Threat Feeds

Malware Host Feed

Cursor-paginated feed of malware host rows outside the C2 stealer allow-list. Same shape as the C2 feed. Requires malware_feed.

post/threat-feeds/malware

Request

Base URL
https://api.hudsonrock.com/json/v3
Auth
API key in header api-key
TypeScript
https://skmtc.dev/hudsonrock/apis/cavalier-api/docs/threat-feeds/malware/post.ts
A function with typed inputs. Its response is checked against the schema.

datestring

A single UTC day (YYYY-MM-DD). Ignored if a range is given.

dateFromstring

Inclusive range start on dayUtc.

dateTostring

Inclusive range end on dayUtc.

hoststring

Exact host match (lower-cased, trimmed).

familystring

Malware family membership (lower-cased). Must not be a C2 stealer family — those return 400 (use /threat-feeds/c2).

countrystring

ISO-2 country, exact (upper-cased).

feedTypestring

asninteger

Autonomous system number.

sort'date' | 'seen' | 'host'

dir'asc' | 'desc'

cursorstring

Opaque keyset cursor from a previous response's pageInfo.nextCursor.

limitinteger

withTotalboolean

{
  "date": "2026-01-31"
}

Successful operation

{
  "data": [
    {
      "host": "malware.example.com",
      "dayUtc": "2026-01-31"
    }
  ]
}