Get AS rankings by botnet threat feed activity

client.radar.entities.asns.botnetThreatFeed(?, ?): ASNBotnetThreatFeedResponse { ases, meta }

GET/radar/entities/asns/botnet_threat_feed

Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

User Details WriteUser Details Read

ParametersExpand Collapse

query: ASNBotnetThreatFeedParams { asn, compareDateRange, date, 6 more }

asn?: Array<string>

Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with - to exclude ASNs from results. For example, -174, 3356 excludes results from AS174, but includes results from AS3356.

compareDateRange?: string

Relative date range for rank change comparison (e.g., “1d”, “7d”, “30d”).

date?: string

The date to retrieve (YYYY-MM-DD format). If not specified, returns the most recent available data. Note: This is the date the report was generated. The report is generated from information collected from the previous day (e.g., the 2026-02-23 entry contains data from 2026-02-22).

formatdate

format?: "JSON" | "CSV"

Format in which results will be returned.

One of the following:

"JSON"

"CSV"

limit?: number

Limits the number of objects returned in the response.

exclusiveMinimum

minimum0

location?: string

Filters results by location. Specify an alpha-2 location code.

maxLength2

minLength2

metric?: "OFFENSE_COUNT" | "NUMBER_OF_OFFENDING_IPS"

Metric to rank ASNs by.

One of the following:

"OFFENSE_COUNT"

"NUMBER_OF_OFFENDING_IPS"

offset?: number

Skips the specified number of objects before fetching the results.

minimum0

sortOrder?: "ASC" | "DESC"

Sort order.

One of the following:

"ASC"

"DESC"

ReturnsExpand Collapse

ASNBotnetThreatFeedResponse { ases, meta }

ases: Array<Ase>

asn: number

country: string

name: string

rank: number

rankChange?: number

meta: Meta { date, total, compareDate }

date: string

total: number

compareDate?: string

Get AS rankings by botnet threat feed activity

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.radar.entities.asns.botnetThreatFeed();

console.log(response.ases);

{
  "result": {
    "ases": [
      {
        "asn": 4134,
        "country": "CN",
        "name": "CHINANET-BACKBONE",
        "rank": 1,
        "rankChange": -2
      }
    ],
    "meta": {
      "date": "2026-02-04",
      "total": 50,
      "compareDate": "2026-01-28"
    }
  },
  "success": true
}

Returns Examples

{
  "result": {
    "ases": [
      {
        "asn": 4134,
        "country": "CN",
        "name": "CHINANET-BACKBONE",
        "rank": 1,
        "rankChange": -2
      }
    ],
    "meta": {
      "date": "2026-02-04",
      "total": 50,
      "compareDate": "2026-01-28"
    }
  },
  "success": true
}