Anti-Malware — entry 002 of 15
AlienVault Open Threat Exchange (OTX)
Open Threat Exchange is AT&T Cybersecurity's community threat-intelligence platform, now operated under the LevelBlue brand, where contributors publish "pulses" of malicious IPs, domains, hashes, and URLs that anyone can query. A live, unauthenticated GET against its IPv4 general-info endpoint returned a full 200 JSON response, and both that call and its OPTIONS preflight echoed the request's Origin in Access-Control-Allow-Origin, resolving cors to yes; an OTX-API-KEY is still needed for higher rate limits and pulse subscriptions. Signup, the API key, and the community feed itself are all free.
AlienVault OTX (now part of LevelBlue) is a shared threat-intelligence feed. Anyone can look up an IP, domain, or URL and get back its reputation and any linked "pulse" reports of malicious activity. A live GET this run against the IPv4 lookup endpoint returned a full result with no API key sent.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/alienvault-open-threat-exchange-otx/"><img src="https://greatapis.com/badge/alienvault-open-threat-exchange-otx.svg" alt="Scored 64 on greatapis.com"></a>Auth quickstart
- No key is needed to look up an indicator. A live
GET /indicators/IPv4/<ip>/generalcall this run returnedHTTP 200with real reputation data and noX-OTX-API-KEYheader sent. - A free
OTX-API-KEYraises the rate limit and unlocks pulse subscriptions. Get one by creating a free account at otx.alienvault.com, then send it as theX-OTX-API-KEYheader on the same calls.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Keyless IP reputation lookup
GEThttps://otx.alienvault.com/api/v1/indicators/IPv4/8.8.8.8/general
{"whois":"http://whois.domaintools.com/8.8.8.8","reputation":0,"indicator":"8.8.8.8","type":"IPv4","type_title":"IPv4","pulse_info":{"count":0,"pulses":[],"references":[]},"asn":"AS15169 google llc","country_code":"US","country_name":"United States of America","sections":["general","geo","reputation","url_list","passive_dns","malware","nids_list","http_scans"]}The sections field in the response lists which detail endpoints have data for this indicator, for example /indicators/IPv4/8.8.8.8/malware. Call general first, then only fetch the sections it lists instead of guessing which ones exist.
Developer reference
1,000 requests/hour without an API key; 10,000 requests/hour with one (higher volume by arrangement).
Gotchas & limits
- A domain lookup uses a different path shape than an IP lookup. A live
GET /indicators/domain/example.com/generalthis run also returnedHTTP 200, but withtype: "domain"and a differentsectionslist (noreputationornids_listsection for this indicator). - The response marks a keyless call as unauthenticated, and reports no quota. A live call this run returned
X-OTX-ACTIVE: 0andX-Remote-User-Name: Anonymous, and no header in that response gave a rate limit, a remaining count, or a reset time. You cannot read your remaining budget from a response, so count your own calls. - CORS echoes the Origin you send. A live call this run with
Origin: https://greatapis.comreturnedAccess-Control-Allow-Origin: https://greatapis.com, not*; the same call with noOriginheader returnedAccess-Control-Allow-Origin: *. A browser page can call this endpoint directly.