get
https://www.virustotal.com/api/v3/collections/sync/ioc-deltas/
With this endpoint you can download an hourly batch of updated IoCs (files, URLs, domains and IP addresses). It includes indicators strictly associated with curated collections generated by the Google Threat Intelligence team, ensuring high-fidelity alerting and reduced false positives for security operations teams. Each batch is represented by its generation time, formatted as a YYYYMMDDhh string. Time 2019120108 will return the batch corresponding to December 1st, 2019 08 AM UTC. You can download batches up to 7 days old, and the most recent batch has always a 2 hours lag respecting to the current time. This means that if the current time in UTC is T you can download batch T-2h but not any more recent.
The downloaded file is a bzip2 compressed UTF-8 text file contains one JSON structure per line, where the structure represents an IoC object.
Besides the standard attributes usually found in all IoC objects, they includes a relationships object containing nested objects for each relationship type, with each type mapping to an array of associated entities.
The backend system generates minute-based packages of updated IoCs, which a secondary service then aggregates into a larger hourly package. Because of this consolidation, the same IoC may appear multiple times within a single package. The latest last_modification_date attribute of an IoC serves as the definitive source of truth for determining an its current status.
Examples
Check out this example .
Retrieve all updated IP addresses that remain associated with at least one curated collection from 2026051010 feed package.
import requests
time = "2026051010"
ioc_type = "ip"
url = f"https://www.virustotal.com/api/v3/collections/sync/ioc-deltas/{time}?ioc_type={ioc_type}"
headers = {"x-apikey": <api-key>,"x-tool": "<integration-name/version>","accept": "application/json"}
response = requests.get(url, headers=headers)Request and Response Examples
Request Example
GET /collections/sync/ioc-deltas/2026040110 HTTP/1.1
Host: www.virustotal.com
x-apikey: REDACTED
x-tool: REDACTED
Below are examples of the JSON objects found within the decompressed packages for each IoC type. Note that packages contain indicators directly as a sequence of objects.
Decompressed Objects
{
"id": "26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb",
"type": "file",
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb"
},
"attributes": {
"size": 99438,
"creation_date": 1690655399,
"last_submission_date": 1775367075,
"names": [],
"last_modification_date": 1775473254,
"md5": "65b2c6a8db2785236d4bc01224069666",
"last_analysis_date": 1775367075,
"tags": [
"peexe",
"overlay",
"spreader"
],
"sha256": "26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb",
"sha1": "c75b3462ce4f07c2f74f993f56f1238df43f94ac",
"first_submission_date": 1775367075,
"times_submitted": 1,
"gti_assessment": {
"threat_score": {
"value": 30
},
"verdict": {
"value": "VERDICT_MALICIOUS"
},
"severity": {
"value": "SEVERITY_LOW"
},
"contributing_factors": {
"gavs_detections": 3,
"gti_confidence_score": 90,
"normalised_categories": [
"trojan"
],
"google_malware_analysis": true
},
"description": "This indicator is malicious (low severity). It was detected by Google's spam and threat filtering engines, it was matched by Google's curated Yara rules, it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher and it was detected by Mandiant's malware analysis."
}
},
"relationships": {
"contacted_urls": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/contacted_urls?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/contacted_urls"
}
},
"itw_urls": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/itw_urls?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/itw_urls"
}
},
"contacted_ips": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/contacted_ips?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/contacted_ips"
}
},
"embedded_urls": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/embedded_urls?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/embedded_urls"
}
},
"embedded_ips": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/embedded_ips?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/embedded_ips"
}
},
"contacted_domains": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/contacted_domains?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/contacted_domains"
}
},
"embedded_domains": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/relationships/embedded_domains?limit=20",
"related": "https://www.virustotal.com/api/v3/files/26ef0b8484e9dd99501c003fb51ee38085f1632871d192087cedb34ae705b7bb/embedded_domains"
}
},
"malware_families": {
"data": [
{
"type": "collection",
"id": "malware--23c58e47-74e4-5815-8cc1-7091eac309a6"
}
]
}
},
"context_attributes": {
"download_url": "https://www.virustotal.com/api/v3/feeds/files/MjZlZjBiODQ4NGU5ZGQ5OTUwMWMwMDNmYjUxZWUzODA4NWYxNjMyODcxZDE5MjA4N2NlZGIzNGFlNzA1YjdiYnx8djN8fDE3NzU0NzY4NTl8fGYxYmI1ZDI0MzBjNTliMGJhZWYyZWRiYjM5Y2Y3Yzc3ZGQ4ZjUzZTBjMjMxNmJlNjk5NmFjZGY1M2FhOTQ2Yjc/download"
}
}{
"id": "audifastinggip.com",
"type": "domain",
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com"
},
"attributes": {
"last_modification_date": 1775476664,
"tags": [],
"registrar": "TUCOWS, INC.",
"creation_date": 1660320673,
"jarm": "3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e",
"categories": {},
"gti_assessment": {
"contributing_factors": {
"safebrowsing_verdict": "harmless",
"gti_confidence_score": 84,
"google_botnet_emulation": true,
"normalised_categories": [
"malware"
],
"malicious_sandbox_verdict": false,
"pervasive_indicator": true,
"mandiant_association_malware": true,
"mandiant_confidence_score": 50,
"associated_malware_configuration": true,
"google_malware_analysis": true
},
"severity": {
"value": "SEVERITY_MEDIUM"
},
"verdict": {
"value": "VERDICT_MALICIOUS"
},
"threat_score": {
"value": 60
},
"description": "This indicator is malicious (medium severity). It was detected by Google's malware analysis, it was detected by Google's botnet analysis, it is considered widespread, Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant malware family, it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher, malware configuration extraction identified this IP associated with a well-known malware family, it was detected by Mandiant's malware analysis, malware configuration extraction established its association with a well-known malware family, it was detected by Google TI URL scanning and it was detected as a Mandiant malware family that downloads and potentially executes a payload."
}
},
"relationships": {
"malware_families": {
"data": [
{
"type": "collection",
"id": "malware--120b2981-504f-5c8a-bfae-467ef1d56d52"
},
{
"type": "collection",
"id": "malware--5a482a36-511c-5031-8ee3-8f8bc4e76a25"
}
]
},
"referrer_files": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/referrer_files?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/referrer_files"
}
},
"downloaded_files": {
"data": [
{
"type": "file",
"id": "3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f"
},
{
"type": "file",
"id": "340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87"
},
{
"type": "file",
"id": "cab538fd1647961eb35348c1bd84e1fde389ad89672587d2fe3c007a0bc9e67f"
},
{
"type": "file",
"id": "1d08335e65da7cf40d1c4a7ba0088e0f39b9c5a4b2e42de95fc9ffa69fb96c7a"
}
],
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/downloaded_files?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/downloaded_files"
}
},
"resolutions": {
"data": [
{
"type": "resolution",
"id": "91.195.240.117audifastinggip.com"
},
{
"type": "resolution",
"id": "143.198.178.0audifastinggip.com"
}
],
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/resolutions?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/resolutions"
}
},
"urls": {
"data": [
{
"type": "url",
"id": "c54198dee100ad8c8bf24cde2f993eca0297c36335f0836853f3866dfc132d02",
"context_attributes": {
"url": "https://audifastinggip.com/"
}
},
{
"type": "url",
"id": "bf7ae82e39f1ce2b2d4a6d8e150ef8b809bb01f6e4aca6d6ad1e0969acde2e73",
"context_attributes": {
"url": "http://audifastinggip.com/"
}
},
{
"type": "url",
"id": "96f3108bfc3a5a8181d76f8b26d46982645f114513aec15d66e3f04b25c70e91",
"context_attributes": {
"url": "https://audifastinggip.com/.comQ/"
}
},
{
"type": "url",
"id": "4f2f227717e2feed67c0fc976c8633b8d98bc87954da5ecaf4a51a664f4eaf83",
"context_attributes": {
"url": "http://audifastinggip.com/T6K"
}
},
{
"type": "url",
"id": "59b918d53ac835b4b84abcd99b01676efa022d4675dfa5ea150f5fcb89de9bfd",
"context_attributes": {
"url": "http://audifastinggip.com/sF"
}
},
{
"type": "url",
"id": "a5c30e33535a7449f54fe1e8b7c897021a29913a21645d25d8681c9df52c4172",
"context_attributes": {
"url": "http://audifastinggip.com/somL"
}
},
{
"type": "url",
"id": "7453cab58fe73e31edc2aa23ada7a0aae942f932d598dd45b32716efa071d9eb",
"context_attributes": {
"url": "http://audifastinggip.com/.com$"
}
},
{
"type": "url",
"id": "b0abaa75cb1f86eeda819a38b5495462d9c7adafa63164fc6352c77b5e3d97f0",
"context_attributes": {
"url": "http://audifastinggip.com/som5"
}
},
{
"type": "url",
"id": "11b8deaa862fe06e7cf7406e275fb1b45e21546f4c993d5599c6a38b9846edaf",
"context_attributes": {
"url": "http://audifastinggip.com/M"
}
},
{
"type": "url",
"id": "1013cf650373479953cadf2670c5c985303a62949ccc386f9567ba80dc52a42e",
"context_attributes": {
"url": "http://audifastinggip.com/omW"
}
},
{
"type": "url",
"id": "8d74cdbd7c23572dea58627b1000bfe8118ad30a04ea81aa67e6f2805ffdc187",
"context_attributes": {
"url": "http://audifastinggip.com/abled"
}
},
{
"type": "url",
"id": "a5e6cc743f241ddc6b1588eae86cc2e97d8140ebdc8cbe0f30acb65cad2ac0af",
"context_attributes": {
"url": "http://audifastinggip.com/bled"
}
},
{
"type": "url",
"id": "84e7fa64d21c419f9dac78771157b049977c3daac9723da3797b4369a84696c7",
"context_attributes": {
"url": "http://audifastinggip.com/.comO"
}
},
{
"type": "url",
"id": "5cddcc00d48d9467cb474eac88738133124a08dd05945229d43eaf2275d22b36",
"context_attributes": {
"url": "http://audifastinggip.com/com"
}
},
{
"type": "url",
"id": "a5b7692671c9aecc86dc802858f9ddf71fdd1b4d9394e6f5969d19c1875141ef",
"context_attributes": {
"url": "http://audifastinggip.com/ameW"
}
},
{
"type": "url",
"id": "8e9b1c244d84d9600f1e245e5d7ecc607aabcd8aea929b8b4c8b021a4d858659",
"context_attributes": {
"url": "http://audifastinggip.com/.comX"
}
},
{
"type": "url",
"id": "fee66f92769edc782802bd0d04b740670a698c023524fdf332c9165859f7fe1c",
"context_attributes": {
"url": "http://audifastinggip.com/om5"
}
},
{
"type": "url",
"id": "1293b834751d7b1824fc601e4b2cd346436f6e64f2a75f3a89593108e56e059c",
"context_attributes": {
"url": "http://audifastinggip.com/rNamei"
}
},
{
"type": "url",
"id": "fccbf10c38b8b7e0b37f277b793354b36559b463537bc8e686e9d024aebd5547",
"context_attributes": {
"url": "http://audifastinggip.com/.comL"
}
},
{
"type": "url",
"id": "cc2b243a2c7855af56c14dec74e299b33b4e231b43cc89bceaea2d6daf713574",
"context_attributes": {
"url": "http://audifastinggip.com/ame"
}
}
],
"meta": {
"cursor": "MjB8fHYzfHwxNzc1NDc2ODIzfHw1MTYyOTk4ZDUwOGJkZjUyZjVmNTZlZDllZDI5MTRlY2Q3ODY3ODk2YmQ4NTdiZGZkNDgxYTMyYTc2NjU4MjZi"
},
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/urls?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/urls",
"next": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/urls?limit=20&cursor=MjB8fHYzfHwxNzc1NDc2ODIzfHw1MTYyOTk4ZDUwOGJkZjUyZjVmNTZlZDllZDI5MTRlY2Q3ODY3ODk2YmQ4NTdiZGZkNDgxYTMyYTc2NjU4MjZi"
}
},
"siblings": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/siblings?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/siblings"
}
},
"subdomains": {
"data": [
{
"type": "domain",
"id": "audifastinggip.com",
"context_attributes": {
"timestamp": 1662738557
}
}
],
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/subdomains?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/subdomains"
}
},
"communicating_files": {
"data": [
{
"type": "file",
"id": "2765df6910a018bfbec81355187f22f485f120a6507dd7342e5ee4a8ba3d2b02"
},
{
"type": "file",
"id": "31375a49026071a9248e8e10891722ff54ba45ee7eebf79e8b39f78100969cab"
},
{
"type": "file",
"id": "3665527675531f6927a99c51f7480f6a42fd00b7f4697566238f210c29878ac2"
},
{
"type": "file",
"id": "38cf7afa89dfeeaa5e6560286a35c2112dcee0723c0151881816829e51167a8f"
},
{
"type": "file",
"id": "3e8b5d4ac62a25e6c08b99954ee66559a8b758a4a05d5cd8a2a1151bbd80016a"
},
{
"type": "file",
"id": "577a2bd2021e0c514202ef7d8001687c6ac5d69da8c886919ca3ba0ec1c2339a"
},
{
"type": "file",
"id": "72fb439f28ae4f633f945e21818f73c99728bd3d5dd67a338ac48101ea7163b4"
},
{
"type": "file",
"id": "8b01aa62a3b8ee347dfd39eaed1a8828280569105b703dd3f5b1f133bbea954b"
},
{
"type": "file",
"id": "928559d1ef31f314d6d4dcb9b37bb8f34c99779eecc0d0a8b3dc8c26a60f350f"
},
{
"type": "file",
"id": "9d245f9c6bd147d75d84467ca798ed02db0e54b7cc7c5919cf524668e08c7cd7"
},
{
"type": "file",
"id": "9d650e68b9c2df1d0f520a38dbefaa849d6593db1778cc3bae0e40eaf4ab3092"
},
{
"type": "file",
"id": "9ed97aa023edc94438d5076b3011003ae142849d78948422680de1264bd7ecae"
},
{
"type": "file",
"id": "a8e2cd24ff12d6069bc031694e5c77d3c0fced6467c9c8153c0b740556749e1c"
},
{
"type": "file",
"id": "b3928c5ef05dcbcce5b27dc6a377a9710ed4b1a5f0fe2a10d46e0ee40cd43b30"
},
{
"type": "file",
"id": "bf061b520fca2119e2a2f65d965c85c0c724a7e0fc15766034b7e14f213f4045"
},
{
"type": "file",
"id": "c051849a17cfad52e11d6d41643505ca330dfb2332ea4321418bdafdf793f6bf"
},
{
"type": "file",
"id": "c8c057d9c29eeddd1cca382bcc7cf1c586251c66d2088e0240a65bec68191b2b"
},
{
"type": "file",
"id": "d26183ea6b180c32197edcf7b695da1a6749d9183798d01aecdd53667b98d368"
},
{
"type": "file",
"id": "de2504aaa35056eae6fe4eccb2fb0645aae6f60ad7994195f7f18b33812b6cec"
},
{
"type": "file",
"id": "f4b2e30e0d6d2c9af0879470f45e88e9465c013648d228154a52633064c7ea8e"
}
],
"meta": {
"cursor": "eyJsaW1pdCI6IDIwLCAib2Zmc2V0IjogMjB9"
},
"links": {
"self": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/communicating_files?limit=20",
"related": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/communicating_files",
"next": "https://www.virustotal.com/api/v3/domains/audifastinggip.com/relationships/communicating_files?limit=20&cursor=eyJsaW1pdCI6IDIwLCAib2Zmc2V0IjogMjB9"
}
}
}
}{
"id": "147.135.242.186",
"type": "ip_address",
"links": {
"self": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186"
},
"attributes": {
"regional_internet_registry": "RIPE NCC",
"tags": [],
"continent": "EU",
"last_modification_date": 1775476819,
"country": "FR",
"asn": 16276,
"as_owner": "OVH SAS",
"gti_assessment": {
"contributing_factors": {
"mandiant_confidence_score": 50,
"mandiant_analyst_observed_recent": true,
"mandiant_association_malware": true,
"malicious_sandbox_verdict": true,
"gti_confidence_score": 79,
"high_severity_related_files": true,
"safebrowsing_verdict": "harmless",
"google_malware_analysis": true
},
"threat_score": {
"value": 29
},
"severity": {
"value": "SEVERITY_HIGH"
},
"verdict": {
"value": "VERDICT_SUSPICIOUS"
},
"description": "This indicator is suspicious (high severity) with high impact. Google TI's ML scoring model identified this indicator as suspicious. Analysts should prioritize investigation."
}
},
"relationships": {
"resolutions": {
"data": [
{
"type": "resolution",
"id": "147.135.242.186ip186.ip-147-135-242.eu"
},
{
"type": "resolution",
"id": "147.135.242.186virizionpvp.eu"
}
],
"links": {
"self": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/relationships/resolutions?limit=20",
"related": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/resolutions"
}
},
"urls": {
"data": [
{
"type": "url",
"id": "4fd228e28501428a1c097706991ae467cd0d378d60f18c5d44d32ce2f228dfb9",
"context_attributes": {
"url": "http://147.135.242.186:443/"
}
},
{
"type": "url",
"id": "4c2220ae8ad67cc6852ffe744a92ece21534b86450dbc61d5aabcd9d8179872a",
"context_attributes": {
"url": "http://147.135.242.186/"
}
},
{
"type": "url",
"id": "65e429cbb65ce5b1f3e75d0291836714e464e1e191913d86847120e6b1400752",
"context_attributes": {
"url": "tcp://147.135.242.186:443/"
}
}
],
"links": {
"self": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/relationships/urls?limit=20",
"related": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/urls"
}
},
"communicating_files": {
"data": [
{
"type": "file",
"id": "00313d889ba30ab94195a4dfc2cd20233bfb4d49a4439a2d9a7701df93824a14"
}
],
"links": {
"self": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/relationships/communicating_files?limit=20",
"related": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/communicating_files"
}
},
"referrer_files": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/relationships/referrer_files?limit=20",
"related": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/referrer_files"
}
},
"downloaded_files": {
"data": [],
"links": {
"self": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/relationships/downloaded_files?limit=20",
"related": "https://www.virustotal.com/api/v3/ip_addresses/147.135.242.186/downloaded_files"
}
},
"malware_families": {
"data": [
{
"type": "collection",
"id": "malware--45fea136-53e0-56a9-835e-70a2c5c9abe0"
}
]
}
}
}{
"id": "7d1272f343d393510faf5c55b1c310e7b3816eef9b724675d201316f46f1637a",
"type": "url",
"links": {
"self": "https://www.virustotal.com/api/v3/urls/7d1272f343d393510faf5c55b1c310e7b3816eef9b724675d201316f46f1637a"
},
"attributes": {
"last_analysis_date": 1775455360,
"times_submitted": 12,
"last_submission_date": 1775455360,
"first_submission_date": 1769236912,
"last_final_url": "tcp://www.xoilacxyl.cc:25/",
"url": "tcp://www.xoilacxyl.cc:25/",
"tags": [],
"categories": {
"Sophos": "phishing and fraud",
"Webroot": "Phishing and Other Frauds"
},
"last_modification_date": 1775473203,
"gti_assessment": {
"severity": {
"value": "SEVERITY_MEDIUM"
},
"contributing_factors": {
"safebrowsing_verdict": "harmless",
"gti_confidence_score": 99,
"mandiant_confidence_score": 50,
"normalised_categories": [
"malware",
"phishing",
"phishing and fraud",
"Phishing and Other Frauds"
],
"mandiant_association_malware": true,
"google_malware_analysis": true
},
"verdict": {
"value": "VERDICT_MALICIOUS"
},
"threat_score": {
"value": 60
},
"description": "This indicator is malicious (medium severity). It was detected by Google's malware analysis, Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant malware family, it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher, its root domain was detected by Google Safe Browsing, it was detected by Mandiant's malware analysis and it was detected as a Mandiant malware family that allows an attacker to interactively issue commands."
}
},
"relationships": {
"last_serving_ip_address": {
"links": {
"self": "https://www.virustotal.com/api/v3/urls/7d1272f343d393510faf5c55b1c310e7b3816eef9b724675d201316f46f1637a/relationships/last_serving_ip_address",
"related": "https://www.virustotal.com/api/v3/urls/7d1272f343d393510faf5c55b1c310e7b3816eef9b724675d201316f46f1637a/last_serving_ip_address"
},
"meta": {
"count": 1
},
"data": {
"type": "ip_address",
"id": "172.67.138.202"
}
},
"malware_families": {
"data": [
{
"type": "collection",
"id": "malware--e6810cc5-2759-52cc-bf57-9b2ffc381760"
}
]
}
}
}