---
title: "Fetch URL risk list"
method: GET
path: "/url/risklist"
tags: ["URL"]
---

# Fetch URL risk list

`GET /url/risklist`

Download URLs filtered by risk rule in CSV/Splunk or STIX format for SIEM and web proxy integration.

## Query parameters

- `format` 'csv/splunk' | 'xml/stix/1.1.1' | 'xml/stix/1.2' | 'application/stix+json;version=2.1'
- `gzip` boolean
- `list` 'analystNote' | 'botnetUrl' | 'cncUrl' | 'defangedURL' | 'default' | 'dhsAis' | 'fraudulentContent' | 'historicalThreatListMembership' | 'large' | 'malwareSiteDetected' | 'malwareSiteSuspected' | 'miningSiteDetected' | 'noKnownRisk' | 'observedTelemetry' | 'phishingSiteDetected' | 'phishingSiteSuspected' | 'proxyUrl' | 'recentAnalystNote' | 'recentBotnetUrl' | 'recentCncUrl' | 'recentDefangedURL' | 'recentDhsAis' | 'recentFraudulentContent' | 'recentMalwareSiteDetected' | 'recentMalwareSiteSuspected' | 'recentMiningSiteDetected' | 'recentPhishingSiteDetected' | 'recentPhishingSiteSuspected' | 'recentProxyUrl' | 'recentRelatedNote' | 'recentReportedCncUrl' | 'recentSpamSiteDetected' | 'recentSuspectedCncUrl' | 'recentWeaponizedURL' | 'relatedNote' | 'reportedCncUrl' | 'spamSiteDetected' | 'suspectedCncUrl'

## Response `200`

Result of operation

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)