Malware Host Feed

Cursor-paginated feed of malware host rows outside the C2 stealer allow-list. Same shape as the C2 feed. Requires malware_feed.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params
string
^\d{4}-\d{2}-\d{2}$

A single UTC day (YYYY-MM-DD). Ignored if a range is given.

string
^\d{4}-\d{2}-\d{2}$

Inclusive range start on dayUtc.

string
^\d{4}-\d{2}-\d{2}$

Inclusive range end on dayUtc.

string

Exact host match (lower-cased, trimmed).

string

Malware family membership (lower-cased). Must not be a C2 stealer family — those return 400 (use /threat-feeds/c2).

string

ISO-2 country, exact (upper-cased).

string
integer

Autonomous system number.

string
enum
Defaults to date
Allowed:
string
enum
Defaults to desc
Allowed:
string

Opaque keyset cursor from a previous response's pageInfo.nextCursor.

integer
1 to 200
Defaults to 50
boolean
Defaults to false
Responses

400

Validation error.

401

Missing or invalid api-key.

403

The API key lacks the required permission for this feed.

500

Internal server error.

Language
Credentials
Header
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json