Sign in

v1

latestOpenAPI 3.0.0Proprietary2026-07-244990150.4 KB
Callback

Callback Overview Statistics

Retrieve aggregate statistics for callback IPs including counts by attack stage, file analysis status, scanner associations, and top threat names.

post/v1/callback/overview

Request body

is_stage_1boolean

Filter by stage 1 status. true = file downloaded from this IP.

is_stage_2boolean

Filter by stage 2 status. true = suspected C2 based on VT/sandbox analysis.

first_seen_afterstring date

Only include IPs first seen after this date (YYYY-MM-DD).

first_seen_beforestring date

Only include IPs first seen before this date (YYYY-MM-DD).

last_seen_afterstring date

Only include IPs last seen after this date (YYYY-MM-DD).

last_seen_beforestring date

Only include IPs last seen before this date (YYYY-MM-DD).

has_filesboolean

If true, only include IPs with associated malware files. If false, only IPs without files.

file_typestring

Filter by file MIME type (e.g. "application/x-executable").

file_namestring

Filter by file name substring match.

file_hashstring

Filter by file SHA256 hash.

scanner_ipsstring[]

Filter to IPs associated with these scanner IPs.

ipsstring[]

Filter to this specific set of callback IPs.

Response

OK - overview statistics returned.

total_ipsinteger

Total number of callback IPs.

stage_1_ipsinteger

Number of stage 1 (initial payload delivery) IPs.

stage_2_ipsinteger

Number of stage 2 (post-exploitation callback) IPs.

unconfirmed_ipsinteger

Number of IPs not yet confirmed as stage 1 or stage 2.

total_filesinteger

Total number of associated malware files.

files_with_vtinteger

Files that have been analyzed by VirusTotal.

files_without_vtinteger

Files pending VirusTotal analysis.

total_cross_refsinteger

Total IP-to-file associations.

total_scanner_linksinteger

Total scanner-to-callback-IP associations.

ips_with_filesinteger

Number of IPs that have associated files.

ips_without_filesinteger

Number of IPs with no associated files.

ips_with_scannersinteger

Number of IPs with known scanner associations.

ips_without_scannersinteger

Number of IPs with no known scanner associations.

distinct_scannersinteger

Total number of unique scanner IPs.

riot_level_1_ipsinteger

Number of IPs at RIOT trust level 1.

riot_level_2_ipsinteger

Number of IPs at RIOT trust level 2.

riot_level_3_ipsinteger

Number of IPs at RIOT trust level 3.

not_riot_ipsinteger

Number of IPs not classified as RIOT.

Example response

{
  "total_ips": 142,
  "stage_1_ips": 98,
  "stage_2_ips": 44,
  "total_files": 230,
  "files_with_vt": 180,
  "files_without_vt": 50,
  "total_cross_refs": 312,
  "total_scanner_links": 456,
  "ips_with_files": 110,
  "ips_without_files": 32,
  "ips_with_scanners": 130,
  "ips_without_scanners": 12,
  "distinct_scanners": 89,
  "top_threat_names": [
    {
      "threat_name": "Trojan.GenericKD.46542",
      "file_count": 12,
      "ip_count": 8
    }
  ]
}