C2 Host Feed

Cursor-paginated, filterable, multi-sortable feed of infostealer C2 host rows.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…

Required Permissions

c2_threat_feed

Response Limits

  • Rate limit: 50 requests per 10 seconds
  • Maximum items per page: 200 hosts
  • Default items per page: 50 hosts
  • Maximum response time: 90 seconds

Body Params
string

A single UTC day (YYYY-MM-DD). Ignored if a range is given.

string

Inclusive range start on dayUtc.

string

Inclusive range end on dayUtc.

string

Exact host match (lower-cased, trimmed).

string

Malware family membership (lower-cased).

string

ISO-2 country, exact (upper-cased).

string
string
integer

Autonomous system number.

string
enum
Defaults to date

date = dayUtc, seen = seenAtDate (nulls excluded), host = host.

Allowed:
string
enum
Defaults to desc
Allowed:
string

Opaque keyset cursor from a previous response's pageInfo.nextCursor. Omit for the first page. Must match the sort/dir it was issued for (else 400).

integer
1 to 200
Defaults to 50

Rows per page. Clamped to [1, 200].

boolean
Defaults to false

When true, also compute pageInfo.total via a full count over the filter. Expensive — avoid unless needed.

Responses

500

Internal server error.

Language
Credentials
Header
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json