---
title: "Public dataset statistics"
method: GET
path: "/stats"
tags: ["stats"]
---

# Public dataset statistics

`GET /stats`

Headline counters for the indicator dataset, read from the metrics
snapshot the `load-metrics` job writes to Redis. **Always 200**: when the
snapshot is missing or a field is absent, the counters are `0` and
`topCategories` is empty — there is no error response. `lastUpdated` is
the snapshot's own `computedAt` stamp (RFC 3339, written by the
`load-metrics` job), `null` when no snapshot exists — never the response
time, so a stale snapshot is visible as such. `topCategories` holds at
most five entries.

**No authentication required.** Not metered.

## Response `200`

Dataset counters

- PublicStats
  - `byType` ByType, required
    - `domains` integer, required
    - `ips` integer, required
  - `lastUpdated` string, nullable — `computedAt` of the `metrics:threats` snapshot the counters were read from (RFC 3339), or `null` when no snapshot exists. Never the response time: a counter served from a stale snapshot must say so.
  - `multiSourceValidated` MultiSourceValidated, required
    - `count` integer, required
    - `percentage` number, double, required
  - `recentActivity` RecentActivity, required
    - `growthRate` number, double, required
    - `last24h` integer, required
    - `last7d` integer, required
  - `sourceCount` integer, required
  - `topCategories` Category[], required
    - `count` integer, required
    - `name` string, required
    - `percentage` number, double, required
  - `totalThreats` integer, required

## Changes

- **2026-09-23** `edb544398108` — 2 breaking
  - the response property `lastUpdated` became nullable for the status `200`
  - the response property `lastUpdated` became optional for the status `200`
- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/stats/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)