Threat List

Today's list can be found here.


Purpose: To serve as a general-purpose master IP blacklist.

Description: This API aggregates a number of IP blacklists including malware hosts, attackers, botnets, and spam. The list is updated daily and historic data is available. Individual domains can also be checked against the list of IPs.

Note that the list is aggressive and can include tens of thousands of IPs each day.



API Usage


Retrieve current list


Plain text
GET: matthewroberts.io/api/threatlist/latest


JSON
GET: matthewroberts.io/api/threatlist/latest?type=json
				


Retrieve historic list


Plain text
GET: matthewroberts.io/api/threatlist/:DATE

Example: matthewroberts.io/api/threatlist/2017-11-14


JSON
GET: matthewroberts.io/api/threatlist/:DATE?type=json

Example: matthewroberts.io/api/threatlist/2017-11-14?type=json
				


Check a single IP


GET: matthewroberts.io/api/threatlist/ip/:IP_ADDRESS

Examples:

GET: matthewroberts.io/api/threatlist/ip/124.246.166.74
200	OK			
{
	"malicious": true,
	"ip": "124.246.141.153"
}

GET: matthewroberts.io/api/threatlist/ip/192.168.0.1
200	OK			
{
	"malicious": false,
	"ip": "192.168.0.1"
}


GET: matthewroberts.io/api/threatlist/ip/1000.0.1.1
400 BAD REQUEST
{
    "error": "malformed IP"
}

				


Check a single domain


GET: matthewroberts.io/api/threatlist/domain/:DOMAIN

Examples:

GET: matthewroberts.io/api/threatlist/domain/evilstuff.com
200	OK			
{
	"malicious": false,
	"domain": "evilstuff.com",
	"ip": "207.148.248.143"
}

GET: matthewroberts.io/api/threatlist/domain/goodstuff.com
200	OK			
{
	"malicious": false,
	"domain": "goodstuff.com",
	"ip": "184.168.37.1"
}


GET: matthewroberts.io/api/threatlist/domain/baddomain
400 BAD REQUEST
{
    "error": "malformed domain"
}