamp
          type: Number
          description: Timestamp when first seen.
        - contextPath: IPQualityScore.LeakedEmail.first_seen.iso
          type: String
          description: ISO8601 time when first seen.
        - contextPath: IPQualityScore.LeakedEmail.plain_text_password
          type: String
          description: The plain text password if it was found in a leak.
        - contextPath: IPQualityScore.LeakedEmail.request_id
          type: String
          description: Unique request ID.
        - contextPath: IPQualityScore.LeakedEmail.email
          type: String
          description: The email address that was queried.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
    - arguments:
        - name: entry_id
          description: Entry ID of the uploaded file to scan.
          required: true
        - name: request_id
          description: Internal request ID used for polling.
          required: false
        - name: retry_count
          description: Internal retry count used for polling.
          required: false
      description: Uploads and scans a file using IPQualityScore Malware File Scanner API.
      name: ipqs-file-scan
      polling: true
      outputs:
        # 🔷 Core Response
        - contextPath: IPQualityScore.FileScan.file_name
          type: String
          description: The file name that was scanned.
        - contextPath: IPQualityScore.FileScan.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.FileScan.message
          type: String
          description: Status message for the file scan.
        - contextPath: IPQualityScore.FileScan.file_hash
          type: String
          description: SHA256 hash of the file.
        - contextPath: IPQualityScore.FileScan.type
          type: String
          description: Type of scan performed (scan or lookup).
        - contextPath: IPQualityScore.FileScan.status
          type: String
          description: Status of the scan (pending, complete).
        # 🔷 Detection Info
        - contextPath: IPQualityScore.FileScan.detected
          type: Boolean
          description: Whether the file is detected as malicious.
        - contextPath: IPQualityScore.FileScan.detected_scans
          type: Number
          description: Number of detections.
        - contextPath: IPQualityScore.FileScan.total_scans
          type: Number
          description: Total number of scans performed.
        - contextPath: IPQualityScore.FileScan.result
          type: String
          description: Scan results or engine outputs.
        # 🔷 File Metadata
        - contextPath: IPQualityScore.FileScan.file_size
          type: Number
          description: File size in bytes.
        - contextPath: IPQualityScore.FileScan.file_type
          type: String
          description: MIME type of the file.
        - contextPath: IPQualityScore.FileScan.sha1
          type: String
          description: SHA1 hash of the file.
        - contextPath: IPQualityScore.FileScan.md5
          type: String
          description: MD5 hash of the file.
        # 🔷 Async Handling
        - contextPath: IPQualityScore.FileScan.update_url
          type: String
          description: URL to poll for updated scan results.
        - contextPath: IPQualityScore.FileScan.request_id
          type: String
          description: Unique request ID for the scan.
        # 🔷 Standard File Context (XSOAR)
        - contextPath: File.SHA256
          type: String
          description: SHA256 hash of the file.
        - contextPath: File.MD5
          type: String
          description: MD5 hash of the file.
        - contextPath: File.SHA1
          type: String
          description: SHA1 hash of the file.
        - contextPath: File.Size
          type: Number
          description: File size.
        - contextPath: File.Type
          type: String
          description: File type.
        - contextPath: File.Malicious.Count
          type: Number
          description: Number of detections.
        # 🔷 DBotScore (Enrichment)
        - contextPath: DBotScore.Indicator
          type: String
          description: Indicator value.
        - contextPath: DBotScore.Type
          type: String
          description: Indicator type (File).
        - contextPath: DBotScore.Score
          type: Number
          description: Reputation score (0=unknown, 1=good, 2=suspicious, 3=malicious).
        - contextPath: DBotScore.Vendor
          type: String
          description: Vendor name (IPQS).
    - arguments:
        - name: url
          description: URL to scan for malware.
          required: true
        - name: request_id
          description: Internal request ID used for polling.
          required: false
        - name: retry_count
          description: Internal retry count used for polling.
          required: false
      description: Scans a URL using IPQualityScore Malware File Scanner API.
      name: ipqs-url-file-scan
      polling: true
      outputs:
        # 🔷 Core Response
        - contextPath: IPQualityScore.URLFileScan.file_name
          type: String
          description: The URL that was scanned.
        - contextPath: IPQualityScore.URLFileScan.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.URLFileScan.message
          type: String
          description: Status message for the URL scan.
        - contextPath: IPQualityScore.URLFileScan.file_hash
          type: String
          description: SHA256 hash of the scanned content.
        - contextPath: IPQualityScore.URLFileScan.type
          type: String
          description: Type of scan performed (scan or lookup).
        - contextPath: IPQualityScore.URLFileScan.status
          type: String
          description: Status of the scan (pending, complete).
        # 🔷 Detection Info
        - contextPath: IPQualityScore.URLFileScan.detected
          type: Boolean
          description: Whether the URL is detected as malicious.
        - contextPath: IPQualityScore.URLFileScan.detected_scans
          type: Number
          description: Number of detections.
        - contextPath: IPQualityScore.URLFileScan.total_scans
          type: Number
          description: Total number of scans performed.
        - contextPath: IPQualityScore.URLFileScan.result
          type: String
          description: Scan results or engine outputs.
        # 🔷 File Metadata
        - contextPath: IPQualityScore.URLFileScan.file_size
          type: Number
          description: File size in bytes.
        - contextPath: IPQualityScore.URLFileScan.file_type
          type: String
          description: MIME type of the file.
        - contextPath: IPQualityScore.URLFileScan.sha1
          type: String
          description: SHA1 hash of the file.
        - contextPath: IPQualityScore.URLFileScan.md5
          type: String
          description: MD5 hash of the file.
        # 🔷 Async Handling
        - contextPath: IPQualityScore.URLFileScan.update_url
          type: String
          description: URL to poll for updated scan results.
        - contextPath: IPQualityScore.URLFileScan.request_id
          type: String
          description: Unique request ID for the scan.
        - contextPath: IPQualityScore.URLFileScan.scan_date
          type: Date
          description: Date and time when the scan was performed.
        # 🔷 Standard URL Context (XSOAR)
        - contextPath: URL.Data
          type: String
          description: URL address.
        - contextPath: URL.Malicious.Description
          type: String
          description: Description of the malicious URL.
        - contextPath: URL.Malicious.Vendor
          type: String
          description: Vendor that identified the URL as malicious.
        # 🔷 DBotScore (Enrichment)
        - contextPath: DBotScore.Indicator
          type: String
          description: Indicator value.
        - contextPath: DBotScore.Type
          type: String
          description: Indicator type (URL).
        - contextPath: DBotScore.Score
          type: Number
          description: Reputation score (0=unknown, 1=good, 2=suspicious, 3=malicious).
        - contextPath: DBotScore.Vendor
          type: String
          description: Vendor name (IPQualityScore).
    - arguments:
        - default: true
          description: IP address to check.
          isArray: true
          name: ip
          required: true
      deprecated: true
      description: Deprecated. Use ipqs-ip-reputation instead.
      name: ip
      outputs:
        - contextPath: IPQualityScore.IP.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.IP.message
          type: String
          description: A generic status message, either success or some form of an error notice.
        - contextPath: IPQualityScore.IP.fraud_score
          type: Number
          description: The overall fraud score of the user based on the IP.
        - contextPath: IPQualityScore.IP.country_code
          type: String
          description: Two character country code of IP address or "N/A" if unknown.
        - contextPath: IPQualityScore.IP.region
          type: String
          description: Region (state) of IP address if available or "N/A" if unknown.
        - contextPath: IPQualityScore.IP.city
          type: String
          description: City of IP address if available or "N/A" if unknown.
        - contextPath: IPQualityScore.IP.ISP
          type: String
          description: ISP if one is known. Otherwise "N/A".
        - contextPath: IPQualityScore.IP.ASN
          type: Number
          description: Autonomous System Number if one is known. Null if nonexistent.
        - contextPath: IPQualityScore.IP.organization
          type: String
          description: Organization if one is known. Otherwise "N/A".
        - contextPath: IPQualityScore.IP.latitude
          type: Number
          description: Latitude of IP address if available or "N/A" if unknown.
        - contextPath: IPQualityScore.IP.longitude
          type: Number
          description: Longitude of IP address if available or "N/A" if unknown.
        - contextPath: IPQualityScore.IP.is_crawler
          type: Boolean
          description: Is this IP associated with being a confirmed crawler.
        - contextPath: IPQualityScore.IP.timezone
          type: String
          description: Timezone of IP address if available or "N/A" if unknown.
        - contextPath: IPQualityScore.IP.mobile
          type: Boolean
          description: Is this user agent a mobile browser?
        - contextPath: IPQualityScore.IP.host
          type: String
          description: Hostname of the IP address if one is available.
        - contextPath: IPQualityScore.IP.proxy
          type: Boolean
          description: Is this IP address suspected to be a proxy?
        - contextPath: IPQualityScore.IP.vpn
          type: Boolean
          description: Is this IP suspected of being a VPN connection?
        - contextPath: IPQualityScore.IP.tor
          type: Boolean
          description: Is this IP suspected of being a TOR connection?
        - contextPath: IPQualityScore.IP.active_vpn
          type: Boolean
          description: Premium Account Feature - Identifies active VPN connections.
        - contextPath: IPQualityScore.IP.active_tor
          type: Boolean
          description: Premium Account Feature - Identifies active TOR exits on the TOR network.
        - contextPath: IPQualityScore.IP.recent_abuse
          type: Boolean
          description: This value will indicate if there has been any recently verified abuse for this IP address.
        - contextPath: IPQualityScore.IP.bot_status
          type: Boolean
          description: Premium Account Feature - Indicates if bots or non-human traffic has recently used this IP address.
        - contextPath: IPQualityScore.IP.connection_type
          type: String
          description: Classification of the IP address connection type.
        - contextPath: IPQualityScore.IP.abuse_velocity
          type: String
          description: Premium Account Feature - How frequently the IP address is engaging in abuse.
        - contextPath: IPQualityScore.IP.request_id
          type: String
          description: A unique identifier for this request.
        - contextPath: IPQualityScore.IP.address
          type: String
          description: The IP address that was queried.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
        - contextPath: IP.Address
          type: string
          description: The IP address.
        - contextPath: IP.ASN
          type: string
          description: The autonomous system name for the IP address.
        - contextPath: IP.Hostname
          type: string
          description: The hostname that is mapped to this IP address.
        - contextPath: IP.Geo.Country
          type: string
          description: The country in which the IP address is located.
        - contextPath: IP.Geo.Description
          type: string
          description: Additional information about the location.
        - contextPath: IP.Malicious.Vendor
          type: string
          description: The vendor reporting the IP address as malicious.
        - contextPath: IP.Malicious.Description
          type: string
          description: A description explaining why the IP address was reported as malicious.
    - arguments:
        - default: true
          description: Email address to check.
          isArray: true
          name: email
          required: true
      deprecated: true
      description: Deprecated. Use ipqs-email-reputation instead.
      name: email
      outputs:
        - contextPath: IPQualityScore.Email.message
          type: String
          description: A generic status message, either success or some form of an error notice.
        - contextPath: IPQualityScore.Email.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.Email.valid
          type: Boolean
          description: Does this email address appear valid?
        - contextPath: IPQualityScore.Email.disposable
          type: Boolean
          description: Is this email suspected of belonging to a temporary or disposable mail service?
        - contextPath: IPQualityScore.Email.smtp_score
          type: Number
          description: Validity score of email server's SMTP setup.
        - contextPath: IPQualityScore.Email.overall_score
          type: Number
          description: Overall email validity score.
        - contextPath: IPQualityScore.Email.first_name
          type: String
          description: Suspected first name based on email.
        - contextPath: IPQualityScore.Email.generic
          type: Boolean
          description: Is this email suspected as being a catch all or shared email for a domain?
        - contextPath: IPQualityScore.Email.common
          type: Boolean
          description: Is this email from a common email provider?
        - contextPath: IPQualityScore.Email.dns_valid
          type: Boolean
          description: Does the email's hostname have valid DNS entries?
        - contextPath: IPQualityScore.Email.honeypot
          type: Boolean
          description: Is this email believed to be a "honeypot" or "SPAM trap"?
        - contextPath: IPQualityScore.Email.deliverability
          type: String
          description: How likely is this email to be delivered to the user and land in their mailbox.
        - contextPath: IPQualityScore.Email.frequent_complainer
          type: Boolean
          description: Indicates if this email frequently unsubscribes from marketing lists or reports email as SPAM.
        - contextPath: IPQualityScore.Email.spam_trap_score
          type: String
          description: Confidence level of the email address being an active SPAM trap.
        - contextPath: IPQualityScore.Email.catch_all
          type: Boolean
          description: Is this email likely to be a "catch all"?
        - contextPath: IPQualityScore.Email.timed_out
          type: Boolean
          description: Did the connection to the mail service provider timeout during the verification?
        - contextPath: IPQualityScore.Email.suspect
          type: Boolean
          description: This value indicates if the mail server is currently replying with a temporary error.
        - contextPath: IPQualityScore.Email.recent_abuse
          type: Boolean
          description: This value will indicate if there has been any recently verified abuse for this email address.
        - contextPath: IPQualityScore.Email.fraud_score
          type: Number
          description: The overall Fraud Score of the user based on the email's reputation.
        - contextPath: IPQualityScore.Email.suggested_domain
          type: String
          description: Indicates if this email's domain should in fact be corrected to a popular mail service.
        - contextPath: IPQualityScore.Email.leaked
          type: Boolean
          description: Was this email address associated with a recent database leak from a third party?
        - contextPath: IPQualityScore.Email.domain_age.human
          type: Date
          description: A human description of when this domain was registered.
        - contextPath: IPQualityScore.Email.domain_age.timestamp
          type: Number
          description: The unix time since epoch when this domain was first registered.
        - contextPath: IPQualityScore.Email.domain_age.iso
          type: Date
          description: The time this domain was registered in ISO8601 format.
        - contextPath: IPQualityScore.Email.first_seen.human
          type: Date
          description: A human description of the email address age.
        - contextPath: IPQualityScore.Email.first_seen.timestamp
          type: Number
          description: The unix time since epoch when this email was first analyzed by IPQS.
        - contextPath: IPQualityScore.Email.first_seen.iso
          type: Date
          description: The time this email was first analyzed by IPQS in ISO8601 format.
        - contextPath: IPQualityScore.Email.sanitized_email
          type: String
          description: Sanitized email address with all aliases and masking removed.
        - contextPath: IPQualityScore.Email.request_id
          type: String
          description: A unique identifier for this request.
        - contextPath: IPQualityScore.Email.address
          type: String
          description: The email address that was queried.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
    - arguments:
        - default: true
          description: Url address to check.
          isArray: true
          name: url
          required: true
      deprecated: true
      description: Deprecated. Use ipqs-url-reputation instead.
      name: url
      outputs:
        - contextPath: IPQualityScore.Url.message
          type: String
          description: A generic status message, either success or some form of an error notice.
        - contextPath: IPQualityScore.Url.success
          type: Boolean
          description: Was the request successful?
        - contextPath: IPQualityScore.Url.unsafe
          type: Boolean
          description: Is this domain suspected of being unsafe due to phishing, malware, spamming, or abusive behavior?
        - contextPath: IPQualityScore.Url.domain
          type: String
          description: Domain name of the final destination URL of the scanned link, after following all redirects.
        - contextPath: IPQualityScore.Url.ip_address
          type: String
          description: The IP address corresponding to the server of the domain name.
        - contextPath: IPQualityScore.Url.server
          type: String
          description: The server banner of the domain's IP address.
        - contextPath: IPQualityScore.Url.content_type
          type: String
          description: MIME type of URL's content.
        - contextPath: IPQualityScore.Url.status_code
          type: Number
          description: HTTP Status Code of the URL's response.
        - contextPath: IPQualityScore.Url.page_size
          type: Number
          description: Total number of bytes to download the URL's content.
        - contextPath: IPQualityScore.Url.domain_rank
          type: Number
          description: Estimated popularity rank of website globally.
        - contextPath: IPQualityScore.Url.dns_valid
          type: Boolean
          description: The domain of the URL has valid DNS records.
        - contextPath: IPQualityScore.Url.parking
          type: Boolean
          description: Is the domain of this URL currently parked with a for sale notice?
        - contextPath: IPQualityScore.Url.spamming
          type: Boolean
          description: Is the domain of this URL associated with email SPAM or abusive email addresses?
        - contextPath: IPQualityScore.Url.malware
          type: Boolean
          description: Is this URL associated with malware or viruses?
        - contextPath: IPQualityScore.Url.phishing
          type: Boolean
          description: Is this URL associated with malicious phishing behavior?
        - contextPath: IPQualityScore.Url.suspicious
          type: Boolean
          description: Is this URL suspected of being malicious or used for phishing or abuse?
        - contextPath: IPQualityScore.Url.risk_score
          type: Number
          description: The IPQS risk score which estimates the confidence level for malicious URL detection.
        - contextPath: IPQualityScore.Url.request_id
          type: String
          description: A unique identifier for this request.
        - contextPath: IPQualityScore.Url.url
          type: String
          description: The URL being queried.
        - contextPath: IPQualityScore.Url.adult
          type: Boolean
          description: Is this URL or domain hosting dating or adult content?
        - contextPath: IPQualityScore.Url.domain_age.human
          type: Date
          description: A human description of when this domain was registered.
        - contextPath: IPQualityScore.Url.domain_age.timestamp
          type: Number
          description: The unix time since epoch when this domain was first registered.
        - contextPath: IPQualityScore.Url.domain_age.iso
          type: Date
          description: The time this domain was registered in ISO8601 format.
        - contextPath: DBotScore.Indicator
          type: String
          description: The indicator that was tested.
        - contextPath: DBotScore.Score
          type: Number
          description: The actual score.
        - contextPath: DBotScore.Type
          type: String
          description: The indicator type.
        - contextPath: DBotScore.Vendor
          type: String
          description: The vendor used to calculate the score.
        - contextPath: URL.Data
          description: The URL.
          type: String
        - contextPath: URL.Malicious.Vendor
          description: The vendor reporting the URL as malicious.
          type: String
  dockerimage: demisto/python3:3.12.13.10230415
  runonce: false
  script: "-"
  subtype: python3
  type: python
tests:
  - No tests