One endpoint returns the same JSON the site renders. Anonymous use is limited per IP; an API key from your account raises the limits.

# anonymous, 20/min and 300/day per IP
curl "https://your-host/api/lookup?q=1.1.1.1"

# with a key, 60/min and 2000/day per key
curl -H "Authorization: Bearer zt_..." "https://your-host/api/v1/lookup?q=example.com"

# force a fresh fetch (keys and signed-in users, 10/hour)
curl -H "Authorization: Bearer zt_..." "https://your-host/api/v1/lookup?q=example.com&refresh=1"

Up to 50 indicators per request, five looked up at a time. Each distinct indicator counts against the daily quota; the reply is one item per query, in order.

curl -X POST -H "Authorization: Bearer zt_..." -H "Content-Type: application/json" \
  -d '{"q":["1.1.1.1","example.com","CVE-2024-3400"]}' \
  "https://your-host/api/v1/lookup/batch"

# {"items":[{"q":"1.1.1.1","ok":true,"result":{...}}, {"q":"nope","ok":false,"error":"invalid_indicator"}]}

Add "mode":"private" to answer from cache and local feeds only. Sessions can use /api/lookup/batch from the site with the same body.

Any lookup can be downloaded as a file with the same limits as /api/lookup.

curl -OJ "https://your-host/api/lookup/export?q=1.1.1.1&format=stix"

json

The full lookup result.

csv

One row: indicator, verdict, score, confidence, reasons, key facts for the type, fetch time and page URL.

stix

STIX 2.1 bundle with one indicator (vulnerability for CVEs, intrusion-set for ransomware groups); x_zertops_score carries the score.

misp

MISP event with one attribute per known form of the indicator, to_ids set when malicious, tagged zertops:verdict.

md

Ticket-ready Markdown: verdict, read, top evidence, report links and the permalink, indicator defanged.

The File tab on the home page analyses a file or picture. The bytes are read once by our own parsers in an isolated thread with a memory cap and a time limit, then dropped; nothing is opened, run, stored or sent to a third party. What is kept for 30 days at /file/<sha256>: the hashes (MD5, SHA-1, SHA-256, SHA-512, SHA3-256, BLAKE2b, CRC32, ssdeep, import hash, perceptual hashes), the report, and for pictures the derived views (bit planes, channels, auto levels) our own encoder draws from the pixels. Every hash of the file and of every file found inside it (archive members, attachments, embedded objects, macro projects, LSB payloads) is looked up against the hash sources; the verdict is the worst of them.

Any file

MD5, SHA-1, SHA-256 with the normal hash verdict; real type from magic bytes with a warning when the extension lies; entropy; every IP, domain, URL and email in its strings, looked up.

Pictures

Dimensions, camera, software and date from EXIF, embedded GPS position, data hidden after the image ends, QR codes decoded and looked up, and a description by the local model if you ask for one.

PDF

JavaScript, auto-open and launch actions, embedded files, links inside compressed streams, author and producer.

Office

Macros, remote templates, DDE fields, external links, embedded objects; legacy binary files get a marker scan.

Programs

Windows, Linux and macOS headers: architecture, compile time, sections with entropy, imports and import hash, signature presence.

Archives

Contents listing with executables, double extensions, path traversal, encryption and bomb ratios called out.

Email, scripts, certificates, shortcuts, disk images

Header analysis and attachments, obfuscation markers and decoded base64, certificate names, shortcut targets, volume ids.

Limits

Up to MAX_UPLOAD_MB (default 25). Anonymous: 5 per hour, 20 per day; signed in: 20 per hour, 200 per day. AI descriptions: 3 per day anonymous, 30 signed in.

curl -X POST -H "Content-Type: application/octet-stream" -H "X-File-Name: sample.bin" \
  --data-binary @sample.bin "https://your-host/api/file"
# {"sha256":"..."}  then open https://your-host/file/<sha256>

Drag the link to your bookmarks bar. On any page, select text with indicators in it and click the bookmark: the selection opens in triage and is looked up at once.

javascript:location.href='https://zertops.com/triage?text='+encodeURIComponent(String(getSelection()).slice(0,8000))

A slash command answers with the verdict card in Slack. Create a Slack app with a slash command whose request URL is the endpoint below, then put the signing secret of that app in SLACK_SIGNING_SECRET on the server. Cached results answer at once; a fresh lookup follows a few seconds later.

/zertops 1.2.3.4
Request URL: https://zertops.com/api/integrations/slack/command

Every request is checked against the signing secret; 20 lookups per minute per workspace. Nothing about the user or the text is logged.

On result pages: / focuses the search box, c copies the indicator, t copies the ticket summary, w watches it, e opens export, j and k move between sections, ? lists the keys.

indicator

type, normalized value and display form. Types: ipv4, ipv6, domain, url, hash_md5, hash_sha1, hash_sha256, cve, ransomware_group, asn.

verdict

level (malicious, suspicious, benign, unknown), score 0-100, confidence 0-100 and the evidence that drove it.

facts

Merged, de-duplicated facts for the indicator type. This is what the page shows.

sources

Per-source status (ok, not_found, error, timeout, skipped, unconfigured), latency and capped raw data.

meta

cached, fetchedAt, expiresAt, durationMs, sourcesPlanned.

headers

X-RateLimit-Remaining, X-Quota-Remaining, X-Zertops-Cached; Retry-After on 429.

The full schema is at /openapi.json.

400

invalid_indicator: the query is not an IP, domain, URL, hash, CVE id or known ransomware group. validation_failed for a bad body or query.

401

api_key_required or login_required.

429

rate_limited (Retry-After header) or quota_exceeded (resets at 00:00 UTC).

Defanged input (hxxp://evil[.]com) is accepted. Private and reserved addresses return without querying any source.

Blocklist

Signed-in users can generate a plain-text feed URL of their malicious watchlist under Account → Feed.

Trends

Newest ransomware victims and exploited vulnerabilities as RSS at /trends/rss.xml; the same data on /trends.