The attacker IPs Shield sees,
flowing into your firewall and SIEM.
Export the attacker IPs Shield observes on your own machines, as plain text or rich JSON — not a generic blocklist, but the attacks targeting your systems directly. The key takes one click in the panel, and copy-paste examples make the first query a three-minute job.
First query in three minutes — without writing code.
The key comes from the panel, and the panel hands you ready copy-paste examples.
Open the Integrations screen in the panel and click "Create key". The key is shown once; revoke it whenever you like.
The screen offers ready curl, PowerShell, and Postman examples with your key already in place — copy with one click and run.
Set the query URL in your SIEM collector or in a list feed that supports custom headers; where headers aren't supported, a small scheduled download does it. The feed keeps itself current.
curl -H "Authorization: Bearer dyn_live_••••" \
"https://api.dynacop.com/api/v1/attacks?format=text&days=7"Two formats: plain text for firewalls, JSON for SIEMs.
One endpoint, two outputs — you pick based on the consuming system.
curl -H "Authorization: Bearer dyn_live_••••" \ "https://api.dynacop.com/api/v1/attacks?format=text&days=7"
A bare IP list. Hand the URL directly to list feeds that can send a custom header; on firewalls that can't, a two-line scheduled job (download → file) does it. Add comments=true if you want header lines.
{
"generatedAt": "2026-07-18T09:00:12Z",
"window": { "since": "2026-07-11T09:00:12Z" },
"count": 42,
"attacks": [
{
"ip": "185.220.101.4",
"attempts": 13633,
"lastSeenAt": "2026-07-18T07:41:03Z",
"resources": ["SRV-RDP-01"],
"blocked": true,
"services": { "rdp": 13401, "unknown": 232 },
"geo": { "country": "DE", "city": "Berlin", "isp": "ExampleNet" }
}
]
}Attempt counts, targeted resources, block status, service breakdown (RDP/SSH), and country/ISP — ready for SIEM rules and reports.
You choose the window and the filter.
The parameters are the endpoint's real contract; the default window is the last 7 days.
days=1..30Sliding window (default 7 days)since=ISO8601Fixed start time (instead of days)min_attempts=nIPs with at least n attemptsblocked=true|falseOnly blocked / only unblockedformat=json|textOutput format (Accept: text/plain works too)comments=trueHeader lines in text output (count, window)?format=text&blocked=true&min_attempts=10The IPs Dynacop blocks on the machine get shut out at your network edge too. URL directly into header-capable feeds; a scheduled download otherwise.
?format=json&days=1Wire the last 24 hours of JSON into your collector; write correlation rules using attempt counts, service breakdowns, and geo fields.
?format=json&days=7One provider-scoped key covers all your customers; each record also lists which customers were targeted.
If-None-Match: "<etag>"Responses carry an ETag: ask with this header and you get a 304 when nothing changed — no wasted bandwidth or processing.
What goes into the feed — and what never does?
Every exported field is a deliberate decision — the default is not to leak.
Targeted account names are deliberately absent from the feed: an exported stream must not leak your admin account inventory. Raw names stay in the panel only.
Want a machine out of the feed? Turn off API export in that resource's policy; it then appears in no response at all.
The key only reads data: it can't modify users, policies, blocks, or resource settings. It's also fully separate from panel sessions — no cookies, only the key in the Authorization header.
There's a fair-use limit; combined with ETag support it's more than enough for a feed that stays minute-fresh.
Threat Feed — frequently asked questions
Where do I get the key?
From the Integrations screen in the panel, in one click. The key is shown once at creation, and the screen offers copy-paste curl, PowerShell, and Postman examples with your key already in place. You can revoke it at any time.
Does the Threat Feed cost extra?
No. The Threat Feed API is included in every installation — it works on the free tier too. There's no separate package or tier.
How do I feed it into my firewall?
The format=text output gives one bare IP per line. On systems whose list feed can send a custom header, set the URL directly; on ones that can't, a two-line scheduled job that downloads the list to a file and serves it as an external list is all it takes. With the blocked=true filter you get only the blocked IPs.
When does an IP drop out of the feed?
The feed is window-based: every response is the full list of attacker IPs seen within your chosen window (the last 7 days by default) — it's not an incremental diff stream. An IP that falls outside the window is absent from the next response, so apply the output as a full-list replacement in the consuming system.
How fresh is the feed?
The feed reads from live data; there's no separate publishing or caching layer in between. As agents report attack events, the records appear in your next query.
What data is in the feed — and what isn't?
In: attacker IP, attempt count, first/last seen, targeted resource names, block status, service breakdown (RDP/SSH), and country/city/ISP. Deliberately out: targeted usernames (they'd leak your account inventory) and internal system identifiers.
As an MSP, can I get all my customers with one key?
Yes. A provider-scoped key covers all your customer workspaces, and each attack record lists the targeted customers in a separate field. You can also create a key scoped to a single customer.
How often can I query it?
There's a limit of 60 requests per minute per key. Responses carry an ETag: query with If-None-Match and you get a 304 when nothing has changed — frequent polling stays cheap.
Can I exclude a specific machine from the feed?
Yes. Turn off API export in the resource's policy; that resource's data then appears in no API response. Panel visibility is unaffected.
Does the feed show only blocked IPs?
No — the default response includes every observed attacker IP, including ones below the block threshold; each record carries its block status. If you want only blocked IPs, use the blocked=true filter.
What should I do if my API key leaks?
Revoke the key in the panel immediately and create a new one. Because the key is read-only, a leak grants no ability to change anything; and since the feed carries no usernames, the impact is limited to reading your attack telemetry — revoke it all the same.
Your first 10 users are free.
Connect Shield's data to your firewall or SIEM today.
No credit card required · No minimum purchase