Get AS rankings by botnet threat feed activity

GET/radar/entities/asns/botnet_threat_feed

Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

User Details WriteUser Details Read

Query ParametersExpand Collapse

asn: optional array of string

Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with - to exclude ASNs from results. For example, -174, 3356 excludes results from AS174, but includes results from AS3356.

compareDateRange: optional string

Relative date range for rank change comparison (e.g., “1d”, “7d”, “30d”).

date: optional string

The date to retrieve (YYYY-MM-DD format). If not specified, returns the most recent available data. Note: This is the date the report was generated. The report is generated from information collected from the previous day (e.g., the 2026-02-23 entry contains data from 2026-02-22).

formatdate

format: optional "JSON" or "CSV"

Format in which results will be returned.

One of the following:

"JSON"

"CSV"

limit: optional number

Limits the number of objects returned in the response.

exclusiveMinimum

minimum0

location: optional string

Filters results by location. Specify an alpha-2 location code.

maxLength2

minLength2

metric: optional "OFFENSE_COUNT" or "NUMBER_OF_OFFENDING_IPS"

Metric to rank ASNs by.

One of the following:

"OFFENSE_COUNT"

"NUMBER_OF_OFFENDING_IPS"

offset: optional number

Skips the specified number of objects before fetching the results.

minimum0

sortOrder: optional "ASC" or "DESC"

Sort order.

One of the following:

"ASC"

"DESC"

ReturnsExpand Collapse

result: { ases, meta }

ases: array of { asn, country, name, 2 more }

asn: number

country: string

name: string

rank: number

rankChange: optional number

meta: { date, total, compareDate }

date: string

total: number

compareDate: optional string

success: boolean

Get AS rankings by botnet threat feed activity

curl https://api.cloudflare.com/client/v4/radar/entities/asns/botnet_threat_feed \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

{
  "result": {
    "ases": [
      {
        "asn": 4134,
        "country": "CN",
        "name": "CHINANET-BACKBONE",
        "rank": 1,
        "rankChange": -2
      }
    ],
    "meta": {
      "date": "2026-02-04",
      "total": 50,
      "compareDate": "2026-01-28"
    }
  },
  "success": true
}

Returns Examples

{
  "result": {
    "ases": [
      {
        "asn": 4134,
        "country": "CN",
        "name": "CHINANET-BACKBONE",
        "rank": 1,
        "rankChange": -2
      }
    ],
    "meta": {
      "date": "2026-02-04",
      "total": 50,
      "compareDate": "2026-01-28"
    }
  },
  "success": true
}