Search Botnet - BlinkOps Documentation

Search ZeroFox’s CTI feed of botnet-infected hosts for a specified IP address.

External DocumentationTo learn more, visit the ZeroFox documentation.

Basic Parameters

Parameter	Description
IP	The IP address to search for.
Listed After	The date and time to return infected hosts listed from.
Return All Pages	Automatically fetch all resources, page by page.

Advanced Parameters

Parameter	Description
Cursor	The cursor of the results page to return. You can get it from the `next` URL of a previous response.

Example Output

{
	"next": null,
	"results": [
		{
			"ip_address": "ip_address",
			"listed_at": "2023-02-09T23:44:09Z",
			"bot_name": "andromeda",
			"c2_ip_address": "184.105.192.2",
			"c2_domain": "differentia.ru",
			"is_common_domain": true,
			"file_location": null,
			"operating_system": null,
			"anti_viruses": null,
			"country_code": "US",
			"zip_code": null,
			"location": null,
			"current_language": null,
			"available_keyboards": null,
			"uac": null,
			"process_elevation": null,
			"acquired_at": null,
			"logged_at": null,
			"estimated_infected_at": null,
			"breached_at": null,
			"tags": [
				"c2_domain_top_1m",
				"c2_root_domain_top_1m"
			]
		}
	]
}

Workflow Library Example

Search Botnet with Zerofox and Send Results Via Email

Preview this Workflow on desktop