---
title: "Fetch URL risk list"
method: GET
path: "/url/risklist"
tags: ["URL"]
---

# Fetch URL risk list

`GET /url/risklist`

## Request

- Base URL: `https://api.recordedfuture.com/v2`
- URL: `https://api.recordedfuture.com/v2/url/risklist`
- Auth: API key in header `X-RFToken`

Download URLs filtered by risk rule in CSV/Splunk or STIX format for SIEM and web proxy integration.

## Query parameters

- `format` 'csv/splunk' | 'xml/stix/1.1.1' | 'xml/stix/1.2' | 'application/stix+json;version=2.1'
- `gzip` boolean
- `list` 'analystNote' | 'botnetUrl' | 'cncUrl' | 'defangedURL' | 'default' | 'dhsAis' | 'fraudulentContent' | 'historicalThreatListMembership' | 'large' | 'malwareSiteDetected' | 'malwareSiteSuspected' | 'miningSiteDetected' | 'noKnownRisk' | 'observedTelemetry' | 'phishingSiteDetected' | 'phishingSiteSuspected' | 'proxyUrl' | 'recentAnalystNote' | 'recentBotnetUrl' | 'recentCncUrl' | 'recentDefangedURL' | 'recentDhsAis' | 'recentFraudulentContent' | 'recentMalwareSiteDetected' | 'recentMalwareSiteSuspected' | 'recentMiningSiteDetected' | 'recentPhishingSiteDetected' | 'recentPhishingSiteSuspected' | 'recentProxyUrl' | 'recentRelatedNote' | 'recentReportedCncUrl' | 'recentSpamSiteDetected' | 'recentSuspectedCncUrl' | 'recentWeaponizedURL' | 'relatedNote' | 'reportedCncUrl' | 'spamSiteDetected' | 'suspectedCncUrl'

## Response `200`

Result of operation

---

[API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)