IOC Feed (TCF-2001)

The Spectra Intelligence IOC Feed delivers structured threat intelligence as a compressed JSONL file. Each record in the file represents a single Indicator of Compromise (IOC), a file hash (SHA-256), domain, IP address, or URL, together with contextual metadata including associated malware families, MITRE ATT&CK techniques, confidence scoring, structured labels, and relationships to other indicators.

Records are retained for a rolling 90-day window.

Feed delivery

The feed is delivered as a compressed ZIP archive. For hourly and daily intervals, each archive contains one JSONL file per interval, where each file covers exactly one hour or one day of data respectively. For dump, the archive contains a single JSONL file. Every line in each file is a valid, self-contained JSON record following the schema described in this document.

The JSONL filename follows this pattern:

indicators_feed_<interval>_<start_timestamp>.jsonl

For example: indicators_feed_hourly_20260703T050000Z.jsonl

Feed record structure

The following is an example of a complete IOC record. All timestamps are Unix epoch values in UTC.

{
  "schema_version": "1.0",
  "id": "domain_luck51.cc",
  "indicator": "luck51.cc",
  "type": "domain",
  "published_date": 1782864013,
  "last_updated": 1782864034,
  "first_seen": 1777119008,
  "last_seen": 1782255036,
  "expiration_date": 1790640013,
  "actors": [],
  "malware_families": ["Blacklisted"],
  "mitre_attack": [],
  "ip_address_types": [],
  "domain_types": ["malware_file"],
  "url_types": [],
  "hash_types": [],
  "malicious_confidence": "medium",
  "labels": [
    "Malware/Blacklisted",
    "MaliciousConfidence/Medium",
    "ThreatType/Web.Hyperlink.Blacklisted"
  ],
  "relations": [
    {
      "relationship_type": "hosts",
      "related_indicator": "42b4ca1d23df4f6f0db00a30b16f98893a0314d77d2b069b31f335b081c69d65",
      "related_indicator_type": "hash_sha256",
      "related_malicious_confidence": "high",
      "related_source": "ReversingLabs",
      "related_first_seen": "1774553268",
      "related_last_seen": "1782856791"
    }
  ],
  "targets": [],
  "threat_types": [],
  "vulnerabilities": [],
  "source": "ReversingLabs"
}

Top-level fields

Field	Type	Description
`schema_version`	string	Version of the IOC schema. Currently always `"1.0"`.
`id`	string	Unique identifier for the indicator. Formed by combining the indicator type and value, for example: `domain_example.com`, `ip_1.2.3.4`, `hash_sha256_<value>`, `url_https://example.com/path`.
`indicator`	string	The raw indicator value: a domain name, IP address, URL, or file hash.
`type`	string	Type of the indicator. See Indicator types.
`published_date`	integer	Unix timestamp (UTC) when the indicator was first published to the feed.
`last_updated`	integer	Unix timestamp (UTC) of the most recent update to the indicator record.
`first_seen`	integer	Unix timestamp (UTC) when the indicator was first observed in Spectra Intelligence.
`last_seen`	integer	Unix timestamp (UTC) when the indicator was most recently observed.
`expiration_date`	integer	Unix timestamp (UTC) computed as `last_seen + 90 days`.
`actors`	array[string]	Threat actor names associated with this indicator. Empty array if none are attributed.
`malware_families`	array[string]	Malware families linked to this indicator. Empty array if unknown.
`mitre_attack`	array[string]	MITRE ATT&CK technique and tactic IDs associated with the indicator's observed behavior, for example `"T1071"` or `"TA0002"`. Empty array if not mapped.
`ip_address_types`	array[string]	Category labels for IP address indicators sourced from third-party intelligence providers. May be empty even when `type` is `ip`.
`domain_types`	array[string]	Category labels for domain indicators sourced from third-party intelligence providers. May be empty even when `type` is `domain`.
`url_types`	array[string]	Category labels for URL indicators sourced from third-party intelligence providers. May be empty even when `type` is `url`.
`hash_types`	array[string]	Threat classifications for file hash indicators. May be empty even when `type` is `hash_sha256`. For possible values, see Malware Naming Standard.
`malicious_confidence`	string	Confidence level that the indicator is malicious. See Malicious confidence values.
`labels`	array[string]	Structured tags providing additional intelligence context. See Labels object.
`relations`	array[object]	Relationships to other indicators. See Relations object.
`targets`	array[string]	Industries or sectors targeted by the associated threat. Empty array if unknown.
`threat_types`	array[string]	High-level threat categories. Empty array if unclassified.
`vulnerabilities`	array[string]	CVE identifiers for vulnerabilities exploited via this indicator, for example `"CVE-2023-1234"`. Empty array if none apply.
`source`	string	Intelligence provider that originated this indicator record.

Indicator types

The type field determines which *_types array is populated for the indicator. Only the array matching the indicator type may be populated; all others will be empty. The matching array may also be empty.

`type` value	Indicator description
`domain`	A fully qualified domain name used in malicious activity.
`ip`	An IPv4 or IPv6 address associated with malicious infrastructure.
`url`	A complete URL observed in phishing campaigns, malware delivery, or command-and-control traffic.
`hash_sha256`	A SHA-256 file hash identifying a malicious file.

Malicious confidence values

The feed uses three confidence values: high, medium, and low. The calculation differs between network indicators and file indicators.

Network indicators

For domains, IP addresses, and URLs, the confidence level is derived from two factors: the reliability of the signal used for classification, and the age of that signal.

Signal reliability

Reliability level	Criteria
Very reliable	An analyst override to malicious, or a malicious TPS reputation combined with a malicious payload.
Reliable	A malicious payload, a high number of malicious TPS reputation entries (more than 3), or a network IOC found in a C2 configuration.
Less reliable	Three or fewer malicious TPS reputation entries, or a domain TPS reputation applied to a URL.

Confidence by signal reliability and age

	Younger than 30 days	Between 30 and 60 days	Older than 60 days
Very reliable signals	`high`	`medium`	`low`
Reliable signals	`medium`	`medium`	`low`
Less reliable signals	`medium`	`low`	`low`

File indicators

For file hashes, the confidence level is not based on the age of the signal — a malicious file hash does not become less malicious over time. Instead, the confidence level is derived directly from the ReversingLabs classification algorithm.

Labels object

Each element in the labels array is a plain string in Category/Value format, for example "Malware/Mispadu" or "MITRE/T1071".

Label categories

Category prefix	Description
`Actor/`	Threat actor name, for example `Actor/SAMBASPIDER`.
`Malware/`	Malware family name, for example `Malware/Mispadu`.
`MaliciousConfidence/`	Confidence classification mirroring the top-level `malicious_confidence` field, for example `MaliciousConfidence/High`.
`ThreatType/`	High-level threat category. Can be a simple value such as `ThreatType/Ransomware` or a hierarchical path such as `ThreatType/Web.Hyperlink.Blacklisted` or `ThreatType/Script-JS.Trojan.Redirector`.
`MITRE/`	MITRE ATT&CK technique or tactic ID, for example `MITRE/T1071` or `MITRE/TA0002`.

Relations object

Each element in the relations array describes a directional link between the current indicator and another known IOC.

Field	Type	Description
`relationship_type`	string	Nature of the relationship between the indicators. See Relationship types.
`related_indicator`	string	Raw value of the related indicator (domain, IP address, hash, or URL).
`related_indicator_type`	string	Type of the related indicator. Uses the same allowed values as the top-level `type` field.
`related_malicious_confidence`	string	Confidence level for this relationship. Observed values: `high`, `medium`, `low`.
`related_source`	string	Intelligence provider that established this relationship.
`related_first_seen`	string	Unix timestamp (UTC) as a string when this relationship was first observed.
`related_last_seen`	string	Unix timestamp (UTC) as a string when this relationship was most recently observed.

Relationship types

`relationship_type`	Meaning
`resolves_to`	The current URL or domain resolves to the related IP address.
`resolved_from`	The current IP address resolved from the related URL or domain.
`hosts`	The current URL, IP address, or domain hosts the related file.
`hosted_on`	The current file is hosted on the related URL, IP address, or domain.
`downloads`	The current indicator downloads the related file or payload.
`downloaded_from`	The current file is downloaded from the related URL, IP address, or domain.
`communicates_with`	The current indicator communicates with the related IP address or domain.
`contacted_by`	The current URL, IP address, or domain is contacted by the related file.
`drops`	The current file drops the related file.
`dropped_by`	The current file is dropped by the related file.
`contains_url`	The current file contains the related URL.
`contains_domain`	The current file contains the related domain.
`contains_ip`	The current file contains the related IP address.
`redirects_to`	The current URL redirects to the related URL.
`parent_of`	The current file is the parent of the related file.
`child_of`	The current file is the child of the related file.

Selection criteria

File hashes

A file hash enters the feed when its ReversingLabs classification is Malicious and at least one of the following events occurs:

A public sample is scanned for the first time and a threat is detected by at least one AV scanner.
A public sample is rescanned and a threat is detected during rescan by at least one AV scanner.
A private sample becomes public and a threat is detected during rescan by at least one AV scanner.

Domains, IP addresses, and URLs

A network indicator enters the feed if it meets all of the following criteria:

ReversingLabs classification: Malicious
Detection sources: third-party detections and dynamic analysis, including identified C2 configurations, IP addresses, and domains
IOC age: less than 30 days old
Third-party detection threshold: detected by 2 or more third-party vendors

Querying the feed

Access requires HTTP Basic Authentication with your Spectra Intelligence credentials.

Feed query

Returns a compressed ZIP archive containing one or more JSONL feed files.

GET https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/feed

View OpenAPI Specification

Example request

curl 'https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/feed' \
  -u 'username:password' \
  -o feed.zip

Query parameters

Parameter	Type	Description
`feed-interval`	string	Optional. Specifies the granularity of the feed interval. If omitted, the service automatically returns the smallest set of files needed to stay current, equivalent to the hourly maximum period (3 days). Available values: `hourly` — files generated within the last 3 days; `daily` — files generated within the last 10 days; `dump` — all indicator files up to 90 days.
`since`	string	Optional. A timestamp in the format `YYYY-MM-DDTHH:MM:SS`, for example `2026-07-01T00:00:00`. Timezone suffixes such as `Z` are not accepted and will result in HTTP 400. Specifies the start of the retrieval window. If not provided, the service automatically calculates the starting point based on the `feed-interval` value. When used with `feed-interval=dump`, returns all data from that timestamp onward instead of the full historical dataset. The timestamp must not be more than 90 days in the past.
`include_relations`	string	Optional. When set to `true`, each indicator record in the response includes the `relations` field. Omitted from records by default.

Response

The response is a ZIP archive. When extracted, it contains one or more JSONL files. Each file covers exactly one interval and is named:

indicators_feed_<interval>_<start_timestamp>.jsonl

If the since timestamp does not align to the start of an interval boundary, the first file covers from since to the next complete interval boundary. Subsequent files each cover one full interval.

Continuous feed

The continuous feed mode lets you consume the indicator feed incrementally without specifying a time range on each request. It uses two operations: Start and Pull.

Start

Establishes the initial retrieval point for a continuous feed session. If Start has not been called for the authenticated user, Pull requests automatically begin from 24 hours before the current time.

PUT https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/start/{time_format}/{time_value}

View OpenAPI Specification

time_format — Required. Format of the timestamp. Accepted values: utc, timestamp.
time_value — Required. The starting point in the format specified by time_format.

A successful request returns HTTP 200 with an empty response body.

Pull

Retrieves the next batch of indicator records relative to the position established by the most recent Start call.

GET https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/pull

View OpenAPI Specification

Query parameters

Parameter	Type	Description
`include_relations`	string	Optional. When set to `true`, each indicator record in the response includes the `relations` field. Omitted from records by default.

The response is a ZIP archive containing a single JSONL file. The filename follows a different pattern from the feed query:

indicators_feed_segment_<unix_timestamp>.jsonl

For example: indicators_feed_segment_1783515046.jsonl

Pull can also be used to reprocess a previously consumed time span, retrieve data from an older period that was not previously fetched, or skip ahead to a more recent timestamp when older data is no longer relevant. Reset the retrieval position by calling Start with a new timestamp before the next Pull.

note

Feed records may be retroactively updated or removed. When a record is updated, it overwrites the original entry at its original timestamp rather than appearing as a new entry at the end of the feed. Consumers that need to detect changes to previously ingested records must periodically re-fetch older intervals by resetting the retrieval position using Start.

Examples

Fetch the hourly feed starting from a specific timestamp

GET https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/feed?feed-interval=hourly&since=2026-07-01T00:00:00

Fetch the daily feed starting from a specific date

GET https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/feed?feed-interval=daily&since=2026-05-01T00:00:00

Fetch the full historical feed

GET https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/feed?feed-interval=dump

caution

Dump responses can be several gigabytes in size and may take approximately half an hour or longer to complete depending on network conditions. Ensure your HTTP client is configured with a sufficiently long timeout before making this request.

Set the continuous feed starting point

PUT https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/start/utc/2026-07-01T00:00:00

Pull the next available batch

GET https://data.reversinglabs.com/api/feed/indicator-feed/v1/query/pull

Feed delivery​

Feed record structure​

Top-level fields​

Indicator types​

Malicious confidence values​

Network indicators​

File indicators​

Labels object​

Label categories​

Relations object​

Relationship types​

Selection criteria​

File hashes​

Domains, IP addresses, and URLs​

Querying the feed​

Feed query​

Continuous feed​

Start​

Pull​

Examples​

Feed delivery

Feed record structure

Top-level fields

Indicator types

Malicious confidence values

Network indicators

File indicators

Labels object

Label categories

Relations object

Relationship types

Selection criteria

File hashes

Domains, IP addresses, and URLs

Querying the feed

Feed query

Continuous feed

Start

Pull

Examples