What this endpoint does

This endpoint generates simulated Squid proxy log events containing domains from the Recorded Future domain risk list, designed for testing and demonstrating SIEM or proxy log integrations without requiring live network data. Each call returns a refreshed set of synthetic log entries (updated every four hours) that mimic real proxy traffic to risky domains, making it useful for validating detection pipelines, building demos, or developing log-parsing workflows. Similar demo event endpoints exist for IP addresses, URLs, hashes, and vulnerabilities.

Response data

The response is plain text (not JSON), with one log entry per line in Squid proxy log format: Unix timestamp, elapsed time in milliseconds, client IP, cache result with HTTP status code, response size in bytes, HTTP method, full URL containing a risky domain, routing hierarchy with peer IP, and content type. The domains embedded in the URLs are drawn from the Recorded Future domain risk list, while client IPs, response sizes, and other metadata are simulated values.