Recent threat signatures

Return the most recently seen threats, optionally filtered by type, severity and confidence.

ioc_type was silently ignored before 2026-09-15, so ?ioc_type=prompt returned IPs and hashes — the Claude Code plugin's search_by_type depended on it.

Confidence tiers:

  • unverified (< 0.50): raw single-source IOCs
  • community (0.50–0.69): community-sourced, reasonable signal
  • validated (0.70–0.84): Pro tier — curated, low noise
  • enterprise (≥ 0.85): multi-confirmed authoritative feed IOCs
get/v1/threats

Request

  • Base URL: https://nullcone.ai/api
  • URL: https://nullcone.ai/api/v1/threats
  • Auth: none declared

Query parameters

limitinteger
min_severityinteger
min_confidencenumber

Minimum confidence_score (0.0–1.0). 0.7+ = validated tier (Pro). 0.85+ = enterprise.

ioc_typestring nullable

Only this IOC type, newest first (e.g. prompt, skill, domain, ip, url, hash_sha256).

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.