> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Botnet

Search ZeroFox's CTI feed of botnet-infected hosts for a specified IP address.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [ZeroFox documentation](https://api.zerofox.com/cti/docs/).

## Basic Parameters

| Parameter | Description |
| - | - |
| IP | The IP address to search for. |
| Listed After | The date and time to return infected hosts listed from. |
| Return All Pages | Automatically fetch all resources, page by page. |

## Advanced Parameters

| Parameter | Description |
| - | - |
| Cursor | The cursor of the results page to return. You can get it from the `next` URL of a previous response. |

## Example Output

```json theme={"dark"}
{
	"next": null,
	"results": [
		{
			"ip_address": "ip_address",
			"listed_at": "2023-02-09T23:44:09Z",
			"bot_name": "andromeda",
			"c2_ip_address": "184.105.192.2",
			"c2_domain": "differentia.ru",
			"is_common_domain": true,
			"file_location": null,
			"operating_system": null,
			"anti_viruses": null,
			"country_code": "US",
			"zip_code": null,
			"location": null,
			"current_language": null,
			"available_keyboards": null,
			"uac": null,
			"process_elevation": null,
			"acquired_at": null,
			"logged_at": null,
			"estimated_infected_at": null,
			"breached_at": null,
			"tags": [
				"c2_domain_top_1m",
				"c2_root_domain_top_1m"
			]
		}
	]
}
```

## Workflow Library Example

[Search Botnet with Zerofox and Send Results Via Email](https://library.blinkops.com/workflows/search-botnet-with-zerofox-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/search-botnet-with-zerofox-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/search-botnet-with-zerofox-and-send-results-via-email/canvas)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.