Threat feed API

• GET/api/v1/feed.json

  The blocking feed. Domain-only, deduplicated, licence-checked. Poll every 15–60 minutes and honour the ETag.

  parameters: none

• GET/api/v1/indicators

  Richer recent intelligence with provenance and first-seen, including non-domain types.

  parameters: hours (1–2160, default 24), limit (1–1000, default 100), category, severity, type

• GET/api/v1/lookup

  What the Observatory holds about one value, with per-source provenance and infrastructure relationships.

  parameters: indicator (domain, IP, URL or file hash) — required

• GET/api/v1/health

  Feed availability, indicator count and snapshot age. Sanitised: no internal telemetry.

  parameters: none

curl -s https://threats.dnsdaddy.dev/api/v1/feed.json | jq '.indicator_count'

# Conditional polling: no body when nothing changed
curl -s -o /dev/null -w '%{http_code}\n' \
  -H 'If-None-Match: "<etag from last response>"' \
  https://threats.dnsdaddy.dev/api/v1/feed.json

Poll no more than once per five minutes; the snapshot is rebuilt on that cadence and a repeated request otherwise just returns the same ETag.

{
  "generated_at": "2026-01-01T00:00:00Z",
  "source": "dnsdaddy-threat-observatory",
  "version": 1,
  "indicator_count": 4812,
  "window_days": 90,
  "attribution": ["abuse.ch ThreatFox (CC0)", "abuse.ch URLhaus (CC0)"],
  "indicators": [
    {
      "value": "malicious-example.com",
      "type": "domain",
      "severity": "critical",
      "categories": ["c2"],
      "family": "AsyncRAT",
      "last_seen": "2026-01-01T00:00:00Z"
    }
  ]
}

1. 01Only sources whose recorded licence permits full republication contribute a published value. Restricted and subscription-delivered datasets are used for internal correlation and counts only.
2. 02Infrastructure-context sources never produce a blocking verdict, however confident they are about the hosting.
3. 03Values must map to a canonical category — malware, phishing, c2 or cryptomining. Unclassified observations are withheld.
4. 04IP literals, URLs, malformed hostnames and shared hosting or storage domains are excluded from the blocking feed.
5. 05One row per logical indicator: categories are unioned, the highest defensible severity wins, the latest last_seen wins, and a malware family is kept only when the sources agree.
6. 06Generation is atomic. If a build collapses to zero after previously publishing indicators, the endpoint returns 503 so your resolver keeps its last known-good copy instead of unblocking everything.