Skip to main content

URI statistics

The ReversingLabs URI Statistics API provides statistical information on how many known, malicious, and suspicious samples are associated with a particular URI. This service takes into account network IOCs extracted during file static analysis and uses that data to correlate URIs with samples. The following URI types are supported: email, URL, IPv4 address and domain.

This service accepts only SHA1 values of URI strings. Requested URI strings cannot be in plain text.

There are two available response formats: XML and JSON.

URI Statistics Query

This query returns information about the state of an URI. It provides an unhashed value and numbers for malicious, suspicious, and known files associated with it.

Request

GET /api/uri/statistics/uri_state/sha1/{uri_sha1}?[format=xml|json]
  • uri_sha1
    • The SHA1 hash value of the URI string
    • Required
  • format
    • Response format. Accepts the following parameters: xml (default) and json
    • Optional

Response

{
"rl": {
"uri_state": {
"url": "string",
"sha1": "string",
"uri_type": "string",
"counters": {
"known": 0,
"malicious": 0,
"suspicious": 0
}
}
}
}
  • sha1
    • SHA1 hash of the URI
  • uri_type
  • counters
    • suspicious - number of associations with suspicious samples, malicious - number of associations with malicious samples, known - number of associations with known samples

Examples

Request Examples

Retrieving the URI state in different formats:

/api/uri/statistics/uri_state/sha1/234988566c9a0a9cf952cec82b143bf9c207ac16?format=json
/api/uri/statistics/uri_state/sha1/baea954b95731c68ae6e45bd1e252eb4560cdc45?format=xml

Response Examples

URL

{
"rl": {
"uri_state": {
"url": "http://google.com",
"sha1": "234988566c9a0a9cf952cec82b143bf9c207ac16",
"uri_type": "url",
"counters": {
"known": 77700,
"malicious": 48296,
"suspicious": 526
}
}
}
}

IPv4

{
"rl": {
"uri_state": {
"ipv4": "127.0.0.1",
"sha1": "4b84b15bff6ee5796152495a230e45e3d7e947d9",
"uri_type": "ipv4",
"counters": {
"known": 48558,
"malicious": 163953,
"suspicious": 596
}
}
}
}