--- title: "Threat Intelligence: checking IPs, domains, URLs and files" description: "Crime score and reports for IPs, domains, URLs and files, in Cyber Console or via API: the threat intelligence behind Threat Blocker and Cloud Defender." canonical: https://www.aegister.com/en/solutions/threat-intelligence/ url: /en/solutions/threat-intelligence/ lang: en --- ![](https://www.aegister.com/static/images/header.webp) # Threat Intelligence Check IP addresses, domains, URLs and files against the threat intelligence behind Threat Blocker and Cloud Defender, in Cyber Console or from your applications through the API. [![ ](https://www.aegister.com/static/videos/products/film-threat-intelligence-en-poster.jpg?v=705836efc4)](https://www.aegister.com/static/videos/products/film-threat-intelligence-en.mp4?v=984db30cfe) ## How it works Reports from more than 130 sources give every indicator a crime score. You look it up in Cyber Console or from your own applications through the API, while Threat Blocker and Cloud Defender receive the list of IP addresses to block. Diagram: Threat intelligence diagram: the sources update the threat intelligence, which gives every indicator a crime score; Cyber Console and the API query it about IPs, domains, URLs and files; Threat Blocker and Cloud Defender receive the IP list and block those addresses. An illustration of how the services work. - 1 ### Lookups in Cyber Console One field for IP addresses, domains, URLs and file digests. For every indicator, the crime score with its level and the reports; for an IP, also network, country, MITRE ATT&CK techniques and the PDF report. - 2 ### The same lookups through the API With a token generated from your profile, your tools query the same threat intelligence. The documentation is public on docs.aegister.com, and your profile shows API use day by day. - 3 ### The same intelligence that blocks Threat Blocker and Cloud Defender block the listed IP addresses, with the list updated at least once an hour. A lookup, instead, reads and shows: it blocks nothing. ## The console in action A tour of the console, then tasks from start to finish, on the screens you will use. Each recording is split into chapters: pick one to start from there. [![](https://www.aegister.com/static/videos/products/screencasts/tour-ti-en-poster.jpg?v=8d2f8cf2ea)](https://www.aegister.com/static/videos/products/screencasts/tour-ti-en.mp4?v=0b922ca5b9) ![](https://www.aegister.com/static/videos/products/screencasts/tour-ti-en-poster.jpg?v=8d2f8cf2ea) Threat Intelligence in the console 1:02 0:00 One field for every indicator 0:12 The report on an IP address 0:28 A domain 0:38 A URL 0:47 A file digest 0:54 The PDF report ![](https://www.aegister.com/static/videos/products/screencasts/ti-api-en-poster.jpg?v=de37c4e77e) Threat Intelligence through the API 0:31 0:00 API usage 0:08 A new token 0:14 The documentation 0:22 Checking an IP address Recordings of the console on our demo tenant. ## What a lookup shows A single field recognises on its own whether you are looking up an IP address, a domain, a URL or a file digest. A lookup reads and shows: blocking IP addresses is the job of Threat Blocker and Cloud Defender. ### Crime score and level Every result gives the crime score on a five-level scale, from no risk to critical, with the number of reports and the dates of the first and the last. ### The full picture of an IP address For an IP, also network and country, the score over time, why it was reported, the MITRE ATT&CK techniques with their defences and the STIX indicators to download. ### PDF report The full picture of an IP address downloads as a PDF, to attach to an analysis or an internal report. ### Your files stay with you To check a file, drop it on the page: its SHA-256 digest is computed in the browser and the file is not uploaded. ### API with tokens Each user generates their own tokens from the profile and sees API use day by day; we set the daily limits. The documentation is public on docs.aegister.com. [API documentation](https://docs.aegister.com/api-reference/token) ## Threat intelligence for your company Lookups are enabled with a licence for each kind of indicator: IP addresses, URLs, domains and files. The Cyber Check-up shows you where to start. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/) [Perimeter protection](https://www.aegister.com/en/solutions/perimeter-protection/) ## Delivered through Cyber Console Threat Intelligence is in the Perimeter Protection module of Cyber Console, next to Threat Blocker, Cloud Defender and Log Analysis: the same platform we use to manage controls, incidents and documentation. [Explore the platform](https://www.aegister.com/en/solutions/cyber-console/) ![Cyber Console: the lookup of an IP address, with crime score, level, reports and network](https://www.aegister.com/static/images/products/ui/ti-lookup-en.png) ## Threat intelligence insights Guides and analysis on threat intelligence and protection against cyber threats. [![Analyst reading a printed report at a desk](https://www.aegister.com/static/images/cms/theme-analyst-report.webp) Made with AI 22 May 2025 ### Cyber Threats in Italy - ACN Operational Summary, April 2025 The ACN's April 2025 Operational Summary highlights a rise in ransomware and DDoS attacks in Italy, with key sectors like telecoms and public administration under threat.](https://www.aegister.com/en/cms/insights/cyber-threats-italy-april-2025-summary/) [![Server room aisle with racks and cabling](https://www.aegister.com/static/images/cms/theme-datacentre-aisle.webp) Made with AI 28 Apr 2025 ### Understanding Threat Intelligence: What Every Business Should Know Explore the fundamentals of threat intelligence and its importance in proactive cybersecurity strategies.](https://www.aegister.com/en/cms/insights/understanding-threat-intelligence/) [![Analyst reading a printed report at a desk](https://www.aegister.com/static/images/cms/theme-analyst-report.webp) Made with AI 12 Apr 2025 ### Cyber Threats 2025: The Most Common Attacks and How to Defend Against Them An in-depth look at the most common cyber threats in 2025 from ransomware to supply chain attacks and how organizations can defend themselves using standards like the NIST CSF and ACN strategy.](https://www.aegister.com/en/cms/insights/cyber-threats-2025-common-attacks/) [All articles](https://www.aegister.com/en/cms/keyword/cyber-threats/)