Skip to main content
Find infections originating from a specific IP address, or scan a whole subnet — useful for correlating known-bad infrastructure or scoping exposure across a corporate IP range.

​
Request

POST /v1/search/ip-cidr · Required scope: search:ip (all tiers) Provide ips or cidr — at least one is required.
ParameterTypeRequiredDefaultDescription
ipsstring[] (IPv4)One of ips/cidr required[]Exact IPv4 addresses, e.g. ["203.0.113.42"]
cidrstring | nullOne of ips/cidr required—IPv4 CIDR range, e.g. "203.0.113.0/24"
start_datestring (date-time) | nullNo—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullNo—Inclusive end filter
sort_directionasc | descNodescMust stay constant across pages
cursorstring | nullNo—Pagination token
limitintegerNo251–500, clamped to your tier’s max_rows

​
Example request

curl -X POST https://api.vantaprism.me/v1/search/ip-cidr \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "cidr": "203.0.113.0/24", "limit": 25 }'

​
Response

200 OK — array of IPExposureResult, cursor-paginated. 
{
  "data": [
    {
      "stealer_id": "RL-2026-AC91F3",
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "ip": "203.0.x.x",
      "country": "US",
      "operating_system": "Windows 11 Pro",
      "computer_name": "DE*************",
      "stealer_family": "RedLine",
      "stealer_version": "1.4",
      "anti_viruses": ["Windows Defender"],
      "infection_date": "2026-05-02T14:22:31Z"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 27.9,
    "tier": "free",
    "masked_fields": ["ip", "computer_name"]
  }
}
FieldDescription
stealer_idlog_victim_id of the infected machine
victim_idSHA-256 victim ID — use with Victim Profiles
ipMasked via subnet_mask on free tier — unless it exactly matches an address you searched for in ips (addresses matched only via cidr remain masked)
countryISO 3166-1 alpha-2
operating_system
computer_nameMasked via partial_identifier on free tier
stealer_family, stealer_versionMalware identification
anti_virusesDetected AV products
infection_dateWhen the log was captured

​
Pagination

Cursor-paginated — see Pagination.

​
Errors

StatuscodeCause
400VALIDATION_ERRORNeither ips nor cidr provided, or ips contains a non-IPv4 value
400INVALID_CURSORTampered or stale cursor
403FORBIDDEN_SCOPEKey lacks search:ip
See Errors for the full catalog.

​
Tier notes

An exact ips entry is returned unmasked even on free tier; a cidr-only match stays subnet-masked (a.b.x.x). computer_name is masked via partial_identifier on free tier regardless.