API Reference

Get Honeypot Activity for a CVE

Return daily Shadowserver honeypot observations for a single CVE over a configurable look-back window, alongside aggregate summary statistics, so you can understand how actively a vulnerability is being scanned or exploited across the internet.

GET

/v1/shadowserver/cve/{cve-id}

Cost: 1 credit per successful call

Path parameters

cve-idstringrequired

A CVE identifier matching the pattern CVE-YYYY-NNNNN where the numeric suffix is 4 to 7 digits. Input is case-insensitive: cve-2024-3094 is accepted and normalised to CVE-2024-3094 server-side.

Query parameters

daysintegeroptionaldefault: 30

Number of days to look back. Accepted range: 1–90.

Request

curl "https://api.precursorintelligence.com/functions/v1/shadowserver/cve/CVE-2024-3094?days=60" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "cve_id": "CVE-2024-3094",
    "days": 60,
    "summary": {
      "cve_id": "CVE-2024-3094",
      "vendor": "xz",
      "product": "xz-utils",
      "severity": "Critical",
      "cvss": 10.0,
      "cisa_kev": true,
      "iot": false,
      "vulnerability_class": "Supply Chain",
      "first_seen": "2024-04-02",
      "last_seen": "2026-05-17",
      "connections_total": 841203,
      "connections_7d": 29841,
      "connections_30d": 118204,
      "connections_90d": 312900,
      "action_priority": "Immediate",
      "epss_score": 0.9732,
      "epss_percentile": 0.9991,
      "nvd_published": "2024-03-29",
      "summary_as_of": "2026-05-17"
    },
    "observations": [
      { "observation_date": "2026-05-17", "unique_ips": 188 },
      { "observation_date": "2026-05-16", "unique_ips": 172 },
      { "observation_date": "2026-05-15", "unique_ips": 161 }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.cve_idstringoptional

The CVE identifier as stored (uppercased).

data.daysintegeroptional

The look-back window used for this query, in days.

data.summaryobject | nulloptional

Aggregate statistics for the CVE across all time and fixed windows. null if the CVE has no Shadowserver records. When present, contains cve_id, vendor, product, severity, cvss (number), cisa_kev (boolean), iot (boolean), vulnerability_class, first_seen, last_seen, connections_total, connections_7d, connections_30d, connections_90d, action_priority, epss_score (number), epss_percentile (number), nvd_published, and summary_as_of.

data.observationsarrayoptional

One entry per calendar day within the window, sorted descending by date. Empty array if no observations exist. Each object contains observation_date (YYYY-MM-DD) and unique_ips (integer, unique source IPs observed on that date).

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_cve_id`, `invalid_days`	A path or query parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.