Feed Endpoints

Feed endpoints provide threat intelligence in formats optimized for consumption by firewalls, DNS resolvers, and Panguard agents. Blocklist feeds return plain text; structured feeds return JSON.

GET /api/feeds/ip-blocklist

Returns a plain-text list of malicious IP addresses, one per line. Designed for direct ingestion by firewalls (iptables, pf, Windows Firewall) and network appliances.

number

default:"30"

Maximum reputation score to include (0 = most malicious). Lower values produce a more conservative list.

string

Filter by threat category: malware, botnet, bruteforce, scanner, c2.

curl -X GET "https://tc.panguard.ai/api/feeds/ip-blocklist?minReputation=20" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl -s "https://tc.panguard.ai/api/feeds/ip-blocklist" \
  -H "Authorization: Bearer YOUR_API_KEY" | \
  while read ip; do
    iptables -A INPUT -s "$ip" -j DROP
  done

Response

# Panguard AI IP Blocklist
# Generated: 2026-03-07T12:00:00Z
# Total: 1423 IPs
198.51.100.42
198.51.100.78
203.0.113.15
203.0.113.99
192.0.2.50
...

The response content type is text/plain. Lines starting with # are comments containing metadata. The list is sorted by reputation score (most malicious first).

GET /api/feeds/domain-blocklist

Returns a plain-text list of malicious domains, one per line. Suitable for DNS sinkhole configurations (Pi-hole, dnsmasq, Unbound).

number

default:"30"

Maximum reputation score to include.

string

Filter by threat category: malware, phishing, c2, exploit.

curl -X GET "https://tc.panguard.ai/api/feeds/domain-blocklist" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl -s "https://tc.panguard.ai/api/feeds/domain-blocklist" \
  -H "Authorization: Bearer YOUR_API_KEY" | \
  sed 's/^/0.0.0.0 /' > /etc/pihole/panguard-blocklist.txt

Response

# Panguard AI Domain Blocklist
# Generated: 2026-03-07T12:00:00Z
# Total: 892 domains
malware-c2.example.net
phishing-bank.example.org
dropper.example.com
evil-redirect.example.io
...

GET /api/feeds/iocs

Returns the full IoC feed in structured JSON format with metadata, suitable for SIEM integrations and automated processing.

string

ISO 8601 timestamp. Returns only IoCs updated after this time (for incremental sync).

string

Filter by IoC type: ip, domain, hash, url.

number

default:"1000"

Maximum number of IoCs to return (max 5000).

curl -X GET "https://tc.panguard.ai/api/feeds/iocs?since=2026-03-06T00:00:00Z&type=ip" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "ok": true,
  "data": {
    "generatedAt": "2026-03-07T12:00:00.000Z",
    "count": 156,
    "iocs": [
      {
        "value": "198.51.100.42",
        "type": "ip",
        "reputation": 12,
        "category": "bruteforce",
        "sightings": 47,
        "firstSeen": "2026-02-15T10:00:00.000Z",
        "lastSeen": "2026-03-07T08:15:00.000Z",
        "metadata": {
          "asn": "AS64496",
          "country": "CN",
          "mitreIds": ["T1110"]
        }
      }
    ]
  }
}

GET /api/feeds/agent-update

Returns a bundled update package for Panguard Guard agents containing the latest detection rules and IoC data. This endpoint is called automatically by agents during their update cycle.

string

The agent’s current rule version. Only returns changes since this version.

string

The requesting agent’s ID for access control.

curl -X GET "https://tc.panguard.ai/api/feeds/agent-update?currentVersion=v20260306" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "ok": true,
  "data": {
    "version": "v20260307",
    "rules": {
      "atr": {
        "added": 12,
        "updated": 3,
        "removed": 1,
        "files": [
          {
            "id": "ATR-2025-0125",
            "name": "Detect Cryptominer via Agent Action",
            "content": "..."
          }
        ]
      }
    },
    "iocs": {
      "ipBlocklist": ["198.51.100.42", "203.0.113.99"],
      "domainBlocklist": ["malware-c2.example.net"],
      "hashBlocklist": ["e3b0c44298fc1c149afbf4c8996fb924"]
    },
    "config": {
      "heartbeatInterval": 60,
      "logLevel": "info"
    }
  }
}

The agent-update endpoint uses delta updates when a currentVersion is provided. This minimizes bandwidth by only sending new or modified rules since the agent’s last update.

API Reference

Threat Cloud API

GET /api/feeds/ip-blocklist

Response

GET /api/feeds/domain-blocklist

Response

GET /api/feeds/iocs

GET /api/feeds/agent-update

​GET /api/feeds/ip-blocklist

​Response

​GET /api/feeds/domain-blocklist

​Response

​GET /api/feeds/iocs

​GET /api/feeds/agent-update

GET /api/feeds/ip-blocklist

Response

GET /api/feeds/domain-blocklist

Response

GET /api/feeds/iocs

GET /api/feeds/agent-update