GET /v1/iocs · indicator feed

curl -H "X-API-Key: $CTI_KEY" "https://ctiforecast.com/v1/iocs?type=ip,domain&min_confidence=70&limit=2"

{
  "count": 2,
  "delayed_hours": 0,
  "next_until": "2026-11-06T21:19:02.118374",
  "data": [
    {"value": "185.177.93.120", "type": "ip", "confidence": 74, "confidence_base": 74,
     "first_seen": "2026-10-28T09:12:40", "last_seen": "2026-11-06T21:20:11",
     "source": "www.bitdefender.com", "malware_family": null,
     "asn": 211252, "as_name": "…", "country": "NL",
     "references": [{"url": "https://www.bitdefender.com/en-us/blog/labs/…", "source": "www.bitdefender.com",
                     "seen_at": "2026-11-06T21:20:11"}]},
    ...
  ]
}

GET /v1/lookup?value=… · check an indicator

Returns found: true and the details when the value (hash, IP, domain, CVE) is in the feed.

curl -H "X-API-Key: $CTI_KEY" "https://ctiforecast.com/v1/lookup?value=CVE-2025-55182"

GET /v1/stats · feed status and your quota

curl -H "X-API-Key: $CTI_KEY" "https://ctiforecast.com/v1/stats"

GET /v1/export · bulk export BUSINESS

Same filters as /v1/iocs, up to 500,000 rows. format=csv (default) or format=json.

curl -H "X-API-Key: $CTI_KEY" -o iocs.csv "https://ctiforecast.com/v1/export?type=sha256,md5&since=2026-11-01T00:00:00"

GET /v1/trending · accelerating threats

Indicators whose mentions over the last 7 days exceed those of the 7 days before. Recomputed hourly. status: nouveau (new, absent the previous week), en_hausse (rising, ×1.5 or more), stable, en_baisse (falling). Default: nouveau,en_hausse. Free plan: top 10 for its types.

curl -H "X-API-Key: $CTI_KEY" "https://ctiforecast.com/v1/trending?type=cve,sha256&limit=20"

{"window": "7d vs 7d précédents", "count": 20, "data": [
  {"value": "CVE-2025-55182", "type": "cve", "trend_score": 87, "status": "en_hausse",
   "mentions_7d": 412, "mentions_previous_7d": 96, "active_days_7d": 7, "growth": 4.28, ...}
]}

GET /v1/forecast · CVE exploitation forecasts

CVEs ranked by their probability of being added to the CISA KEV catalog (confirmed exploitation) within 30 days. The model combines EPSS with mention dynamics in security research and is retrained weekly (measured reliability). signal: imminente (likely soon), a_surveiller (watch), exploitee (exploited), faible (low); default imminente,a_surveiller. Free plan: top 10, without source articles.

curl -H "X-API-Key: $CTI_KEY" -H "Accept-Language: en" "https://ctiforecast.com/v1/forecast?signal=imminente&limit=20"

{"horizon_days": 30, "epss_date": "2026-11-06", "count": 20, "data": [
  {"cve": "CVE-2026-43284", "signal": "imminente", "signal_label": "Likely exploitation soon",
   "forecast_score": 100, "kev_probability_30d": 0.0033, "epss": 0.942, "in_kev": false,
   "mentions_7d": 7, "mentions_previous_7d": 9, "reasons": ["…"],
   "references": [{"url": "https://…", "source": "…"}]}
]}

kev_probability_30d is a raw probability, low by nature (only a few dozen CVEs are added to KEV each month). forecast_score (0-100) is its rank among active CVEs: use it to prioritise. The reasons field is currently written in French.

GET /v1/cve/<id> · CVE profile

Forecast, EPSS, KEV status (with the date added and known ransomware use), mentions and source articles for one CVE.

curl -H "X-API-Key: $CTI_KEY" "https://ctiforecast.com/v1/cve/CVE-2025-55182"

GET /v1/blocklist.txt · blocklist

One value per line (lines starting with # are comments), sorted by confidence. Built for firewalls, DNS filters, Wazuh and MISP. These tools often can only download a URL: you can then pass the key in the URL with key=. Keep that URL private, it gives access to your account.

curl "https://ctiforecast.com/v1/blocklist.txt?type=ip&days=30&key=$CTI_KEY"

Up to 50,000 lines on Pro, 500,000 on Business.

GET /v1/stix · STIX 2.1 bundle PRO

Same filters as /v1/iocs. Hashes, IPs, domains and URLs become indicator objects with their STIX pattern, and CVEs become vulnerability objects. Source articles are in external_references. Identifiers are stable: an indicator keeps the same id from one export to the next, which avoids duplicates on import (OpenCTI, MISP, Microsoft Sentinel).

curl -H "X-API-Key: $CTI_KEY" -o cti-forecast.json "https://ctiforecast.com/v1/stix?type=sha256,ip,domain&min_confidence=70&limit=1000"

TAXII 2.1 server PRO

The OASIS standard protocol for exchanging threat intelligence. OpenCTI, Microsoft Sentinel, MISP and most TIPs connect to it directly. Basic authentication: any username, your API key as the password (or the X-API-Key header). Read-only, STIX 2.1 objects marked TLP:GREEN, pagination with next, incremental collection with added_after.

curl -u "client:$CTI_KEY" -H "Accept: application/taxii+json;version=2.1" \
  "https://ctiforecast.com/taxii2/api/collections/77653c02-ccd7-55e5-8db8-85d421cfba7c/objects/?added_after=2026-11-01T00:00:00Z&limit=500"

Confidence and decay

confidence is the current confidence. For IPs and URLs it halves every 30 days without a new sighting, and every 90 days for domains (after a 7-day grace period): attack infrastructure changes hands quickly. Hashes and CVEs do not decay. confidence_base is the value before decay; an indicator seen again gets its base confidence back. In STIX, valid_until is the date after which the indicator should no longer be used for blocking.

Error codes