Public IOC API

A read-only feed of the same indicators shown on the dashboard — botnet C2 hosts, compromised machines, actively exploited CVEs and recent ransomware victims, merged from public sources into one shape. No account, no API key, no sign-up.

Base URL

https://amaravaticyber.com/api/v1/

Every response is CORS-enabled (Access-Control-Allow-Origin: *), so it can be called directly from a browser, a script, a Logic App, or a SIEM connector.

Endpoints

Formats

JSON (default)

{
  "generated_at": "2026-09-22T01:00:00.000Z",
  "api_version": "v1",
  "disclaimer": "Aggregated from public sources…",
  "attribution": [
    { "name": "CISA Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "U.S. Government public domain" }
  ],
  "sources": [
    { "name": "CISA KEV", "ok": true, "count": 40, "response_ms": 179, "error": null }
  ],
  "count": 10,
  "indicators": [
    {
      "type": "ip",
      "value": "27.133.154.218",
      "context": "QakBot · offline · port 443 · SAKURA-B SAKURA Internet Inc.",
      "tags": ["c2", "botnet", "qakbot"],
      "seenAt": "2022-06-04T21:24:53",
      "source": "Feodo Tracker (abuse.ch)",
      "link": "https://feodotracker.abuse.ch/browse/host/27.133.154.218/"
    }
  ]
}

CSV — ?format=csv

One row per indicator: type,value,context,tags,source,seen_at,link. For a spreadsheet or a bulk import that wants a flat table.

Plain text — ?format=text

One raw indicator value per line — nothing else. For a script that just wants addresses to drop into a block list. CVEs and victim names are left out here since they are not addresses; use json or csv for those.

STIX 2.1 — ?format=stix

A STIX bundle: indicator objects with a pattern for IPs, domains, URLs and hashes; vulnerability objects for CVEs; identity objects for ransomware victims, since a company name is the thing that was targeted, not an observable to pattern-match. This is the shape most SIEM and threat-intel platforms expect for a bulk import.

Microsoft Sentinel

Sentinel's Threat Intelligence connector can ingest a STIX 2.1 bundle. The straightforward path:

1. A Logic App on a schedule (hourly is more than enough — see rate limits below) calls GET /api/v1/iocs?format=stix.
2. Feed the response body into Sentinel's Threat Intelligence Upload Indicators API action, or a Logic App connector that accepts a STIX bundle directly.
3. Optionally narrow with &type=c2,cve first, if you only want infrastructure and exploited vulnerabilities rather than the full set including ransomware victims.

The same pattern works for Splunk, Elastic or a custom script — poll the endpoint, parse JSON or CSV, ingest.

Rate limits & caching

Responses are cached at Cloudflare's edge for five minutes, so polling more often than that returns the same cached answer rather than re-fetching upstream — there is no reason to poll faster. A sensible interval is every 15–60 minutes. On top of that, each endpoint is capped at 30 requests per minute per IP address; going over returns 429 Too Many Requests with a Retry-After header telling you how many seconds to wait. This is a small, free, single-maintainer service; please do not hammer it.

Terms

• Read-only, no authentication, free.
• Data is aggregated from public sources, credited above and in every response's attribution field. This project does not claim ownership of the underlying data.
• No uptime guarantee, no SLA. This can change or go away.
• Do not rely on this as your only source for anything safety- or compliance-critical.

See the full Terms of use and Privacy notice, which apply to the API the same as the dashboard — no accounts, no tracking, no logging of who calls this.