CyberService

The CyberService provides APIs for cyber threat intelligence aggregated from multiple authoritative sources including Feodo Tracker, URLhaus, AlienVault OTX, AbuseIPDB, and C2Intel.

Base Path

/api/cyber/v1

ListCyberThreats

Retrieves threat indicators from multiple intelligence sources with filtering by time range, threat type, source, and severity. Endpoint: GET /api/cyber/v1/list-cyber-threats

Request Parameters

start

int64

Start of time range (inclusive), Unix epoch milliseconds

end

int64

End of time range (inclusive), Unix epoch milliseconds

page_size

int32

Maximum items per page (1-100)

cursor

string

Cursor for next page

type

CyberThreatType

Optional threat type filter: CYBER_THREAT_TYPE_C2_SERVER, CYBER_THREAT_TYPE_MALWARE_HOST, CYBER_THREAT_TYPE_PHISHING, or CYBER_THREAT_TYPE_MALICIOUS_URL

source

CyberThreatSource

Optional source filter: CYBER_THREAT_SOURCE_FEODO, CYBER_THREAT_SOURCE_URLHAUS, CYBER_THREAT_SOURCE_C2INTEL, CYBER_THREAT_SOURCE_OTX, or CYBER_THREAT_SOURCE_ABUSEIPDB

min_severity

CriticalityLevel

Optional minimum criticality filter

Response

threats

CyberThreat[]

The list of cyber threats

Show CyberThreat

string

required

Unique threat identifier

type

CyberThreatType

Type of cyber threat

source

CyberThreatSource

Source of the threat intelligence

indicator

string

Threat indicator value (IP, domain, or URL)

indicator_type

CyberThreatIndicatorType

Type of the indicator: CYBER_THREAT_INDICATOR_TYPE_IP, CYBER_THREAT_INDICATOR_TYPE_DOMAIN, or CYBER_THREAT_INDICATOR_TYPE_URL

location

GeoCoordinates

Geolocation of the threat indicator

country

string

Country of origin (ISO 3166-1 alpha-2)

severity

CriticalityLevel

Threat criticality level

malware_family

string

Associated malware family, if known (e.g., “Emotet”, “TrickBot”)

Example Request

curl "https://your-domain.com/api/cyber/v1/list-cyber-threats?start=1704067200000&end=1709251200000&type=CYBER_THREAT_TYPE_C2_SERVER&source=CYBER_THREAT_SOURCE_FEODO&page_size=50"

Example Response

{
  "threats": [
    {
      "id": "feodo-192-0-2-1",
      "type": "CYBER_THREAT_TYPE_C2_SERVER",
      "source": "CYBER_THREAT_SOURCE_FEODO",
      "indicator": "192.0.2.1",
      "indicator_type": "CYBER_THREAT_INDICATOR_TYPE_IP",
      "location": {
        "latitude": 52.3676,
        "longitude": 4.9041
      },
      "country": "NL",
      "severity": "CRITICALITY_LEVEL_HIGH",
      "malware_family": "Emotet",
      "tags": ["botnet", "c2", "banking-trojan"],
      "first_seen_at": 1704153600000,
      "last_seen_at": 1709208000000
    },
    {
      "id": "urlhaus-malware-xyz",
      "type": "CYBER_THREAT_TYPE_MALWARE_HOST",
      "source": "CYBER_THREAT_SOURCE_URLHAUS",
      "indicator": "http://malicious-example.com/payload.exe",
      "indicator_type": "CYBER_THREAT_INDICATOR_TYPE_URL",
      "location": {
        "latitude": 37.7749,
        "longitude": -122.4194
      },
      "country": "US",
      "severity": "CRITICALITY_LEVEL_CRITICAL",
      "malware_family": "AsyncRAT",
      "tags": ["malware-distribution", "rat", "remote-access"],
      "first_seen_at": 1708992000000,
      "last_seen_at": 1709164800000
    },
    {
      "id": "otx-phishing-001",
      "type": "CYBER_THREAT_TYPE_PHISHING",
      "source": "CYBER_THREAT_SOURCE_OTX",
      "indicator": "phishing-site.example.com",
      "indicator_type": "CYBER_THREAT_INDICATOR_TYPE_DOMAIN",
      "location": {
        "latitude": 51.5074,
        "longitude": -0.1278
      },
      "country": "GB",
      "severity": "CRITICALITY_LEVEL_MEDIUM",
      "malware_family": "",
      "tags": ["phishing", "credential-theft", "banking"],
      "first_seen_at": 1709078400000,
      "last_seen_at": 1709251200000
    }
  ],
  "pagination": {
    "cursor": "eyJvZmZzZXQiOjUwfQ==",
    "has_more": true
  }
}

Threat Types

The CyberThreatType enum classifies threats into four categories:

C2_SERVER: Command and control servers used by threat actors to control compromised systems
MALWARE_HOST: Servers hosting malware payloads for distribution
PHISHING: Phishing sites designed to steal credentials or sensitive information
MALICIOUS_URL: Other malicious URLs that don’t fit the above categories

Threat Sources

The service aggregates data from five authoritative sources:

Feodo Tracker (abuse.ch)

Tracks botnet C2 servers, particularly banking trojans like Emotet, TrickBot, and Dridex.

URLhaus (abuse.ch)

Collects and shares malware distribution URLs, including payload hosting sites.

C2Intel

Specialized feed of command and control server indicators.

AlienVault OTX (Open Threat Exchange)

Community-driven threat intelligence platform with IOCs from security researchers worldwide.

AbuseIPDB

Crowdsourced IP address reputation database tracking malicious activity.

Indicator Types

Threats are categorized by indicator type:

IP: IP addresses (IPv4 or IPv6)
DOMAIN: Domain names
URL: Full URLs including path and parameters

Severity Levels

Threat severity is assessed using the CriticalityLevel enum:

CRITICALITY_LEVEL_LOW: Low risk, monitoring recommended
CRITICALITY_LEVEL_MEDIUM: Moderate risk, investigate and consider blocking
CRITICALITY_LEVEL_HIGH: High risk, immediate action recommended
CRITICALITY_LEVEL_CRITICAL: Critical risk, block immediately

Use Cases

Threat Hunting

Query for specific malware families or threat types to proactively search for indicators in your environment.

curl "https://your-domain.com/api/cyber/v1/list-cyber-threats?type=CYBER_THREAT_TYPE_C2_SERVER&page_size=100"

Geographic Analysis

Analyze threat distribution by country to identify regional patterns:

curl "https://your-domain.com/api/cyber/v1/list-cyber-threats?source=CYBER_THREAT_SOURCE_ABUSEIPDB&page_size=100"

Firewall/IDS Integration

Pull latest indicators to update firewall rules or IDS signatures:

# Get threats from last 24 hours
START=$(date -d '24 hours ago' +%s)000
END=$(date +%s)000
curl "https://your-domain.com/api/cyber/v1/list-cyber-threats?start=$START&end=$END&min_severity=CRITICALITY_LEVEL_HIGH&page_size=100"

Malware Campaign Tracking

Monitor specific malware families over time:

curl "https://your-domain.com/api/cyber/v1/list-cyber-threats?source=CYBER_THREAT_SOURCE_FEODO&page_size=100"

Best Practices

Regular Polling: Query the API regularly (e.g., every 15-30 minutes) to stay current with emerging threats
Severity Filtering: Use min_severity to focus on high-impact threats
Source Diversity: Don’t rely on a single source; aggregate data from multiple feeds
Geolocation Context: Use the location and country fields to add geographic context to threat analysis
Tag-Based Analysis: Leverage the tags field to identify threat patterns and campaigns

Overview

Services

Data Sources

Base Path

ListCyberThreats

Request Parameters

Response

Example Request

Example Response

Threat Types

Threat Sources

Feodo Tracker (abuse.ch)

URLhaus (abuse.ch)

C2Intel

AlienVault OTX (Open Threat Exchange)

AbuseIPDB

Indicator Types

Severity Levels

Use Cases

Threat Hunting

Geographic Analysis

Firewall/IDS Integration

Malware Campaign Tracking

Best Practices

Build docs developers (and LLMs) love

Overview

Services

Data Sources

​Base Path

​ListCyberThreats

​Request Parameters

​Response

​Example Request

​Example Response

​Threat Types

​Threat Sources

​Feodo Tracker (abuse.ch)

​URLhaus (abuse.ch)

​C2Intel

​AlienVault OTX (Open Threat Exchange)

​AbuseIPDB

​Indicator Types

​Severity Levels

​Use Cases

​Threat Hunting

​Geographic Analysis

​Firewall/IDS Integration

​Malware Campaign Tracking

​Best Practices

Build docs developers (and LLMs) love

Base Path

ListCyberThreats

Request Parameters

Response

Example Request

Example Response

Threat Types

Threat Sources

Feodo Tracker (abuse.ch)

URLhaus (abuse.ch)

C2Intel

AlienVault OTX (Open Threat Exchange)

AbuseIPDB

Indicator Types

Severity Levels

Use Cases

Threat Hunting

Geographic Analysis

Firewall/IDS Integration

Malware Campaign Tracking

Best Practices