Rösti provides Repackaged Öpen Source Threat Intelligence gathered from public reports. The Indicators of Compromise (IOCs) are available in various formats, including MISP, STIX and ECS.

Reports API
Diamond Introducing

C2 Feeds

New feeds focused exclusively on command & control (C2) IOCs. Starting April 20, new IOCs will be manually reviewed and C2s are added to these curated feeds.

The result: significantly less noise, higher confidence, and more actionable insights compared to general IOC feeds—so you can focus on what truly matters.

C2 Feeds
Loading stats

Important Updates

C2 Feeds

Introducing new feeds focused exclusively on command & control (C2) IOCs. Starting April 20, new IOCs will be manually reviewed and C2s are added to these curated feeds.
API Requests will soon Require Authentication

Starting October 1, 2026, authentication will be required for the Rösti API.
New Domain: rosti.dev

Rösti is now using a new domain rosti.dev. The old domains *.rosti.bin.re will be redirected to the new domains until at least December 31, 2026.