HUhudsonrock
Threat Feeds

C2 Host Feed

Changed on

Cursor-paginated feed of infostealer C2 host rows (one row per host per UTC day). Restricted to the allow-listed stealer families; other malware families are on /threat-feeds/malware. Requires the c2_threat_feed api permission. Pass pageInfo.nextCursor back as cursor for the next page. Filters are optional and AND-combined; dateFrom/dateTo take precedence over date.

post/threat-feeds/c2

Request

Request body

datestring

A single UTC day (YYYY-MM-DD). Ignored if a range is given.

dateFromstring

Inclusive range start on dayUtc.

dateTostring

Inclusive range end on dayUtc.

hoststring

Exact host match (lower-cased, trimmed).

familystring

Allow-listed stealer family membership (lower-cased). Non-allow-listed families return 400 — use /threat-feeds/malware instead.

countrystring

ISO-2 country, exact (upper-cased).

feedTypestring
reviewStatusstring

Deprecated. Accepted but ignored — this field no longer exists on feed records.

asninteger

Autonomous system number.

sort'date' | 'seen' | 'host'

date = dayUtc, seen = seenAtDate (nulls excluded), host = host.

dir'asc' | 'desc'
cursorstring

Opaque keyset cursor from a previous response's pageInfo.nextCursor. Omit for the first page. Must match the sort/dir it was issued for (else 400).

limitinteger

Rows per page. Clamped to [1, 200].

withTotalboolean

When true, also compute pageInfo.total via a full count over the filter. Expensive — avoid unless needed.

Example request

{
  "date": "2026-01-31"
}

Response

Successful operation

Example response

{
  "data": [
    {
      "_id": "665f1a2b3c4d5e6f7a8b9c0d",
      "host": "malicious-c2.example.com",
      "dayUtc": "2026-01-31",
      "feedType": "auto",
      "families": [
        "redline"
      ],
      "tags": [
        "etherhiding"
      ],
      "infraType": "hosting",
      "country": "US",
      "asn": 64500,
      "asOrg": "Example Hosting",
      "resolvedIps": [
        "203.0.113.10"
      ],
      "ports": [
        443,
        8080
      ],
      "dnsActivity": 12,
      "dnsActivityByWindow": [
        {
          "windowDays": 7,
          "count": 12
        }
      ],
      "firstSeen": "2026-01-10T00:00:00Z",
      "lastSeen": "2026-01-31T12:00:00Z",
      "compromised_data": {
        "domain": "acme.com",
        "compromised_employees": 42,
        "last_employee_compromised": "2026-06-11T00:00:00.000Z",
        "compromised_users": 1380,
        "last_user_compromised": "2026-07-02T00:00:00.000Z"
      }
    }
  ],
  "pageInfo": {
    "limit": 50,
    "count": 50,
    "hasMore": true,
    "nextCursor": "eyJzIjoiZGF0ZSIsImQiOiJkZXNjIiwidiI6MTc2ODQ3ODQwMDAwMH0",
    "total": 12034,
    "sort": {
      "key": "date",
      "dir": "desc"
    }
  }
}

Changes