All feeds are delivered in a single JSON format and split into two indicator types — IP addresses and domains. Some feeds run in incremental mode, others in live mode; the mode is determined by the nature of the feed's data: verifiable infrastructure (C2, malicious IPs/domains) is delivered as live, while detection streams (DGA, scam, OSINT) are delivered as daily lists.
Each day a new list of indicators discovered over the last 24 hours is generated. The first_seen and last_seen fields match the export date.
The list contains only indicators active right now; inactive infrastructure is removed from the feed. first_seen reflects the date of first detection, last_seen the date of last confirmed activity.
Every export is a single JSON file with feed metadata and an array of indicators. The record structure is the same across all feeds;
only the indicator type (ip / domain) and its type-specific fields differ.
{
"generated_at": "2026-07-03T13:52:35Z",
"feed_name": "main_ips",
"feed_type": "live",
"count": 531,
"indicators": [
{
"value": "185.246.220.107",
"id": "d9301b48…22d5e",
"source": "threatcat",
"type": "ip",
"first_seen": "2026-04-09",
"last_seen": "2026-07-03",
"category": "bo_team",
"related": [
"rlon.fun"
]
}
]
}
{
"generated_at": "2026-07-03T13:52:35Z",
"feed_name": "scam_domains",
"feed_type": "incremental",
"count": 1,
"indicators": [
{
"value": "user-account-check.online",
"id": "d71abafc…f089ee",
"source": "threatcat",
"type": "domain",
"first_seen": "2026-07-02",
"last_seen": "2026-07-03",
"category": "suspicious",
"extensions": {
"domainName": "user-account-check.online",
"registrar": "REG.RU LLC",
"creationDate": "2026-07-02 10:33:48",
"nameServers": [
"ns1.reg.ru",
"ns2.reg.ru"
]
},
"related": [
"87.120.107.209"
]
}
]
}
| Field | Type | Description |
|---|---|---|
| generated_at | ISO 8601 | Time the export was generated |
| feed_name | string | Technical feed name (e.g. main_ips) |
| feed_type | live / incremental | Delivery mode of this export |
| count | number | Number of indicators in the export |
| value | string | The indicator itself — an IP address or domain |
| id | sha256 | Unique record identifier |
| type | ip / domain | Indicator type |
| first_seen | date | Date of first detection |
| last_seen | date | Date of last confirmed activity |
| category | string | Category / C2 framework name / threat type |
| related | array | Related indicators (domains on an IP, or vice versa) |
| extensions | object · domains only | Registration data: registrar, creation date, name servers |
IP addresses of active command servers running C2 frameworks. Each address is verified via network fingerprints — the feed only contains infrastructure that responds at export time. The category field holds the framework name, related holds domains hosted on the address.
The primary feed of malicious IP addresses: C2 infrastructure, phishing and malware hosting, botnet nodes. Aggregates confirmed indicators of every category in one list — an entry point for perimeter blocking.
The primary feed of currently active malicious domains: domains resolve and malicious activity is confirmed. Records are enriched with registration data (extensions) and links to IP addresses (related).
IP addresses with indirect signs of malicious activity that haven't yet received final attribution: suspicious network fingerprints, characteristic configurations, proximity to confirmed infrastructure. Candidates for blocking at organizations with a strict security posture.
Domains generated by Domain Generation Algorithms (DGA), used by malware to reach command servers. A daily list of newly registered and detected DGA domains with registrar and name-server data.
Domains showing signs of preparation for malicious activity: brandsquatting, typosquatting, phishing patterns in names, suspicious registration data. A daily list for proactive detection — before a domain is put to use in an attack.
Indicators from open sources: public reports, APT campaign research, vendor publications. Aggregated, normalized, and deduplicated into a single format — no need to parse dozens of differently formatted sources by hand.
Domains of fraudulent resources: fake stores and payment pages, investment scam schemes, fake bank and service websites. A daily list to protect customers and employees from financial fraud.
Access to feeds and the indicator database is granted via an API key, passed as a query parameter in the request. The key determines what you can access — downloading feed files or making queries against the database. Limit — 1 request per second per key.
Grants access to the feed files you're subscribed to. Valid until a set date — after expiry, requests are rejected.
Grants access to queries such as reverse_ip, whois, subdomains. Limited by number of uses — each successful call consumes one.
{
"valid": true,
"type": "timed",
"owner": "example",
"permissions": ["main_ips"],
"expires_at": "2026-12-31 00:00:00",
"uses_remaining": null,
"created_at": "2026-01-01 00:00:00"
}
timed key). On success — the file is returned in the response body; on error — JSON with a description.{ "success": false, "error": "key expired" }
token key). Each successful call consumes one use. Available actions are listed below.{
"success": true,
"action": "reverse_ip",
"page": 1,
"per_page": 100,
"total": 120,
"pages": 2,
"data": [
{ "first_seen": "2025-11-11", "last_seen": "2026-07-06", "name": "rapsovodstvo.ru", "ip": "8.8.8.8" },
{ "first_seen": "2026-01-07", "last_seen": "2026-03-09", "name": "qqjcane.cn", "ip": "8.8.8.8" }
],
"uses_remaining": 9962
}
{
"success": true,
"action": "subdomains",
"page": 1,
"per_page": 100,
"total": 52,
"pages": 1,
"data": [
{ "first_seen": "2025-11-13", "last_seen": "2025-11-13", "name": "go.ya.ru", "ip": "87.250.251.249" },
{ "first_seen": "2026-02-12", "last_seen": "2026-02-13", "name": "uniproxy.alice.ya.ru", "ip": "213.180.204.80" }
],
"uses_remaining": 9963
}
{
"success": true,
"action": "whois",
"uses_remaining": 97,
"result": {
"registrar": "Registrar of Domain Names REG.RU LLC",
"creationDate": "2026-07-02 10:33:48",
"nameServers": [
"ns1.reg.ru",
"ns2.reg.ru"
]
}
}
| Error | Reason |
|---|---|
| key not found | The key doesn't exist or was entered incorrectly |
| key expired | The key has expired |
| no access rights to this feed | The key doesn't grant access to the requested feed |
| feed file not found | The export file is temporarily unavailable |
| Feed | Type | Mode | Purpose |
|---|---|---|---|
| C2 Frameworks Feed | IP | Live | Active C2-framework servers |
| Main IP Feed | IP | Live | Primary feed of malicious IPs |
| Main Domain Feed | Domains | Live | Primary feed of malicious domains |
| Suspicious IP Feed | IP | Live | IPs showing signs of malicious activity |
| DGA Feed | Domains | Incremental | Algorithmically generated domains |
| Suspicious Domains Feed | Domains | Incremental | Brandsquatting and phishing patterns |
| Scam Feed | Domains | Incremental | Fraudulent resources |
| OSINT Feed | — | Incremental | Indicators from open sources |