Download IoCs batch from a given collection

get

https://www.virustotal.com/api/v3/collections/{id}/{ioc_type}/download/batch

Use this endpoint to export IoCs associated with a specific collection. Optimized specifically for TIP integrators, this endpoint allows you to fetch up to 10,000 indicators per page, enabling the retrieval of large JSON-formatted IoC batches with minimal request overhead.

Allowed filters by object `ioc_type`

The bulk export endpoint will support filtering capabilities via filter_query query parameter, as detailed below.

Filter Parameter	Description	Supported Types
creation_date	IoC creation date	file, domain
size (file_size)	File size	file
fs (first_submission)	First submission date	file, url
gti_severity	Google TI calculated severity	file, url, domain, ip
gti_score	Google TI calculated score	file, url, domain, ip
gti_verdict	Google TI calculated verdict	file, url, domain, ip
la (last_analysis)	Last analysis date	file, url
lm (last_modified)	Last modification date	file, url, domain, ip
ls (last_submission)	Last submission date	file, url
p (positives)	AV vendors detections	file, url, domain, ip
submissions (times_submitted)	Times the file was submitted to the platform	file

Allowed `attributes`

The bulk export endpoint currently supports fetching only selected attributes from the following table:

Attribute	Supported Types
as_owner	ip
asn	ip
categories	url, domain
continent	ip
country	ip
creation_date	file, domain
first_submission_date	file, url
gti_assessment	file, url, domain, ip
jarm	domain, ip
last_analysis_date	file, url
last_final_url	url
last_http_response_code	url
last_modification_date	file, url, domain, ip
last_submission_date	file, url
md5	file
names	file
positives	file, url, domain, ip
regional_internet_registry	ip
registrar	domain
sha1	file
sha256	file, url
size	file
tags	file, url, domain, ip
times_submitted	file, url
title	url
url	url

Examples

Check out this example.

Retrieve all files associated to the threat actor UNC6780 that have been detected as malicious by more than 7 AV engines.

import requests
import urllib

id = "threat-actor--7ea07b08-ade2-5a54-b7a9-74d90ca7d2db"
ioc_type = "files"
filter_query = "p:8+"

url = f"https://www.virustotal.com/api/v3/collections/{id}/{ioc_type}/download/batch?filter_query={urllib.parse.quote(filter_query)}"

headers = {"x-apikey": <api-key>,"x-tool": "<integration-name/version>","accept": "application/json"}

response = requests.get(url, headers=headers)

Request and Response Examples

Request Examples

GET /api/v3/collections/threat-actor--9382a805-c571-55b4-be0e-327e9ea0c287/files/download/batch?attributes=gti_assessment,md5,sha1,sha256&limit=2 HTTP/1.1
Host: www.virustotal.com
x-apikey: REDACTED
x-tool: REDACTED

GET /api/v3/collections/threat-actor--9382a805-c571-55b4-be0e-327e9ea0c287/files/download/batch?limit=2 HTTP/1.1
Host: www.virustotal.com
x-apikey: REDACTED
x-tool: REDACTED

GET /api/v3/collections/threat-actor--9382a805-c571-55b4-be0e-327e9ea0c287/domains/download/batch?limit=2 HTTP/1.1
Host: www.virustotal.com
x-apikey: REDACTED
x-tool: REDACTED

GET /api/v3/collections/threat-actor--9382a805-c571-55b4-be0e-327e9ea0c287/ip_addresses/download/batch?limit=2 HTTP/1.1
Host: www.virustotal.com
x-apikey: REDACTED
x-tool: REDACTED

GET /api/v3/collections/threat-actor--9382a805-c571-55b4-be0e-327e9ea0c287/urls/download/batch?limit=2  HTTP/1.1
Host: www.virustotal.com
x-apikey: REDACTED
x-tool: REDACTED

Response Examples

{
	"data": [
		{
			"attributes": {
				"gti_assessment": {
					"description": "This indicator did not match our detection criteria and there is currently no evidence of malicious activity.",
					"severity": {
						"value": "SEVERITY_NONE"
					},
					"threat_score": {
						"value": 1
					},
					"verdict": {
						"value": "VERDICT_UNDETECTED"
					}
				},
				"md5": "516e7026603fb976ee86c4e020c64c70",
				"sha1": "d3a300b1b80550694a86ed54dca2787e1f0244b5",
				"sha256": "bda69ad9116e8e661f45d847787c88f7b491be9f0c6dd891f9b016b4ec07f318"
			},
			"id": "bda69ad9116e8e661f45d847787c88f7b491be9f0c6dd891f9b016b4ec07f318",
			"type": "file"
		},
		{
			"attributes": {
				"gti_assessment": {
					"description": "This indicator is malicious (high severity) with high impact. It was detected by Google's spam and threat filtering engines, Mandiant's scoring pipeline identified this indicator as malicious, it was detected by sandbox analysis, indicating suspicious behavior, it is associated with a tracked Mandiant threat actor, it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher and categorised as downloader. Analysts should prioritize investigation.",
					"severity": {
						"value": "SEVERITY_HIGH"
					},
					"threat_score": {
						"value": 100
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"md5": "3feb0505b71b6dc91cfb621ae7a28fef",
				"sha1": "7825f0bfd19ecfaf6538a9465cad7bc8c026f468",
				"sha256": "d1223db1e8dd0aa13b9bff498f47e103fc6d02e602ff168dc53c91faf9778a6c"
			},
			"id": "d1223db1e8dd0aa13b9bff498f47e103fc6d02e602ff168dc53c91faf9778a6c",
			"type": "file"
		}
	],
	"meta": {
		"cursor": "RVBNRkdnd0lvSnlSelFZUXc0SHkrQUlnQUFwUE1Dd3hOemN5TVRFMU1UY3lMQ0pwZEM1NmRtTXVZMkZ3YVhSaGJDST0="
	}
}

{
	"data": [
		{
			"attributes": {
				"first_submission_date": 1404861773,
				"gti_assessment": {
					"description": "This indicator did not match our detection criteria and there is currently no evidence of malicious activity.",
					"severity": {
						"value": "SEVERITY_NONE"
					},
					"threat_score": {
						"value": 1
					},
					"verdict": {
						"value": "VERDICT_UNDETECTED"
					}
				},
				"last_analysis_date": 1751281285,
				"last_modification_date": 1772103445,
				"last_submission_date": 1770921861,
				"md5": "516e7026603fb976ee86c4e020c64c70",
				"names": [
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvc-controller/bin/debug/mvc-model.dll.config",
					"flash_all_bat.vshost.exe.config",
					"bms software/bmstool.exe.config",
					"tmtbzdcj/tbtmcaiji.vshost.exe.config",
					"siyanoavappupdate.exe.config",
					"boot/loveboot.vshost.exe.config",
					"novetus-lite/bin/data/roblox legacy place converter.exe.config",
					"fileconverter.exe.config",
					"novetus_legacy/bin/data/roblox_legacy_place_converter.exe.config",
					"wiinupro-master/wiinupro/app.config",
					"tokenesign.exe.config",
					"installviaservice.exe.config",
					"ndliceseserviceconfig.699ba5ac_8044_4fc0_8e1d_085cce7e4f97",
					"godotdec.exe.config",
					"digitaltoolsv2.0/数字机型配置工具.vshost.exe.config",
					"rdpcrystalinstallation/sample programs/dotnet/rdpcrystaledilibrary_demo/bin/debug/rdpcrystaledilibrary_demo.exe.config",
					"zlwx.autoupdater.vshost.exe.config",
					"xml2cfgwin.vshost.exe.config",
					"addins/act/bin/win64/ansys.act.browser.exe.config",
					"奕东wms(供应商版)安装程序及手册/wms/timserp.exe.config",
					"vcredistpatch.exe.config",
					"fileconverter.exe.config1",
					"pddzdcj/pddcaiji.vshost.exe.config",
					"rdpcrystalinstallation/sample programs/dotnet/rdpcrystaledilibrary_demo/bin/debug/rdpcrystaledilibrary_demo.vshost.exe.config",
					"zlwebclient.exe.config",
					"boot/loveboot.exe.config",
					"anf-elevate.exe.config",
					"rdpcrystalinstallation/sample programs/dotnet/rdpcrystaledilibrary_demo/app.config",
					"updaterguardianservice/southwayy.printwayy.updaterguardianservice.exe.config",
					"zlwx.configwindow.vshost.exe.config",
					"flash_all_bat.exe.config",
					"3/wildfire_multifuctionalserial_assistant.exe.config",
					"奕东wms(供应商版)安装程序及手册/wms/timseem.exe.config",
					"c:\\users\\user\\appdata\\local\\temp\\r2csjz5y.1uj\\??????? ????\\??????? ????\\????????\\????? 11 ????????\\mvc-controller\\bin\\debug\\mvc-controller.dll.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvcproject/bin/x64/debug/mvc-controller.dll.config",
					"siyanoavapplauncher.exe.config",
					"zlwx.autoupdater.exe.config",
					"pddzdcj/pddcaiji.exe.config",
					"visualstudiotabcontrol.dll.config",
					"anfelevate.exe.config",
					"grimlite/grimlite rev 1.3.4 - [skymeister]/libs/visualstudiotabcontrol.dll.config",
					"file7df7a312c550fff7debaebfa83565f5",
					"tmssetup/tmsstreamingadapter/release_4.0/tmsstreamingadapter.exe.config",
					"pddcaiji.vshost.exe.config",
					"windbot/windbot.exe.config",
					"奕东wms(供应商版)安装程序及手册/wms/timserp.vshost.exe.config",
					"easinote5_5.1.14.68662/main/swenserver.exe.config",
					"zlwx.publish.vshost.exe.config",
					"zlwx.configwindow.exe.config",
					"ndlicensingservice.exe.config",
					"zlwebclient.vshost.exe.config",
					".exe.config",
					"_30d30983410342019ee3d2661e886bf6",
					"ubntdiscovery.exe.config",
					"_c77a0535448742f981331960f04359c3",
					"vbpanvalidatorweb.exe.config",
					"simconnectnetworkwizard.exe.config",
					"swenvtesttool.exe.config",
					"c:\\users\\user\\appdata\\local\\temp\\deployment\\ogjjn1y3.lek\\lk5qtaqk.zhg\\je935_loader_lely.exe.config",
					"c:\\users\\user\\appdata\\local\\temp\\euhi2uy0.giv\\flash_all_bat.exe.config",
					"grimlite rev - amogus/libs/visualstudiotabcontrol.dll.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvc-view/bin/debug/mvc-view.dll.config",
					"_e33443f09deb32735a5e2cb3e0363f55",
					"tmtbzdcj/pddcaiji.vshost.exe.config",
					"config/runpowershellscriptasadmin.exe.config",
					"grimlite rev/libs/visualstudiotabcontrol.dll.config",
					"奕东wms(供应商版)安装程序及手册/wms/terp.erp01.ui.dll.config",
					"1.0.0.7/addins/invoicedata/third/invoicequeryservice.exe.config",
					"burn/w3burn/asda-w3 firmware upgrade tool.exe.config",
					"lzma.dll.config",
					"bin/data/roblox_legacy_place_converter.exe.config",
					"nddigital\\remoteprint\\client\\settings\\appconnector.remoteprint.clientsettings.exe.config",
					"main/help/ja/help.exe.config",
					"c:\\users\\user\\appdata\\local\\temp\\kwp523e1.1lf\\digitaltoolsv2.0\\????????.vshost.exe.config",
					"奕东wms(供应商版)安装程序及手册/wms/timseem.vshost.exe.config",
					"badge-printer/x64/badgeprintercli.exe.config",
					"setautorun.exe.config",
					"c:\\users\\user\\appdata\\local\\temp\\zo4qxitg.jty\\digitaltoolsv2.0\\????????.vshost.exe.config",
					"swtool/swenvtesttool.exe.config",
					"badge-printer/x86/badgeprintercli.exe.config",
					"1.0.0.7/addins/invoicedata/third/invoicequeryservice.vshost.exe.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvc-controller/bin/debug/mvc-controller.dll.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvc-view/bin/debug/mvc-model.dll.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvcproject/bin/x64/debug/mvc-model.dll.config",
					"je935_loader_lely.exe.config.deploy",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvc-view/bin/debug/mvc-controller.dll.config",
					"mxloader.exe.config",
					"_d38db53b1927b12e4924006ee5e55611",
					"main/help/en/help.exe.config",
					"json_functions.dll.config",
					"scp/runtime/shared/scp.desktop.client.search.exe.config",
					"tmssetup/tmsstreamingadapter/release_4.0/tmsstreamingadapter.vshost.exe.config",
					"elink/axisserver/bin/testdatamanager.dll.config",
					"bms software/bmstool.vshost.exe.config",
					"tmtbzdcj/tbtmcaiji.exe.config",
					"zlwx.publish.exe.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvc-model/bin/debug/mvc-model.dll.config",
					"elink/axisserver/bin/elinkmarker.exe.config",
					"3/wildfire_multifuctionalserial_assistant.vshost.exe.config",
					"изпитни теми/изпитни теми/практика/билет 11 практика/mvcproject/bin/x64/debug/mvc-view.dll.config"
				],
				"sha1": "d3a300b1b80550694a86ed54dca2787e1f0244b5",
				"sha256": "bda69ad9116e8e661f45d847787c88f7b491be9f0c6dd891f9b016b4ec07f318",
				"size": 184,
				"tags": [
					"xml",
					"known-distributor",
					"trusted"
				],
				"times_submitted": 99
			},
			"id": "bda69ad9116e8e661f45d847787c88f7b491be9f0c6dd891f9b016b4ec07f318",
			"type": "file"
		},
		{
			"attributes": {
				"first_submission_date": 1656508940,
				"gti_assessment": {
					"description": "This indicator is malicious (high severity) with high impact. It was detected by Google's spam and threat filtering engines, Mandiant's scoring pipeline identified this indicator as malicious, it was detected by sandbox analysis, indicating suspicious behavior, it is associated with a tracked Mandiant threat actor, it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher and categorised as downloader. Analysts should prioritize investigation.",
					"severity": {
						"value": "SEVERITY_HIGH"
					},
					"threat_score": {
						"value": 100
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"last_analysis_date": 1770472261,
				"last_modification_date": 1770479482,
				"last_submission_date": 1770472237,
				"md5": "3feb0505b71b6dc91cfb621ae7a28fef",
				"names": [
					"5.word",
					"d1223db1e8dd0aa13b9bff498f47e103fc6d02e602ff168dc53c91faf9778a6c.bin",
					"31ventures presentation(protected).docx",
					"5.docx"
				],
				"positives": 17,
				"sha1": "7825f0bfd19ecfaf6538a9465cad7bc8c026f468",
				"sha256": "d1223db1e8dd0aa13b9bff498f47e103fc6d02e602ff168dc53c91faf9778a6c",
				"size": 2973439,
				"tags": [
					"calls-wmi",
					"docx",
					"exploit",
					"malware",
					"cve-2017-0199"
				],
				"times_submitted": 7
			},
			"id": "d1223db1e8dd0aa13b9bff498f47e103fc6d02e602ff168dc53c91faf9778a6c",
			"type": "file"
		}
	],
	"meta": {
		"cursor": "RVBNRkdnd0loNTZSelFZUTErYXBwUUlnQUFwUE1Dd3hOelk0TlRrek16a3dMQ0k1TVRNMVptSTVaVGMwWW1SaU16azRNamhpWm1WalpqYzVNVGswTXpBd05qSmpaVFE0TW1FMU1qTTVPVGxpWkRkbVpqRmhNelk0TURNNFpqTXlNemN4SWc9PQ=="
	}
}

{
	"data": [
		{
			"attributes": {
				"creation_date": 1751155200,
				"gti_assessment": {
					"description": "This indicator is malicious (medium severity). Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant threat actor and it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher.",
					"severity": {
						"value": "SEVERITY_MEDIUM"
					},
					"threat_score": {
						"value": 60
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"jarm": "3fd3fd0003fd3fd00043d3fd3fd43d70e44c2d581076ca8e0c7ff40bb556f2",
				"last_modification_date": 1772115175,
				"positives": 15
			},
			"id": "j-ic.co",
			"type": "domain"
		},
		{
			"attributes": {
				"creation_date": 1711324800,
				"gti_assessment": {
					"description": "This indicator is malicious (medium severity). It was detected by Google Safe Browsing, Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant threat actor and it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher.",
					"severity": {
						"value": "SEVERITY_MEDIUM"
					},
					"threat_score": {
						"value": 60
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"jarm": "3fd3fd0003fd3fd00043d3fd3fd43d70e44c2d581076ca8e0c7ff40bb556f2",
				"last_modification_date": 1772115172,
				"positives": 17
			},
			"id": "it.zvc.capital",
			"type": "domain"
		}
	],
	"meta": {
		"cursor": "RUxFZkdnd0k2WjZSelFZUWxiemRqZ0VnQUFvZE1Dd3hOemN5TVRFMU1UY3lMQ0pwZEM1NmRtTXVZMkZ3YVhSaGJDST0="
	}
}

{
	"data": [
		{
			"attributes": {
				"as_owner": "hostwinds llc.",
				"asn": 54290,
				"continent": "na",
				"country": "us",
				"gti_assessment": {
					"description": "This indicator is malicious (high severity) with high impact. It was determined as malicious by a Mandiant analyst, it is considered widespread, Mandiant's scoring pipeline identified this indicator as malicious, Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant threat actor and it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher. Analysts should prioritize investigation.",
					"severity": {
						"value": "SEVERITY_HIGH"
					},
					"threat_score": {
						"value": 95
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"last_modification_date": 1772105112,
				"positives": 2,
				"regional_internet_registry": "arin"
			},
			"id": "104.168.143.111",
			"type": "ip_address"
		},
		{
			"attributes": {
				"as_owner": "winstri corporation",
				"asn": 36829,
				"continent": "na",
				"country": "us",
				"gti_assessment": {
					"description": "This indicator is malicious (high severity) with high impact. It is considered widespread, it is associated with a tracked Mandiant threat actor and it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher. Analysts should prioritize investigation.",
					"severity": {
						"value": "SEVERITY_HIGH"
					},
					"threat_score": {
						"value": 95
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"last_modification_date": 1772104120,
				"positives": 3,
				"regional_internet_registry": "arin"
			},
			"id": "104.156.149.130",
			"type": "ip_address"
		}
	],
	"meta": {
		"cursor": "RUpVQ0dnd0kwWitSelFZUTdvekJnQUlnQUFvZU1Dd3hOemN5TVRBME1USXdMQ0l4TURRdU1UVTJMakUwT1M0eE16QWk="
	}
}

{
	"data": [
		{
			"attributes": {
				"categories": [
					"compromised websites",
					"phishing and fraud",
					"phishing (alphamountain.ai)",
					"phishing and other frauds"
				],
				"first_submission_date": 1750229771,
				"gti_assessment": {
					"description": "This indicator is malicious (medium severity). It was determined as malicious by a Mandiant analyst, Mandiant's scoring pipeline identified this indicator as malicious, Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant threat actor and it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher.",
					"severity": {
						"value": "SEVERITY_MEDIUM"
					},
					"threat_score": {
						"value": 60
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"last_analysis_date": 1772104796,
				"last_modification_date": 1772105147,
				"last_submission_date": 1772104796,
				"positives": 16,
				"sha256": "9b06762c9eca7179002a53d32ed63ed7b9af42897ca7d7c4760da9fe1ec541d5",
				"times_submitted": 17,
				"url": "http://web071zoom.us/fix/audio-tr/7217417464"
			},
			"id": "9b06762c9eca7179002a53d32ed63ed7b9af42897ca7d7c4760da9fe1ec541d5",
			"type": "url"
		},
		{
			"attributes": {
				"categories": [
					"information technology",
					"adult content",
					"phishing and other frauds",
					"phishing and fraud",
					"phishing (alphamountain.ai)"
				],
				"first_submission_date": 1698305064,
				"gti_assessment": {
					"description": "This indicator is malicious (medium severity). It was detected by Google Safe Browsing, Google TI's ML scoring model identified this indicator as malicious, it is associated with a tracked Mandiant threat actor, it was detected by Webrisk as being associated with malware and it is contained within a collection provided by the Google Threat Intelligence team, or a trusted partner or security researcher.",
					"severity": {
						"value": "SEVERITY_MEDIUM"
					},
					"threat_score": {
						"value": 60
					},
					"verdict": {
						"value": "VERDICT_MALICIOUS"
					}
				},
				"last_analysis_date": 1772100816,
				"last_modification_date": 1772101137,
				"last_submission_date": 1772100816,
				"positives": 12,
				"sha256": "b2fe1d9aff2cc54b416675f45741d8ae4bd1b6493af16eacf2d44b24bd4925a1",
				"times_submitted": 43,
				"url": "http://internal.group.link-net.publicvm.com/"
			},
			"id": "b2fe1d9aff2cc54b416675f45741d8ae4bd1b6493af16eacf2d44b24bd4925a1",
			"type": "url"
		}
	],
	"meta": {
		"cursor": "RVBRTUdnd0lxcUNSelFZUTNJVzZvUUlnQUFwUE1Dd3hOemN5TVRBd09ERTJMQ0ppTW1abE1XUTVZV1ptTW1Oak5UUmlOREUyTmpjMVpqUTFOelF4WkRoaFpUUmlaREZpTmpRNU0yRm1NVFpsWVdObU1tUTBOR0l5TkdKa05Ea3lOV0V4SWc9PQ=="
	}
}

Responses

Language

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

Allowed filters by object ioc_type

Allowed attributes