api

API v1 Documentation

Full-featured REST API for IP enrichment, JARM fingerprints, favicon search, certificate lookup, and threat intelligence. 53M+ IPs indexed, updated daily.

Get Free API Key View Endpoints

rocket_launch Quick Start

# Base URL
https://zondex.io/api/v1/

# Authentication: pass your API key via header
curl -H "X-Api-Key: YOUR_API_KEY" "https://zondex.io/api/v1/ip/8.8.8.8/"

# Or via query parameter
curl "https://zondex.io/api/v1/ip/8.8.8.8/?api_key=YOUR_API_KEY"

Get your free API key at Account → Profile. All responses are JSON with consistent {"ok": true, "data": {...}} envelope.

list Endpoints

GET /api/v1/ip/{ip}/ GET /api/v1/search/ GET /api/v1/jarm/{hash}/ GET /api/v1/favicon/{hash}/ GET /api/v1/cert/{sha256}/ GET /api/v1/threats/ GET /api/v1/stats/ GET /api/v1/account/usage/

GET

/api/v1/ip/{ip}/

Full enrichment for an IP address: all open ports, services, banners, CVEs, JARM, SSL certs, WAF, RDAP, geolocation, threat intelligence, and more.

Example

curl -H "X-Api-Key: YOUR_KEY" "https://zondex.io/api/v1/ip/8.8.8.8/"

Response

{
  "ok": true,
  "data": {
    "ip": "8.8.8.8",
    "total_services": 4,
    "ports": [53, 443],
    "cve_count": 0,
    "geo": { "country_code": "US", "city": "" },
    "asn": { "number": 15169, "org": "Google LLC" },
    "reverse_dns": "dns.google",
    "services": [
      {
        "port": 443, "service": "http", "product": "gws",
        "tls": { "enabled": true, "jarm": "27d40d...", "cert_subject": "dns.google" },
        "http": { "title": "Google Public DNS", "status_code": 200 },
        "vulnerabilities": { "cve_ids": [], "cve_count": 0 },
        "threat": { "type": "" },
        "waf": "Cloudflare",
        // ... 40+ fields per service
      }
    ]
  }
}

GET

/api/v1/search/

Full-text and dork search across 150M+ service records. Supports all search operators.

Parameters

Name	Type	Required	Description
q	string	Yes	Search query (dork syntax)
page	int	No	Page number (default: 1, max: 100)
per_page	int	No	Results per page (default: 20, max: 100)

Example

curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/search/?q=nginx+country:DE&per_page=5"

GET

/api/v1/jarm/{hash}/

UNIQUE

Look up all hosts matching a JARM TLS fingerprint. 30M+ JARM hashes indexed. Use for C2 infrastructure tracking, threat hunting, and TLS fingerprinting. No other standalone JARM API exists.

Example

# Find all hosts with a specific JARM fingerprint
curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/jarm/29d29d00029d29d21c41d41d00041d0fc7ac8335432249e8becb757baaacec/"

# Search JARM hashes by partial match
curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/jarm/search/?q=29d29d"

Search Response

{
  "ok": true,
  "data": [
    { "jarm_hash": "29d29d00029d29d21c...", "host_count": 996695 },
    { "jarm_hash": "29d29d00029d29d00...", "host_count": 258010 }
  ]
}

GET

/api/v1/favicon/{hash}/

Find all hosts serving a specific favicon by its hash. 11M+ favicons indexed. Essential for OSINT, bug bounties, and asset discovery.

Example

# Find hosts by favicon hash
curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/favicon/-1151348033/"

GET

/api/v1/cert/{sha256}/

Find hosts sharing an SSL/TLS certificate by its SHA256 fingerprint. Search certificates by issuer or subject name.

Endpoints

# Lookup by certificate SHA256
curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/cert/c3eb99d168069e737ea70f3f6d8f17a3.../"

# Search by issuer/subject
curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/cert/search/?q=Let%27s+Encrypt"

GET

/api/v1/threats/

BUSINESS+

Threat intelligence feed: C2 servers, botnets, miners, RATs, malware, tor exit nodes. 1.3M+ threat records updated daily. Available on Business and Enterprise plans.

Parameters

Name	Type	Required	Description
type	string	No	c2, miner, botnet, rat, malware, tor_exit
country	string	No	2-letter country code
limit	int	No	Max results (default: 100, max: 10,000)

Example

curl -H "X-Api-Key: YOUR_KEY" \
  "https://zondex.io/api/v1/threats/?type=c2&country=RU&limit=500"

GET

/api/v1/stats/

PUBLIC

Database statistics. No authentication required.

curl "https://zondex.io/api/v1/stats/"

GET

/api/v1/account/usage/

Check your current API usage, remaining quota, and plan details.

curl -H "X-Api-Key: YOUR_KEY" "https://zondex.io/api/v1/account/usage/"

{
  "ok": true,
  "data": {
    "plan": "Free",
    "daily_limit": 100,
    "used_today": 12,
    "remaining": 88
  }
}

speed Rate Limits & Pricing

Every response includes X-RateLimit-Limit and X-RateLimit-Remaining headers.

Plan	Price	API Requests/Day	Threat Feed	JARM/Favicon/Cert
Free	$0	100	cancel	check_circle
Pro	$49/mo	5,000	cancel	check_circle
Business	$149/mo	25,000	check_circle	check_circle
Enterprise	Custom	Unlimited	check_circle	check_circle

error_outline Error Responses

Status	Meaning
400	Bad Request — missing or invalid parameters
401	Unauthorized — missing API key
403	Forbidden — invalid key or feature not in plan
429	Rate limit exceeded
503	Service unavailable — database error

API v1 Documentation

rocket_launch Quick Start

list Endpoints

/api/v1/ip/{ip}/

Example

Response

/api/v1/search/

Parameters

Example

/api/v1/jarm/{hash}/

Example

Search Response

/api/v1/favicon/{hash}/

Example

/api/v1/cert/{sha256}/

Endpoints

/api/v1/threats/

Parameters

Example

/api/v1/stats/

/api/v1/account/usage/

speed Rate Limits & Pricing

error_outline Error Responses

More Documentation

auto_awesome AI Search Gemini Flash