We’ve rolled out two major updates to help teams enrich threat detection and improve adversary tracking: the IOC Hunter Feed and threat actor attribution are now embedded in our C2 Feed.
IOC Hunter Feed
This new feed aggregates indicators of compromise (IOCs) from public threat research and enriches them with the context that matters.
Each IOC includes:
Publication metadata: source, title, date, and URL
Threat actor attribution: names, aliases, descriptions, country of origin
Associated indicators: IPs, hostnames, file hashes, and more
The feed gives analysts a reliable stream of contextualized IOCs-ready for enrichment, pivoting, or prioritization.
Attribution in the C2 Feed
The C2 Feed now includes optional metadata linking infrastructure to known threat actors and malware campaigns.
Attribution is based on matches from the IOC Hunter dataset and includes:
Actor names and aliases
Historical context and associated campaigns
Origin country and activity profile
This upgrade builds on our real-time scanning of C2 infrastructure and improves signal fidelity for defenders tracking active threats.
Accessing the Feeds
Both feeds are available now via the Hunt.io API in compressed JSON format.
To retrieve the IOC Hunter Feed:
curl -o ioc-hunter.json.gz 'https://api.hunt.io/v1/feeds/ioc-hunter' -H 'token: <API_TOKEN_GOES_HERE>'
To retrieve the C2 Feed with Attribution:
curl -o c2.json.gz 'https://api.hunt.io/v1/feeds/c2' -H 'token: <API_TOKEN_GOES_HERE>'
Key Fields
Entries in both feeds include:
IP, hostname, and port
Malware name and subsystem
Timestamp and confidence score
Threat actor metadata (if applicable)
This added context helps analysts move from indicator to actor faster and more accurately.
Why It Matters
Threat detection is just one part of the job. Knowing who’s behind an attack-and what else they’ve been involved in-helps teams prioritize, attribute, and respond more effectively.
These features are now available to all Hunt.io users. If you’re new to our platform, book a demo and we’ll walk you through how it works.
Hunt 2.0 introduces a more powerful platform for threat analysis, improved data access, and a modernized interface designed to enhance security operations. This update includes a refined UI, advanced IP visualization, expanded HuntSQL™ and API features, and new integrations with Cyware and OpenCTI.
Improved Web Interface
The updated web interface offers a more intuitive design, optimizing navigation and data analysis for a seamless user experience.
Redesigned dashboard – Faster, more intuitive, and now supports collapsible navigation.
Enhanced search functionality – Expanded support for domains and IP associations.
Threat Actors Feature – Interactive IOC filtering from public research, validated by analysts.
IP Visual History – New tool to track IP relationships over time.
HuntSQL™ Enhancements
New URLx table for extended dataset queries.
Export options: CSV, JSON for offline analysis.
Updated documentation and sample queries.
AttackCapture™ Updates
New preview functionality – View any file type before downloading.
Expanded data collection – More sandboxed files for deeper analysis.
API Upgrades
The latest API enhancements provide deeper data access, streamline integrations with external tools, and include detailed documentation to simplify implementation.
AttackCapture™ API – Retrieve Open Directory data, listings, and statistics.
SQL API – Execute SQL queries remotely and fetch large datasets.
C2 & IP Enrichment APIs – Fetch active C2 servers, enrich IPs with detailed metadata, and download feeds in compressed JSON format.
Data Improvements
Hunt 2.0 improves data collection and processing, delivering more precise and actionable threat intelligence.
Key enhancements include:
Manual submission of Open Directories for AttackCapture™.
Enhanced SSL parsing for detecting malware-related certificates.
New C2 and malware pages with real-time filtering, news, and IOC insights.
New Integrations
New integrations with top cyber intelligence platforms ensure smoother workflows and enhanced operational efficiency.
Key integrations include:
Cyware Integration – Automatic ingestion of Hunt’s C2 feed for real-time threat detection.
OpenCTI Connector – Import Hunt’s C2 intelligence into OpenCTI via STIX format, with plans to expand feed support.
Experience Hunt 2.0 today and take your threat hunting to the next level.
Hunt is announcing the release of Hunt SQL for threat hunting and analysis. This is a new feature that allows researchers, analysts and threat hunters to query the extensive Hunt database using the power and flexibility of SQL.
This initial release of Hunt SQL will contain:
HTTP - Users can query first party HTTP data to identify threat actors and malicious activity.
Malware - Users can query the Hunt database of confirmed C2 servers and build detailed statistics on threat actor activity.
Certificates - Users can query first party certificate data, allowing users to track and identify malicious certificates.
HoneyPot - Users can query honeypot data and obtain detailed stats on internet scanning activity.
Open Directories - Users can query the Hunt database of past and present open directories. This helps discover malware, exploits and attack tooling.
Phishing - Query an extensive list of phishing sites to identify and track phishing kits and threat actor tooling.
Access to Hunt SQL can be obtained by signing up for a free demo.
Today Hunt is announcing our IP Enrichment API. You can get detailed data on every IPv4 Address and enrich any existing system.
Unlock the true potential of your IP addresses with our groundbreaking IP Enrichment API.
Steps to using the API:
Reach out to our team to get access for commercial (paid), demo or research purposes.
Create an API key.
Look at the IP Enrichment Guide.
Prototype with the IP Enrichment Reference.
Check it out and schedule a demo today.
Today, to kick off our 1 year anniversary, we're launching an update and rethink to our Open Directory feature. It's been an amazing year with over 50,000,000 files processed from bad actors.
Full Code Search across attacker code
MITRE ATT&CK codes baked in everywhere
Editorial observations
Automatic extraction of attacker credentials and keys
Download files as a password protect zip
Open Directories for Attributed IOCs
Attack files by scan signature
Attack files by File Signature
More Files Sandboxed - automatically
Check it out and schedule a demo today.
January
enhancement
enhancement
enhancement
New signatures
enhancement
December
enhancement
New signatures
enhancement
November
enhancement
new feature
New signatures
enhancement
October
new feature
enhancement
enhancement
new feature
new feature
September
new feature
new feature
new feature
new feature
New signatures
New signatures
new feature
new feature
enhancement
August
BUG FIX
enhancement
enhancement
enhancement
BUG FIX
BUG FIX
New signatures
BUG FIX
new feature
new feature
enhancement
enhancement
enhancement
July
enhancement
enhancement
enhancement
new feature
BUG FIX
June
improved detections
new detections
BUG FIX
New signatures
enhancement
May
new feature
enhancement
New signatures
April
new feature
New signatures
March
enhancement
New signatures
February
enhancement
New signatures
January
new feature
New signatures
December
enhancement
new feature
New signatures
November
New signatures
October
new feature
new feature
New signatures
