WAYSCloud API

Real-time threat intelligence for IP addresses, domains, and malware URLs. Free tier with 1,000 requests/day.

Checking status...

Interactive Docs (Swagger) ReDoc OpenAPI Spec

Quick Start

# Check threat score for any IP (recommended)
curl https://ip.wayscloud.services/api/v1/ip/8.8.8.8

# Get your own IP info
curl https://ip.wayscloud.services/json

# Get country threat statistics
curl https://ip.wayscloud.services/api/country/US

# Get ASN threat data
curl https://ip.wayscloud.services/api/asn/16509

Core Endpoints

GET /api/v1/ip/{ip} RECOMMENDED

Primary endpoint for IP threat intelligence. Returns threat score (0-100), risk level, abuse reports, geolocation, and recommendations.

Legacy alias: /api/search/{ip} (still supported)

/api/v1/ip/8.8.8.8

GET /json

Returns the caller's IP address with metadata including geolocation, reverse DNS, and IP version detection.

/json

GET /api/country/{code}

Country-level threat intelligence with statistics, top attack categories, time-series trends, and most active IPs.

/api/country/US

GET /api/asn/{number}

ASN (network) level threat data. Identify malicious hosting providers, bulletproof hosts, and compromised networks.

/api/asn/16509 (Amazon AWS)

GET /api/threats/live

Real-time threat feed with latest attacks. Filter by time range (1h, 24h, 7d) and sort by recency or report count.

/api/threats/live?time_range=1h

GET /api/malware/domain/{domain}

Domain threat intelligence with malware URLs, status (online/offline), malware families, and timeline.

/domain/drive.google.com

Example Response

Response from /api/v1/ip/8.8.8.8

{
  "ip": "8.8.8.8",
  "threat_score": 0,
  "risk_level": "clean",
  "total_reports": 0,
  "recommendation": "allow",
  "geolocation": {
    "country": "United States",
    "country_code": "US",
    "city": "Mountain View",
    "latitude": 37.4056,
    "longitude": -122.0775
  },
  "asn": {
    "number": 15169,
    "organization": "GOOGLE"
  },
  "reverse_dns": "dns.google"
}