Skip to content
Cloudflare API
Start here
API Reference
Radar
Entities
ASNs

Get AS rankings by botnet threat feed activity

radar.entities.asns.botnet_threat_feed(ASNBotnetThreatFeedParams**kwargs) -> ASNBotnetThreatFeedResponse
GET/radar/entities/asns/botnet_threat_feed

Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
User Details WriteUser Details Read
ParametersExpand Collapse
asn: Optional[SequenceNotStr[str]]

Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with - to exclude ASNs from results. For example, -174, 3356 excludes results from AS174, but includes results from AS3356.

compare_date_range: Optional[str]

Relative date range for rank change comparison (e.g., “1d”, “7d”, “30d”).

date: Optional[Union[null, null]]

The date to retrieve (YYYY-MM-DD format). If not specified, returns the most recent available data. Note: This is the date the report was generated. The report is generated from information collected from the previous day (e.g., the 2026-02-23 entry contains data from 2026-02-22).

formatdate
format: Optional[Literal["JSON", "CSV"]]

Format in which results will be returned.

One of the following:
"JSON"
"CSV"
limit: Optional[int]

Limits the number of objects returned in the response.

exclusiveMinimum
minimum0
location: Optional[str]

Filters results by location. Specify an alpha-2 location code.

maxLength2
minLength2
metric: Optional[Literal["OFFENSE_COUNT", "NUMBER_OF_OFFENDING_IPS"]]

Metric to rank ASNs by.

One of the following:
"OFFENSE_COUNT"
"NUMBER_OF_OFFENDING_IPS"
offset: Optional[int]

Skips the specified number of objects before fetching the results.

minimum0
sort_order: Optional[Literal["ASC", "DESC"]]

Sort order.

One of the following:
"ASC"
"DESC"
ReturnsExpand Collapse
class ASNBotnetThreatFeedResponse: …
ases: List[Ase]
asn: int
country: str
name: str
rank: int
rank_change: Optional[int]
meta: Meta
date: str
total: int
compare_date: Optional[str]

Get AS rankings by botnet threat feed activity

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
response = client.radar.entities.asns.botnet_threat_feed()
print(response.ases)
{
  "result": {
    "ases": [
      {
        "asn": 4134,
        "country": "CN",
        "name": "CHINANET-BACKBONE",
        "rank": 1,
        "rankChange": -2
      }
    ],
    "meta": {
      "date": "2026-02-04",
      "total": 50,
      "compareDate": "2026-01-28"
    }
  },
  "success": true
}
Returns Examples
{
  "result": {
    "ases": [
      {
        "asn": 4134,
        "country": "CN",
        "name": "CHINANET-BACKBONE",
        "rank": 1,
        "rankChange": -2
      }
    ],
    "meta": {
      "date": "2026-02-04",
      "total": 50,
      "compareDate": "2026-01-28"
    }
  },
  "success": true
}