IP reputation, attacker intent, MITRE TTP mapping, session-level behavioral depth — delivered as structured JSON. Primary data, no third-party feed.
The dataset is live and growing. The API is in final hardening. Early access opens to a limited number of teams in Q3 2026.
Endpoints
/ip/{address}
Full behavioral profile — intent, bot_score, confidence, kill chain stage, first/last seen, geo + ASN.
/ip/{address}/ttps
MITRE ATT&CK techniques observed for this IP across all sessions and sensor regions.
/ip/{address}/sessions
Session-level detail — HASSH, credentials, payload, tool signatures, port targeting patterns.
/ip/batch
Bulk lookup — up to 100 IPs per request. Returns scored behavioral profiles for each.
/actors
Actor clusters — grouped by similar_pattern, campaign ID, attacker type. Cross-sensor reconstruction.
/feed/iocs
Live IOC feed — structured indicators with confidence score, TTP context, and temporal metadata.
Sovereign Delivery
Ultra-secure ingest via dedicated WireGuard mesh
For defense, government, and high-OPSEC teams — HeXG pushes data directly into your infrastructure via a dedicated encrypted tunnel. No public API calls, no query exposure, zero behavioral data in transit over public networks.
Pricing
Early access pricing for teams that need more than reputation scores.
Pricing & plans are being finalized. Join the early access program to get notified when we launch and lock in founder pricing.
Request early access →We're opening access to a small cohort first. Early access teams lock in the launch price permanently.
Get early access →Tell us what you're looking for. We'll get back within one business day.