ZeroCERT API v1.1

ㆍ2025.05.09 Changing api service domain address : cert.zero.camp -> api.zeroax.com

Public API


Public API v1.1 Summary:
Type method Auth request URL Explanation
domain POST Y /v1.1/check/domain
ex) http://example.com/, http://8.8.8.8/		 domain or ip check
ip POST Y /v1.1/check/ip ip check
url POST Y /v1.1/check/url full url check
file POST Y /v1.1/check/hash file hash(md5, sha256) check
- POST Y /v1.1/check/reputation level 0~5
ip, domain, url
Compromised(90-Days)


Parameters:
Query Params Description
key api key
value domain, ip, url, hash


Result code:
Result code Description
type Lookup type
date Detection date (new)
value Lookup value
state State code (*)
tag tag


(*)State code:
State code Explanation
compromised Compromised site (latest 90 days)
mailcious mailcious url
malware malware file
phishing phishing site
suspicious suspicious site
deface deface site
clean No results found. clean site


[PHP Example code]
$KEY = "api key code";
$TARGET = "https://api.zeroax.com/v1.1/check/domain";
$VALUE = "zerocert.org";

$post_data = array(
"key" => $KEY,
"value" => $VALUE
);


[Example response]
{ "Result": { "Type": "domain", "Value": "zerocert.org", "State": "clean" } }



Private API


Private API v1.1 Summary:
Type method Auth request URL Explanation
POST Y /v1.1/feed/url Latest 24 hours Bad URLs
/v1.1/feed/link Referer url
/v1.1/relation/domain Related information between nodes
/v1.1/relation/ip
/v1.1/relation/url
/v1.1/search/domain Search
/v1.1/search/ip
/v1.1/search/url
/v1.1/search/hash
/v1.1/search/tag
/v1.1/search/ssdeep File Similarity Search
/v1.1/search_box/domain Search Sandbox
(*) being prepared
/v1.1/search_box/ip
/v1.1/search_box/url
/v1.1/search_box/hash
/v1.1/search_box/strings


/v1.1/feed/url, /link

Parameters:
Query Params Description
key api key
date ex) 201805291700
Latest detection date (default 24 hours)


Result code:
Result code Description
scan_date Lookup date (default 24 hours)
date Detection date
state State code (*)
domain Domain or IP address
url Bad url
sub_url Sub url regular expression check
ip IP address
cc Country code
md5_file File Hash(md5)
sha256_file File Hash(sha256)
ssdeep Ssdeep value
tag tag




/v1.1/relation/domain, /ip, /url

Parameters:
Query Params Description
key api key
value domain, ip, url
date ex) 201805291700
Latest detection date (default 90 days)


/v1.1/search/domain, /ip, /url, /hash, /tag, /ssdeep

Parameters:
Query Params Description
key api key
value domain, ip, url, hash(md5, sha256), ssdeep(*), tag(ex: ransomware)
date ex) 201805291700
Latest detection date (default 90 days)

(*) ssdeep value ex: 1536:bno0yFF/899ShgXwRjm8KQOu660MYo+Dy7x:r5GF/8amXwR+Qi60MV1




/v1.1/search_box/domain, /ip, /url, /hash, /strings

Parameters:
Query Params Description
key api key
value domain, ip, url, hash(md5, sha256), strings(ex: zyad1234)
date ex) 201805291700
Latest analysis date (default 90 days)


ZeroAX.com | ZeroCERT Team, Contact Us : help@zeroax.com