API Reference

Look up the SSL Blacklist (SSLBL)

Check the abuse.ch SSL Blacklist (SSLBL) to determine whether a SHA-1 TLS certificate fingerprint is associated with botnet command-and-control infrastructure or malware distribution.

GET

/v1/blacklist/ssl/{sha1}

Cost: 1 credit per successful call

Path parameters

sha1stringrequired

SHA-1 fingerprint of the TLS certificate to look up. Must be exactly 40 hexadecimal characters (pattern ^[0-9a-f]{40}$). Input is case-insensitive and normalised to lowercase server-side before matching.

Request

curl https://api.precursorintelligence.com/functions/v1/blacklist/ssl/a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4 \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "sha1_fingerprint": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4",
    "listed": true,
    "listing_date": "2025-09-14T00:00:00Z",
    "listing_reason": "Cobalt Strike C2",
    "generated_at": "2026-05-29T11:04:22.381Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

A well-formed fingerprint that is not present on the blacklist returns a successful response in which listed is false and only that field, the echoed sha1_fingerprint, and generated_at are present:

200 OK (no match)

{
  "data": {
    "sha1_fingerprint": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4",
    "listed": false,
    "generated_at": "2026-05-29T11:04:22.381Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.sha1_fingerprintstringoptional

The SHA-1 fingerprint that was looked up, echoed back in lowercase.

data.listedbooleanoptional

Whether the fingerprint is present on the SSL Blacklist. When false, only sha1_fingerprint, listed, and generated_at are returned.

data.listing_datestringoptional

ISO 8601 timestamp of when the certificate was added to the blacklist. Present only when listed is true.

data.listing_reasonstringoptional

The malware family or threat associated with the listing (for example, Cobalt Strike C2). Present only when listed is true.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_sha1`	The path segment is not a valid 40-character hex string.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.