List Callback IPs
list-callback-ipsRead-only
Retrieve a paginated list of callback and C2 IPs filtered by attack stage, file attributes, date ranges, and scanner IPs.
Instructions
Paginated list of callback/C2 IPs filtered by attack stage, first/last seen date ranges, file attributes, and scanner associations. Dates are YYYY-MM-DD.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | No | Filter to this specific set of callback IPs | |
| page | No | Zero-indexed page number (default 0) | |
| file_hash | No | File SHA256 hash | |
| file_name | No | File name substring match | |
| file_type | No | File MIME type (e.g. "application/x-executable") | |
| has_files | No | true = only IPs with malware files; false = only IPs without files | |
| page_size | No | Results per page, 1-100 (default 20) | |
| is_stage_1 | No | true = file was downloaded from this IP (stage 1) | |
| is_stage_2 | No | true = suspected C2 based on VT/sandbox analysis (stage 2) | |
| scanner_ips | No | Filter to IPs associated with these scanner IPs | |
| last_seen_after | No | Only IPs last seen after this date (YYYY-MM-DD) | |
| first_seen_after | No | Only IPs first seen after this date (YYYY-MM-DD) | |
| last_seen_before | No | Only IPs last seen before this date (YYYY-MM-DD) | |
| first_seen_before | No | Only IPs first seen before this date (YYYY-MM-DD) |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| items | No | ||
| total | No | ||
| page_size | No |