Attacker Infrastructure

API / Schema

Integrate with VulnCheck Attacker Infrastructure using the VulnCheck API and an easy to follow JSON schema.

VulnCheck Attacker Infrastructure is available to VulnCheck Community accounts through the vulncheck-attacker-infrastructure index. You can query it with filters, or download the whole index as a backup.

Query the index

Results are sorted by last_seen, most recent first.

curl --request GET \
    --url 'https://api.vulncheck.com/v3/index/vulncheck-attacker-infrastructure?classifications=c2:sliver' \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

vulncheck index list vulncheck-attacker-infrastructure --countrycode AU

Query parameters

Parameter	Description	Example
`ip`	Records for an IP address	`ip=3.145.168.65`
`hostname`	Records for a hostname	`hostname=artex.dpdns.org`
`port`	Records on a port	`port=443`
`asn`	Records in an autonomous system	`asn=AS16509`
`country`	Records in a country, by name	`country=Australia`
`country_code`	Records in a country, by ISO 3166-1 alpha-2 code	`country_code=US`
`classifications`	Records with a classification. Use the full classification, including the value	`classifications=c2:sliver`
`source`	Records from one collection source: `target-intel` or `canary-intel`	`source=canary-intel`
`date`	Records last seen on a date (`YYYY-MM-DD`)	`date=2026-11-09`
`pubStartDate` / `pubEndDate`	Records last seen within a date range (`YYYY-MM-DD`)	`pubStartDate=2026-11-01&pubEndDate=2026-11-09`
`updatedAtStartDate` / `updatedAtEndDate`	Records updated within a date range (`YYYY-MM-DD`)	`updatedAtStartDate=2026-11-09`

Parameters can be combined. For example, ?source=canary-intel&port=443 returns canary-observed infrastructure on port 443.

Unrecognized query parameters are ignored, and the full index is returned. Check parameter names if a filtered query returns more results than expected.

Download the backup

The backup is a zip file containing newline-delimited JSON, one record per line. Use the backup to retrieve the full index.

curl --request GET \
    --url https://api.vulncheck.com/v3/backup/vulncheck-attacker-infrastructure \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
 "context"
 "encoding/json"
 "fmt"
 "log"
 "os"

 vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
 configuration := vulncheck.NewConfiguration()
 configuration.Scheme = "https"
 configuration.Host = "api.vulncheck.com"

 client := vulncheck.NewAPIClient(configuration)

 token := os.Getenv("VULNCHECK_API_TOKEN")
 auth := context.WithValue(
  context.Background(),
  vulncheck.ContextAPIKeys,
  map[string]vulncheck.APIKey{
   "Bearer": {Key: token},
  },
 )
 resp, httpRes, err := client.EndpointsAPI.BackupIndexGet(auth, "vulncheck-attacker-infrastructure").Execute()

 if err != nil || httpRes.StatusCode != 200 {
  log.Fatal(err)
 }

 prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
 if err != nil {
  log.Fatalf("Failed to generate JSON: %v", err)
  return
 }

 fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    endpoints_client = vulncheck_sdk.EndpointsApi(api_client)

    api_response = endpoints_client.backup_index_get("vulncheck-attacker-infrastructure")

    print(api_response.data[0].url)

vulncheck backup download vulncheck-attacker-infrastructure

JSON Schema

Field	Type	Description
`ip`	string	IPv4 address. Absent on some Canary Intelligence records that only have a hostname
`hostname`	string	Hostname, when one was observed
`port`	integer	Port the infrastructure was observed on. Can be absent on Canary Intelligence records
`asn`	string	Autonomous system number, such as `AS16509` (Target Intelligence records)
`country`	string	Country name (Target Intelligence records)
`country_code`	string	ISO 3166-1 alpha-2 country code (Target Intelligence records)
`classifications`	array of strings	What the infrastructure is. See Classifications
`source`	array of strings	The collection source that observed the record: `target-intel` or `canary-intel`
`first_seen`	string (RFC 3339 timestamp)	When VulnCheck first observed the record
`last_seen`	string (RFC 3339 timestamp)	When VulnCheck most recently observed the record
`updated_at`	string (RFC 3339 timestamp)	When the record was last updated in the index

Example Attacker Infrastructure entries

Below is an example Target Intelligence record, a Sliver C2 server.

"data": [
  {
    "ip": "3.145.168.65",
    "port": 443,
    "asn": "AS16509",
    "country": "United States",
    "country_code": "US",
    "classifications": [
      "c2:sliver"
    ],
    "source": [
      "target-intel"
    ],
    "first_seen": "2026-11-02T22:01:30.89Z",
    "last_seen": "2026-11-09T22:05:06.504Z",
    "updated_at": "2026-11-10T12:40:17.817Z"
  }
]

Below is an example Canary Intelligence record, a hostname that an exploitation attempt against a VulnCheck canary called back to.

"data": [
  {
    "hostname": "visited-acre-encourages-vii.trycloudflare.com",
    "port": 443,
    "classifications": [
      "attacker-infrastructure"
    ],
    "source": [
      "canary-intel"
    ],
    "first_seen": "2026-11-10T01:51:35Z",
    "last_seen": "2026-11-10T20:25:04Z",
    "updated_at": "2026-11-10T20:25:23.15487516Z"
  }
]

Introduction

Exploit Intelligence 101