---
title: "Malware Host Feed"
method: POST
path: "/threat-feeds/malware"
tags: ["Threat Feeds"]
---

# Malware Host Feed

`POST /threat-feeds/malware`

## Request

- Base URL: `https://api.hudsonrock.com/json/v3`
- URL: `https://api.hudsonrock.com/json/v3/threat-feeds/malware`
- Auth: API key in header `api-key`
- TypeScript: <https://skmtc.dev/hudsonrock/apis/cavalier-api/docs/threat-feeds/malware/post.ts> (a function with typed inputs; its response is checked against the schema)

Cursor-paginated feed of malware host rows outside the C2 stealer allow-list. Same shape as the C2 feed. Requires `malware_feed`.

## Request body

- object
  - `date` string: A single UTC day (YYYY-MM-DD). Ignored if a range is given.
  - `dateFrom` string: Inclusive range start on `dayUtc`.
  - `dateTo` string: Inclusive range end on `dayUtc`.
  - `host` string: Exact host match (lower-cased, trimmed).
  - `family` string: Malware family membership (lower-cased). Must not be a C2 stealer family — those return `400` (use `/threat-feeds/c2`).
  - `country` string: ISO-2 country, exact (upper-cased).
  - `feedType` string
  - `asn` integer: Autonomous system number.
  - `sort` 'date' | 'seen' | 'host'
  - `dir` 'asc' | 'desc'
  - `cursor` string: Opaque keyset cursor from a previous response's `pageInfo.nextCursor`.
  - `limit` integer
  - `withTotal` boolean

## Response `200`

Successful operation

- object
  - `data` object[]
    - `_id` string
    - `host` string
    - `dayUtc` string
    - `feedType` string, nullable
    - `families` string[]: Malware families outside the C2 stealer allow-list.
    - `tags` string[]
    - `infraType` string, nullable
    - `country` string, nullable
    - `asn` integer, nullable
    - `asOrg` string, nullable
    - `resolvedIps` string[]
    - `ports` integer[]
    - `sha256` string[]
    - `dnsActivity` integer
    - `dnsActivityByWindow` object[]
      - `windowDays` integer
      - `count` integer
    - `passiveDnsHits` integer
    - `trancoRank` integer, nullable
    - `firstSeen` string, nullable
    - `lastSeen` string, nullable
    - `addedAt` string, nullable
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
  - `pageInfo` object
    - `limit` integer
    - `count` integer
    - `hasMore` boolean
    - `nextCursor` string, nullable
    - `total` integer
    - `sort` object
      - `key` string
      - `dir` 'asc' | 'desc'

## Other responses

- `400`: Validation error.
- `401`: Missing or invalid `api-key`.
- `403`: The API key lacks the required permission for this feed.
- `500`: Internal server error.

## Changes

- **2026-11-03** `a7ebb4dfd47f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hudsonrock/apis/cavalier-api/changes/threat-feeds/malware/post.md)

---

[API](https://skmtc.dev/hudsonrock/apis/cavalier-api.md) - [All operations](https://skmtc.dev/hudsonrock/apis/cavalier-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hudsonrock/apis/cavalier-api/revisions/a7ebb4dfd47f?raw)