---
title: "C2 Host Feed"
method: POST
path: "/threat-feeds/c2"
tags: ["Threat Feeds"]
---

# C2 Host Feed

`POST /threat-feeds/c2`

Cursor-paginated feed of infostealer C2 host rows (one row per host per UTC day). Requires the `c2_threat_feed` api permission. Pass `pageInfo.nextCursor` back as `cursor` for the next page. Filters are optional and AND-combined; `dateFrom`/`dateTo` take precedence over `date`.

## Request body

- object
  - `date` string — A single UTC day (YYYY-MM-DD). Ignored if a range is given.
  - `dateFrom` string — Inclusive range start on `dayUtc`.
  - `dateTo` string — Inclusive range end on `dayUtc`.
  - `host` string — Exact host match (lower-cased, trimmed).
  - `family` string — Malware family membership (lower-cased).
  - `country` string — ISO-2 country, exact (upper-cased).
  - `feedType` string
  - `reviewStatus` string — Deprecated. Accepted but ignored — this field no longer exists on feed records.
  - `asn` integer — Autonomous system number.
  - `sort` 'date' | 'seen' | 'host' — `date` = dayUtc, `seen` = seenAtDate (nulls excluded), `host` = host.
  - `dir` 'asc' | 'desc'
  - `cursor` string — Opaque keyset cursor from a previous response's `pageInfo.nextCursor`. Omit for the first page. Must match the `sort`/`dir` it was issued for (else `400`).
  - `limit` integer — Rows per page. Clamped to [1, 200].
  - `withTotal` boolean — When true, also compute `pageInfo.total` via a full count over the filter. Expensive — avoid unless needed.

## Response `200`

Successful operation

- object
  - `data` object[]
    - `_id` string — Unique record identifier.
    - `host` string — C2 host (domain or IP).
    - `dayUtc` string — UTC day the host was seen (YYYY-MM-DD).
    - `feedType` string, nullable — Source feed type.
    - `families` string[] — Malware families associated with the host.
    - `tags` string[] — Free-form classification tags.
    - `infraType` string, nullable — Infrastructure type.
    - `country` string, nullable — ISO-2 country code.
    - `asn` integer, nullable — Autonomous system number.
    - `asOrg` string, nullable — AS organisation name.
    - `resolvedIps` string[] — Resolved IP addresses.
    - `ports` integer[] — Observed ports.
    - `sha256` string[] — Deduped sample hashes associated with the host.
    - `dnsActivity` integer — DNS activity count for the 7-day window.
    - `dnsActivityByWindow` object[] — DNS activity counts by lookback window (7/14/30/60/90 days).
      - `windowDays` integer
      - `count` integer
    - `passiveDnsHits` integer — Passive DNS hit count.
    - `trancoRank` integer, nullable — Tranco popularity rank (1–100000), or null if unranked.
    - `firstSeen` string, nullable — Upstream first-seen timestamp (ISO string).
    - `lastSeen` string, nullable — Upstream last-seen timestamp (ISO string).
    - `addedAt` string, nullable — When the host was added to the feed (ISO string).
    - `createdAt` string, date-time — Record creation time.
    - `updatedAt` string, date-time — Record last-update time.
  - `pageInfo` object
    - `limit` integer
    - `count` integer
    - `hasMore` boolean
    - `nextCursor` string, nullable — Opaque keyset cursor for the next page. Pass it back as `cursor` to fetch the next page. `null` when `hasMore` is false. A cursor is bound to its sort+filter context — changing `sort`/`dir`/filters invalidates it.
    - `total` integer — Total documents matching the filter (no cursor). Present only when `withTotal: true` was sent. Expensive — a full count over the filter.
    - `sort` object
      - `key` string
      - `dir` 'asc' | 'desc'

## Other responses

- `400` — Validation error — malformed date, unknown sort/dir, or a cursor that does not match the requested sort.
- `401` — Missing or invalid `api-key`.
- `403` — The API key lacks the required permission for this feed.
- `500` — Internal server error.

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)