Threat List

Today's list can be found here.

Purpose: To serve as a general-purpose master IP blacklist.

Description: This API aggregates a number of IP blacklists including malware hosts, attackers, botnets, and spam. The list is updated daily and historic data is available. Individual domains can also be checked against the list of IPs.

*Note that the list is aggressive and can include tens of thousands of IPs each day.

API Usage

Retrieve current list


Plain text
GET: mattyroberts.io/api/threatlist/latest


JSON
GET: mattyroberts.io/api/threatlist/latest?type=json

Retrieve historic list


Plain text
GET: mattyroberts.io/api/threatlist/:DATE

Example: mattyroberts.io/api/threatlist/2017-11-14


JSON
GET: mattyroberts.io/api/threatlist/:DATE?type=json

Example: mattyroberts.io/api/threatlist/2017-11-14?type=json

Check a single IP


GET: mattyroberts.io/api/threatlist/ip/:IP_ADDRESS

Examples:

GET: mattyroberts.io/api/threatlist/ip/124.246.166.74
200 OK			
{
	"malicious": true,
	"ip": "124.246.141.153"
}

GET: mattyroberts.io/api/threatlist/ip/192.168.0.1
200 OK			
{
	"malicious": false,
	"ip": "192.168.0.1"
}


GET: mattyroberts.io/api/threatlist/ip/1000.0.1.1
400 BAD REQUEST
{
    "error": "malformed IP"
}

Check a single domain


GET: mattyroberts.io/api/threatlist/domain/:DOMAIN

Examples:

GET: mattyroberts.io/api/threatlist/domain/evilstuff.com
200 OK			
{
	"malicious": false,
	"domain": "evilstuff.com",
	"ip": "207.148.248.143"
}

GET: mattyroberts.io/api/threatlist/domain/goodstuff.com
200 OK			
{
	"malicious": false,
	"domain": "goodstuff.com",
	"ip": "184.168.37.1"
}


GET: mattyroberts.io/api/threatlist/domain/baddomain
400 BAD REQUEST
{
    "error": "malformed domain"
}