API Reference

Get Daily Honeypot Statistics

Return aggregate Shadowserver honeypot statistics for each day in the requested window, including unique IP counts, total connections, and the number of active and distinct CVEs observed.

GET

/v1/shadowserver/daily-stats

Cost: 1 credit per successful call

Query parameters

daysintegeroptionaldefault: 30

Look-back window in days. Accepted range: 1–90.

Request

curl "https://api.precursorintelligence.com/functions/v1/shadowserver/daily-stats?days=60" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 2,
    "days": 60,
    "items": [
      {
        "observation_date": "2026-05-17",
        "dimension": "port",
        "dimension_value": "445",
        "unique_ips": 188412,
        "connections": 4231998,
        "active_cves": 2812,
        "distinct_cves": 1412
      },
      {
        "observation_date": "2026-05-16",
        "dimension": "port",
        "dimension_value": "445",
        "unique_ips": 191037,
        "connections": 4318204,
        "active_cves": 2790,
        "distinct_cves": 1398
      }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Total number of rows returned across all dimensions in the window.

data.daysintegeroptional

The look-back window that was applied, in days.

data.itemsarrayoptional

One entry per calendar day and dimension combination in the window, ordered newest first by date, then by connection volume descending. Each object contains the fields below.

data.items[].observation_datestringoptional

Observation date in YYYY-MM-DD format (UTC).

data.items[].dimensionstringoptional

The grouping dimension for this row (for example, "port" or "protocol").

data.items[].dimension_valuestringoptional

The value of the dimension for this row (for example, "445" or "tcp").

data.items[].unique_ipsintegeroptional

Number of unique source IP addresses observed by Shadowserver honeypots on this date for this dimension.

data.items[].connectionsintegeroptional

Total connection attempts logged across all honeypot sensors on this date for this dimension.

data.items[].active_cvesintegeroptional

Count of CVEs that had at least one connection recorded on this date for this dimension.

data.items[].distinct_cvesintegeroptional

Count of distinct CVEs with activity, de-duplicated across all sensors on this date for this dimension.

data.generated_atstringoptional

ISO 8601 timestamp indicating when the response was generated.

Errors

Status	`error`	When
400	`invalid_days`	The `days` query parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.