Rösti provides Repackaged Öpen Source Threat Intelligence gathered from public reports. The Indicators of Compromise (IOCs) are available in various formats, including MISP, STIX and ECS.

Reports API
Diamond Introducing

C2 Feeds

New feeds focused exclusively on command & control (C2) IOCs. Starting April 20, new IOCs will be manually reviewed and C2s are added to these curated feeds.

The result: significantly less noise, higher confidence, and more actionable insights compared to general IOC feeds—so you can focus on what truly matters.

C2 Feeds
Loading stats

Important Updates

C2 Feeds

Introducing new feeds focused exclusively on command & control (C2) IOCs. Starting April 20, new IOCs will be manually reviewed and C2s are added to these curated feeds.
API Requests will soon Require Authentication

Starting October 1, 2026, authentication will be required for the Rösti API.
New Domain: rosti.dev

Rösti is now using a new domain rosti.dev. The old domains *.rosti.bin.re will be redirected to the new domains until at least December 31, 2026.

Pricing

Premium features, same free price

Rösti is built to support security teams with reliable, high-quality threat intelligence at every stage of their operations.

Core

The perfect starting point for actionable threat intelligence. Free forever.

$0 / month
Premium

Premium features with increased quotas and expanded access.

$0 / month
Unlimited
Everyone’s plan

Unlimited full access to all features and data.

$0 / month

Core

Premium

Unlimited

Daily Updates
Ongoing Development
Manual IOC Review
Diverse Source of IOCs
Multi-Format Threat Intel Exports
Blocklist-Ready Domain Feeds
Product-Specific Security Feeds
False-Positive Risk Scoring
Enterprise-grade API Access
API Explorer and Playground
Yara Rules
—
Curated C2 Feeds
—
Bulk IOC Exports
—
—
API Calls per Day
100
1000
unlimited