A curated, open-source collection of Threat Intelligence / IOC feeds.
Most feeds are free and publicly accessible — no account or API key required.
Feeds that require registration are clearly marked as RESTRICTED.
Sources aggregated from:
- FireWALL-E: ipsets-blocklists;
- MISP default feeds;
- Bert-JanP/Open-Source-Threat-Intel-Feeds;
- awesome-threat-intelligence;
- mthcht/awesome-lists;
- Additional community projects.
Important
Content is served as-is. Verify licensing terms before using in a business environment.
Note
Auto-updated daily by GitHub Actions: 🟢 Active – 🔴 Offline – 🔒 Restricted – ⚪ Not checked.
| Category | Description | Count |
|---|---|---|
IP |
Malicious / suspicious IPv4 addresses and CIDR ranges | 167 |
DNS |
Malicious or suspicious domain names | 24 |
URL |
Malicious / phishing / C2 URLs | 34 |
MD5 |
MD5 hashes of malicious files | 6 |
SHA1 |
SHA1 hashes of malicious files | 3 |
SHA256 |
SHA256 hashes of malicious files | 4 |
SSL |
Malicious SSL certificate fingerprints | 1 |
JA3 |
JA3 TLS client fingerprints | 1 |
CVEID |
Known exploited CVE identifiers | 4 |
RANSOMWARELEAK |
Ransomware leak site victim data aggregated from multiple gang leak sites | 1 |
MISP |
Structured MISP-format feeds (importable directly into MISP platform) | 5 |
IOC |
Mixed-type IOC feeds containing multiple indicator types (IP, domain, URL, hash, etc.) | 34 |
BLOCKLIST |
General-purpose IP blocklists — ISPs, ASNs, gaming, ad-trackers (not strictly threat intel) | 43 |
REPO |
GitHub repositories with IOC collections — no direct machine-readable feed URL | 63 |
RESTRICTED |
Feeds requiring registration or an API key (free or commercial) to access | 5 |
GEOIP |
IP geolocation databases — country/ASN/region mapping (not threat intel) | 3 |
RSS |
Threat intelligence RSS/Atom feeds from vendors, CERTs, and security researchers | 9 |
FRAMEWORK |
Threat intelligence frameworks, matrices, and tracking tools (MITRE, APT maps, etc.) | 3 |
OSINT |
Open-source intelligence platforms and search engines for IOC investigation | 6 |
SANDBOX |
Online malware analysis sandboxes for dynamic file and URL analysis | 3 |
| Total | 419 |
threat-intelligence-feeds/
├── threat-intelligence-feeds.csv ← master feed database (source of truth)
├── README-STATISTICS.md ← auto-generated, do not edit manually
├── README.md ← auto-updated stats + feeds table
├── requirements.txt
├── scripts/
│ ├── tif-validator.py ← validates CSV format & categories
│ ├── tif-status-checker.py ← checks live HTTP status of all URLs
│ ├── tif-generate-table-statistics.py ← generates README-STATISTICS.md (standalone)
│ └── tif-update-readme.py ← regenerates stats + feeds table in README
└── .github/workflows/
└── daily-update.yml ← runs every day at 02:17 UTC
threat-intelligence-feeds.csv is the single source of truth for this project.
It is maintained manually (you add/remove feeds here) but the FeedStatus column is auto-filled daily by tif-status-checker.py via GitHub Actions. The README tables are then auto-regenerated from this CSV by tif-update-readme.py.
Format:
Vendor;Description;Category;Url;FeedStatus
Abuse.ch;Botnet C2 IP Blacklist;IP;https://sslbl.abuse.ch/blacklist/sslipblacklist.csv;Active- Python 3.10+
git
# 1. Clone the repository
git clone https://github.com/kraloveckey/threat-intelligence-feeds.git
cd threat-intelligence-feeds
# 2. (Optional but recommended) create a virtual environment
python3 -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
# 3. Install dependencies
pip install -r requirements.txt
# 4. Validate the CSV (always a good first step)
cd scripts
python3 tif-validator.py
# 5. Check live HTTP status of all feed URLs
# Writes/updates the FeedStatus column in threat-intelligence-feeds.csv
# Takes ~3–5 minutes (runs 25 workers in parallel)
python3 tif-status-checker.py
# 6. Regenerate README-STATISTICS.md and inject tables into README.md
python3 tif-update-readme.pyTip
You can run steps 4–6 independently. For example, run only tif-validator.py after adding new feeds to the CSV before opening a Pull Request.
After the first push, the workflow runs every day at 02:17 UTC and:
- Validates the CSV format and categories.
- Checks HTTP status of all feed URLs → updates
FeedStatuscolumn in CSV. - Regenerates stats and both tables in README.
- Commits and pushes if anything changed.
You can also trigger it manually: Actions → Daily TIF Update → Run workflow
Status legend: 🟢 Active – 🔴 Offline – 🔒 Restricted (requires API key) – ⚪ Not yet checked.
Note
BLOCKLIST entries (ISPs, ASNs, gaming companies, IANA ranges) are general-purpose blocklists, not threat intelligence in the strict sense — use them for network filtering, not for SIEM correlation.
REPO entries point to GitHub repositories without a direct machine-readable URL — you need to browse or clone them manually.
RESTRICTED entries require free or commercial registration to download.
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | Botnet C2 IP Blacklist (CSV) | 🟢 | ↗ |
| Abuse.ch | Botnet C2 IP Blacklist (TXT) | 🟢 | ↗ |
| Abuse.ch | Botnet C2 IP Blacklist Aggressive (CSV) | 🟢 | ↗ |
| Abuse.ch | Botnet C2 IP Blacklist Aggressive (TXT) | 🟢 | ↗ |
| Abuse.ch | Botnet C2 Indicators of Compromise – Recommended Blocklist | 🟢 | ↗ |
| Abuse.ch | Botnet C2 Indicators of Compromise | 🟢 | ↗ |
| Abuse.ch | All botnet C2s Feodo Tracker has ever seen | 🟢 | ↗ |
| Abuse.ch | Feodo IP Blocklist Aggressive | 🟢 | ↗ |
| AbuseIPDB | AbuseIPDB Score 100 – Last 1 day | 🟢 | ↗ |
| AbuseIPDB | AbuseIPDB Score 100 – Last 30 days | 🟢 | ↗ |
| AlienVault | Alienvault IP Reputation | 🟢 | ↗ |
| AlienVault | IP Reputation Generic | 🟢 | ↗ |
| APNIC Honeynet | SSH Bruteforce IPs | 🟢 | ↗ |
| APNIC Honeynet | Telnet Bruteforce IPs | 🟢 | ↗ |
| Binarydefense | Binary Defense Artillery Threat Intelligence Banlist | 🟢 | ↗ |
| Blocklist.de | All IPs that attacked a customer/server in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs that attacked SSH in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs that attacked Mail/Postfix in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs that attacked Apache in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs that attacked IMAP/SASL/POP3 in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs reported for IRC/BadBots/RFI-Attacks in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs with Brute-Force attacks on Joomla/Wordpress/Web-Logins | 🟢 | ↗ |
| Blocklist.de | IPs older than 2 months with more than 5000 attacks | 🟢 | ↗ |
| Blocklist.de | IPs that attacked FTP in the last 48 hours | 🟢 | ↗ |
| Blocklist.de | IPs that attacked SIP in the last 48 hours | 🟢 | ↗ |
| Blocklist.net.ua | Ukrainian Blocklist (Ukraine CERT) | 🟢 | ↗ |
| BotScout.com | Most recently-caught web bots | 🟢 | ↗ |
| Botvrij.eu | Botvrij IOC IP Destination (raw) | 🟢 | ↗ |
| Botvrij.eu | Botvrij IOC IP Source (raw) | 🟢 | ↗ |
| BruteForceBlocker | SSH BruteForce Blocker IPs | 🟢 | ↗ |
| C2IntelFeeds | C2 IP addresses – 30 day verified | 🟢 | ↗ |
| C2IntelFeeds | Unverified C2 IPs | 🟢 | ↗ |
| Carbon Black | Cobalt Strike LuckyMouse / TA428 | 🟢 | ↗ |
| Carbon Black | Cobalt Strike Pyxie | 🟢 | ↗ |
| CINSscore | CINS Bad IP List (ci-badguys) | 🟢 | ↗ |
| CleanTalk | CleanTalk Blacklist – Submitted Today | 🟢 | ↗ |
| CleanTalk | CleanTalk Blacklist – Updated Today | 🟢 | ↗ |
| CleanTalk | CleanTalk Blacklist – Top 20 | 🟢 | ↗ |
| CriticalPathSecurity | Abuse.ch IP Blocklist Feed | 🟢 | ↗ |
| CriticalPathSecurity | Log4j Scanners and Exploiters | 🟢 | ↗ |
| CriticalPathSecurity | CPS collected IOCs (Zeek intel format) | 🟢 | ↗ |
| CriticalPathSecurity | CPS LockBit ransomware IPs | 🟢 | ↗ |
| CriticalPathSecurity | CPS stalkerware indicators | 🟢 | ↗ |
| CriticalPathSecurity | CPS Ragnar Locker ransomware IOCs | 🟢 | ↗ |
| cybercrime-tracker.net | Command and Control tracking IP list | 🟢 | ↗ |
| dan.me.uk | Dynamic list of TOR nodes (full) | 🟢 | ↗ |
| Daniel Austin MBCS | TOR Exit Nodes | 🟢 | ↗ |
| Daniel Austin MBCS | TOR All Nodes | 🟢 | ↗ |
| darklist.de | Darklist.de IP Blacklist | 🟢 | ↗ |
| DataPlane | SIP Query Source IPs | 🟢 | ↗ |
| DataPlane | SSH Password Auth Source IPs | 🟢 | ↗ |
| DataPlane | SSH Client Source IPs | 🟢 | ↗ |
| DataPlane | SIP Registration Source IPs | 🟢 | ↗ |
| DataPlane | VNC RFB Source IPs | 🟢 | ↗ |
| DataPlane | DNS Recursion Desired | 🟢 | ↗ |
| DataPlane | DNS Recursion Desired IN ANY | 🟢 | ↗ |
| DataPlane | DNS CH TXT version.bind | 🟢 | ↗ |
| DataPlane | SIP Invitation Source IPs | 🟢 | ↗ |
| DataPlane | SMTP Data Source IPs | 🟢 | ↗ |
| DataPlane | SMTP Greet Source IPs | 🟢 | ↗ |
| DataPlane | IP Protocol 41 Source IPs | 🟢 | ↗ |
| DataPlane | Telnet Login Source IPs | 🟢 | ↗ |
| DShield | Top 20 attacking subnets | 🟢 | ↗ |
| Ellio | Firewall Threat List (Community) | 🟢 | ↗ |
| Emerging Threats | Emerging Threats Tor Rules | 🟢 | ↗ |
| Emerging Threats | Emerging Threats Block IPs | 🟢 | ↗ |
| Emerging Threats | ET compromised hosts (includes openbl/bruteforceblocker/sidreporter) | 🟢 | ↗ |
| Emerging Threats | ET Spamhaus DROP blocklist (PIX/ACL format) | 🟢 | ↗ |
| Emerging Threats | ET DShield top 20 attackers (PIX/ACL format) | 🟢 | ↗ |
| etnetera.cz | Etnetera aggressive IP blocklist (Czech ISP security team) | 🟢 | ↗ |
| Firehol | Firehol Level 1 Blocklist (netset) | 🟢 | ↗ |
| Github | Fox-IT Cobalt Strike Servers | 🟢 | ↗ |
| GPF Comics | IPs that attacked GPF Comics (spam/exploits/scans) | 🟢 | ↗ |
| GraphiclineWeb | Universally banned IPs (spiders/spambots/hackers/harvesters) | 🔴 | ↗ |
| GreenSnow.co | Bruteforce/scan/exploit attacking IPs | 🟢 | ↗ |
| GriffinGuard | GriffinGuard Abuse 7-day Top 10K | 🔴 | ↗ |
| home.nuug.no | POP3 Gropers | 🟢 | ↗ |
| iBlocklist.com | Open Proxies IPs (without TOR) | 🟢 | ↗ |
| iBlocklist.com | Known malicious Spyware and Adware IP ranges | 🟢 | ↗ |
| iBlocklist.com | Hijacked IP-Blocks and known Spam delivery ranges | 🟢 | ↗ |
| iBlocklist.com | Web server hack and exploit attempt IPs | 🟢 | ↗ |
| iBlocklist.com | Suspicious IPs under investigation | 🟢 | ↗ |
| iBlocklist.com | Advertising trackers and bad/intrusive sites | 🟢 | ↗ |
| iBlocklist.com | Hostile web spiders | 🟢 | ↗ |
| iBlocklist.com | Known hackers and DShield reported IPs | 🟢 | ↗ |
| iBlocklist.com | Forum spam IPs | 🟢 | ↗ |
| iBlocklist.com | CruzIT compromised machines scanning for vulnerabilities | 🟢 | ↗ |
| iBlocklist.com | Spamhaus DROP list (p2p format) | 🟢 | ↗ |
| iBlocklist.com | SpyEye tracker abuse.ch IP blocklist | 🟢 | ↗ |
| iBlocklist.com | Palevo tracker abuse.ch IP blocklist | 🟢 | ↗ |
| iBlocklist.com | CIArmy malicious IPs (Sentinel network) | 🟢 | ↗ |
| iBlocklist.com | Malc0de malware distribution IPs (last 30 days) | 🟢 | ↗ |
| iBlocklist.com | Tor / Onion Router IP addresses | 🟢 | ↗ |
| iBlocklist.com | IP ranges sharing child pornography in p2p community | 🟢 | ↗ |
| ipspamlist | IP Spam List | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 1 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 2 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 3 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 4 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 5 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 6 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 7 | 🟢 | ↗ |
| IPsum | Malicious and/or suspicious IP addresses – Level 8 | 🟢 | ↗ |
| IPsum | IPsum combined threat feed – all blacklists merged with occurrence count | 🟢 | ↗ |
| James Brine | Daily malicious IPs from honeypots (SSH/FTP/RDP/GIT/SNMP/REDIS) | 🟢 | ↗ |
| MalSilo | MalSilo IPv4 List | 🟢 | ↗ |
| Maltrail | Maltrail Mass Scanner IPs | 🔴 | ↗ |
| mthcht | VPN NordVPN IPs | 🔴 | ↗ |
| mthcht | VPN SurfShark IPs | 🟢 | ↗ |
| mthcht | VPN MullVad IPs | 🟢 | ↗ |
| mthcht | VPN ProtonVPN IPs | 🟢 | ↗ |
| MyIP.ms | Web bot IPs identified in last 10 days | 🟢 | ↗ |
| MyIP.ms | Full blacklist database (ZIP) | 🟢 | ↗ |
| NETSHIELD | Active IP Blacklist – Score ≥65 last 30 days (firewall recommended) | 🟢 | ↗ |
| NETSHIELD | IP Blacklist – Score ≥40 extended rules | 🔴 | ↗ |
| NETSHIELD | Combined Threat Blacklist – 180-day window for SIEM/audit | 🔴 | ↗ |
| NETSHIELD | Watchlist – Score 25-39 monitoring only | 🟢 | ↗ |
| NETSHIELD | CVE exploit and active C2 server IPs (daily) | 🟢 | ↗ |
| NETSHIELD | Honeypot-confirmed attacker IPs (daily) | 🟢 | ↗ |
| NETSHIELD | HoneyDB community honeypot IPs (API) | 🔴 | ↗ |
| NETSHIELD | Bot and scanner IPs (daily) | 🟢 | ↗ |
| NETSHIELD | AbuseIPDB top reported IPs Score ≥50 (API) | 🔴 | ↗ |
| NETSHIELD | High-risk ASN blocklist Score ≥50 | 🔴 | ↗ |
| opsxcq | Open Proxy List | 🟢 | ↗ |
| pan-unit42 | DiamondFox Panels | 🟢 | ↗ |
| ProjectHoneypot.org | Email harvesters (RSS feed) | 🟢 | ↗ |
| ProjectHoneypot.org | Spam servers (RSS feed) | 🟢 | ↗ |
| ProjectHoneypot.org | Bad web hosts (RSS feed) | 🟢 | ↗ |
| ProjectHoneypot.org | Comment spammers (RSS feed) | 🟢 | ↗ |
| ProjectHoneypot.org | Directory/dictionary attackers (RSS feed) | 🟢 | ↗ |
| SANS ICS | SANS ICS Intel Feed – community threat indicators | 🟢 | ↗ |
| SANS ICS / DShield | DShield suggested IP blocklist | 🟢 | ↗ |
| Sblam | Sblam Spam Comment IPs | 🟢 | ↗ |
| SecOps-Institute | Tor Nodes List | 🟢 | ↗ |
| SecOps-Institute | Tor Exit Nodes List | 🟢 | ↗ |
| SentinelPhishFeed | Malicious IP address feed | 🟢 | ↗ |
| snort.org | ip-block-list | 🟢 | ↗ |
| socks-proxy.net | Open SOCKS proxies | 🟢 | ↗ |
| Spamhaus | Spamhaus DROP List (legacy txt) | 🟢 | ↗ |
| SpamHaus | Extended DROP list – ASNs (eDROP) | 🟢 | ↗ |
| Spamhaus Project | Don't Route Or Peer (DROP) List | 🟢 | ↗ |
| spydisec | High Confidence IP Blocklist – confirmed by 5+ independent sources (~5K IPs) | 🟢 | ↗ |
| spydisec | High Confidence IP Blocklist – validated by 3+ independent sources (unlimited) | 🟢 | ↗ |
| spydisec | Medium Confidence IP Blocklist – corroborated by 2+ sources (~25K IPs) | 🟢 | ↗ |
| spydisec | Medium Confidence IP Blocklist – corroborated by 2+ sources (unlimited) | 🟢 | ↗ |
| spydisec | Low Confidence IP Blocklist – single source reports (use with caution) | 🟢 | ↗ |
| spydisec | Full Research IP Blocklist (all tiers combined) | 🟢 | ↗ |
| spydisec | Permanent append-only IP Blocklist archive | 🟢 | ↗ |
| SSLProxies.org | Open SSL proxies | 🟢 | ↗ |
| StopForumSpam | Forum Spammer IPs – 90 days (zip) | 🟢 | ↗ |
| StopForumSpam | Forum Spammer IPs – 180 days (zip) | 🟢 | ↗ |
| StopForumSpam | Forum Spammer IPs – 1 day (zip) | 🟢 | ↗ |
| StopForumSpam | Forum Spammer IPs – 7 days (zip) | 🟢 | ↗ |
| StopForumSpam | Forum Spammer IPs (last 1 day) | 🟢 | ↗ |
| StopForumSpam | Forum Spammer IPs – 30 days (zip) | 🟢 | ↗ |
| StopForumSpam | Toxic IPs CIDR | 🟢 | ↗ |
| StopForumSpam | Banned IPs – all time (ZIP) | 🟢 | ↗ |
| StopForumSpam | Forum spammer IPs – last 365 days (ZIP) | 🟢 | ↗ |
| StopForumSpam | Forum spammer IPs – last 180 days ALL (ZIP) | 🟢 | ↗ |
| threatview.io | OSINT IOCs from Twitter and Pastebin | 🟢 | ↗ |
| threatview.io | High Confidence Cobalt Strike C2 Feed | 🟢 | ↗ |
| threatview.io | IP High Confidence Feed | 🟢 | ↗ |
| TorProject | Tor Exit Addresses (TorProject official) | 🟢 | ↗ |
| Turris | Turris Greylist – IPs observed attacking Turris routers | 🔴 | ↗ |
| Ultimate-Hosts-Blacklist | Ultimate Hosts Blacklist IPs | 🟢 | ↗ |
| X4BNet | VPN IPs | 🟢 | ↗ |
| Yoyo | Yoyo Ad Server IPs | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | The host file contains Payload delivery domains and Botnet C2 domains (last 6 months) | 🔴 | ↗ |
| Botvrij.eu | Blacklist Domain | 🟢 | ↗ |
| C2IntelFeeds | C2 domain list – 30 day filter abused | 🟢 | ↗ |
| C2IntelFeeds | C2 domains with URLs – 30 day filter abused | 🟢 | ↗ |
| C2IntelFeeds | C2 domains with URLs – filter abused | 🟢 | ↗ |
| C2IntelFeeds | C2 domains with URL and IP – 30 day filter abused | 🟢 | ↗ |
| C2IntelFeeds | C2 domains list | 🟢 | ↗ |
| CERT-PL | List of malicious domains in Poland (txt) | 🟢 | ↗ |
| Cert.PL | Malicious Domains | 🟢 | ↗ |
| elliotwutingfeng | Inversion DNSBL – scam and phishing domains | 🟢 | ↗ |
| hagezi | DNS Pro Blocklist – comprehensive DNS blocklist (ads, tracking, malware, phishing) | 🔴 | ↗ |
| hagezi | DNS Pro++ Blocklist – more aggressive version of Pro list | 🔴 | ↗ |
| jarelllama | Scam Blocklist – phishing and scam domains (wildcard format) | 🟢 | ↗ |
| MalSilo | MalSilo Domain List | 🟢 | ↗ |
| phishdestroy | PhishDestroy blocklist – phishing and malicious domains | 🟢 | ↗ |
| SentinelPhishFeed | Phishing and malware domains feed | 🟢 | ↗ |
| shreshtait.com | Newly Registered Domains – 1 month | 🟢 | ↗ |
| shreshtait.com | Newly Registered Domains – 1 week | 🟢 | ↗ |
| spydisec | Malicious Domains Blocklist | 🟢 | ↗ |
| spydisec | Spam/Scam/Abuse Domains Blocklist | 🟢 | ↗ |
| spydisec | Ads and Tracking Domains Blocklist | 🟢 | ↗ |
| spydisec | Permanent append-only Malicious Domains archive | 🔴 | ↗ |
| threatview.io | Domain High Confidence Feed | 🟢 | ↗ |
| tsirolnik | Spam Domains List | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | Recent Payload delivery and Botnet C2 URLs (ThreatFox) | 🔴 | ↗ |
| Abuse.ch | Recent Malware URLs (URLhaus) | 🔴 | ↗ |
| Abuse.ch | ThreatFox IOCs – Recent (all types) | 🔴 | ↗ |
| APNIC Honeynet | URL Seen in Honeypots | 🟢 | ↗ |
| CriticalPathSecurity | CPS file transfer portal IOCs | 🟢 | ↗ |
| cybercrime-tracker.net | Cybercrime Tracker – All C2s | 🟢 | ↗ |
| cybercrime-tracker.net | Cybercrime Tracker – Gatelist | 🟢 | ↗ |
| ExtSentry | Malicious browser extension IDs (all) | 🟢 | ↗ |
| ExtSentry | Malicious browser extension IDs only | 🟢 | ↗ |
| ExtSentry | Suspicious browser extension IDs only | 🟢 | ↗ |
| ExtSentry | Browser extensions enriched IOC feed (CSV) | 🟢 | ↗ |
| Github | APT Notes CSV | 🟢 | ↗ |
| jeroengui | Phishing URLs – last week community feed | 🟢 | ↗ |
| loldrivers | LOLDrivers | 🟢 | ↗ |
| LOLOLFarm | LOLOLFarm | 🟢 | ↗ |
| LOTS | Living Off Trusted Sites | 🔴 | ↗ |
| MalSilo | MalSilo URL List | 🟢 | ↗ |
| MISP Abuse.ch | MISP Abuse.ch URLhaus | 🔴 | ↗ |
| MISP Project | MISP Default Feeds (metadata) | 🟢 | ↗ |
| OpenPhish | Phishing URLs | 🟢 | ↗ |
| Phishing Army | Phishing Army Blocklist | 🟢 | ↗ |
| Phishing Army | Phishing Army Blocklist Extended | 🟢 | ↗ |
| PhishTank | PhishTank Online Valid Phishing | 🟢 | ↗ |
| PhishTank | PhishTank Online Valid Phishing (CSV) | 🟢 | ↗ |
| SentinelPhishFeed | Phishing URLs feed (auto-updated multiple times daily) | 🟢 | ↗ |
| threatview.io | URL High Confidence Feed | 🟢 | ↗ |
| urlabuse | URL Abuse Blacklist Feed | 🔴 | ↗ |
| urlabuse | Malware URL Feed | 🔴 | ↗ |
| urlabuse | Phishing URL Feed | 🔴 | ↗ |
| urlabuse | Hacked URL Feed | 🔴 | ↗ |
| urlabuse | URL Abuse DB – Latest 500 entries (CSV) | 🔴 | ↗ |
| UrlHaus | UrlHaus_misp ASN feeds | 🟢 | ↗ |
| VXVault | VXVault Malware URL List | 🟢 | ↗ |
| VXVault | VXVault URL List | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | MD5 hashes – Recent additions (MalwareBazaar) | 🔴 | ↗ |
| Abuse.ch | MD5 hashes – Recent malicious files on C2 (ThreatFox) | 🔴 | ↗ |
| Botvrij.eu | IOC List MD5 | 🟢 | ↗ |
| cybercrime-tracker.net | Cybercrime Tracker – Hash List | 🟢 | ↗ |
| malshare.com | Malshare Current All | 🟢 | ↗ |
| threatview.io | MD5 Hash Blocklist | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | SHA1 hashes – Recent additions (MalwareBazaar) | 🔴 | ↗ |
| Botvrij.eu | IOC List SHA1 | 🟢 | ↗ |
| threatview.io | SHA File Hash Feed | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | SHA256 hashes – Recent additions (MalwareBazaar) | 🔴 | ↗ |
| Abuse.ch | SHA256 hashes – Recent malicious files on C2 (ThreatFox) | 🔴 | ↗ |
| Botvrij.eu | IOC List SHA256 | 🟢 | ↗ |
| ExtSentry | Browser extension CRX SHA-256 file hashes | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | SSL Certificate Blacklist | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Abuse.ch | JA3 Fingerprints Blacklist | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| CISA | Known Exploited Vulnerabilities Catalog (CSV) | 🟢 | ↗ |
| CISA | Known Exploited Vulnerabilities Catalog (JSON) | 🟢 | ↗ |
| eCrimeLabs | Vulnerabilities with Metasploit exploit available | 🟢 | ↗ |
| NIST | National Vulnerability Database CVEs | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| ransomware.live | All ransomware victims on leak sites | 🔴 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| abuse.ch | MalwareBazaar MISP feed (hashes + metadata) | 🔴 | ↗ |
| abuse.ch | ThreatFox MISP feed (IOCs) | 🔴 | ↗ |
| Botvrij.eu | Botvrij.eu OSINT MISP feed | 🟢 | ↗ |
| MISP CIRCL | MISP CIRCL OSINT Feed – Hashes | 🟢 | ↗ |
| MISP Feed CERT-FR | MISP Feed CERT-FR Hashes | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| mthcht | Offensive Tools detection patterns | 🟢 | ↗ |
| mthcht | Greyware Tools detection patterns | 🟢 | ↗ |
| mthcht | AV signatures keywords | 🟢 | ↗ |
| mthcht | Suspicious Named pipes | 🟢 | ↗ |
| mthcht | Suspicious Windows Services | 🟢 | ↗ |
| mthcht | Suspicious Windows Tasks | 🟢 | ↗ |
| mthcht | Suspicious destination port | 🟢 | ↗ |
| mthcht | Suspicious Firewall rules | 🔴 | ↗ |
| mthcht | Suspicious User-agent | 🟢 | ↗ |
| mthcht | Suspicious USB Ids | 🟢 | ↗ |
| mthcht | Suspicious mutex names | 🟢 | ↗ |
| mthcht | Suspicious MAC address | 🟢 | ↗ |
| mthcht | Suspicious Hostname | 🟢 | ↗ |
| mthcht | Microsoft App IDs List (BEC Detection) | 🟢 | ↗ |
| mthcht | Metadata Executables | 🔴 | ↗ |
| mthcht | DNS over HTTPS server list | 🟢 | ↗ |
| mthcht | Dynamic DNS domains list | 🟢 | ↗ |
| mthcht | Sinkholed Domains | 🟢 | ↗ |
| mthcht | Hijacklibs | 🟢 | ↗ |
| mthcht | LOLDriver List | 🟢 | ↗ |
| mthcht | Malicious Bootloader List | 🟢 | ↗ |
| mthcht | Malicious SSL Certificates List | 🟢 | ↗ |
| mthcht | Ransomware known file extensions | 🟢 | ↗ |
| mthcht | Ransomware known file name ransom notes | 🟢 | ↗ |
| mthcht | Windows ASR rules | 🟢 | ↗ |
| mthcht | GeoIP services Lists | 🟢 | ↗ |
| rosti.bin | Public threat intelligence reports feed | 🟢 | ↗ |
| SentinelPhishFeed | File hash IOCs (MD5/SHA) | 🟢 | ↗ |
| threatview.io | Bitcoin Address Intel | 🟢 | ↗ |
| tweetfeed.live | IOCs shared by infosec community on Twitter – Today (IP/URL/DNS/Hash) | 🟢 | ↗ |
| tweetfeed.live | IOCs shared by infosec community on Twitter – Week (IP/URL/DNS/Hash) | 🟢 | ↗ |
| tweetfeed.live | IOCs shared by infosec community on Twitter – Month (IP/URL/DNS/Hash) | 🟢 | ↗ |
| tweetfeed.live | IOCs shared by infosec community on Twitter – Year (IP/URL/DNS/Hash) | 🟢 | ↗ |
| WSTNPHX | Email addresses used by malware | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| iBlocklist.com | Level 1 – anti-p2p companies/media/government/legal ranges | 🟢 | ↗ |
| iBlocklist.com | Level 2 – corporate/labs/proxy ranges | 🟢 | ↗ |
| iBlocklist.com | Level 3 – paranoid list (portals/ISPs/unusual ranges) | 🟢 | ↗ |
| iBlocklist.com | Yoyo.org ad servers (p2p format) | 🟢 | ↗ |
| iBlocklist.com | Educational Institution IPs | 🟢 | ↗ |
| iBlocklist.com | Microsoft IP ranges | 🟢 | ↗ |
| iBlocklist.com | IANA Reserved IPs | 🟢 | ↗ |
| iBlocklist.com | IANA Private IPs | 🟢 | ↗ |
| iBlocklist.com | IANA Multicast IPs | 🟢 | ↗ |
| iBlocklist.com | IP blocklist for non-LAN computers | 🟢 | ↗ |
| iBlocklist.com | Exclusions list | 🟢 | ↗ |
| iBlocklist.com | Apple IPs | 🟢 | ↗ |
| iBlocklist.com | LogMeIn IPs | 🟢 | ↗ |
| iBlocklist.com | Steam IPs | 🟢 | ↗ |
| iBlocklist.com | XFire IPs | 🟢 | ↗ |
| iBlocklist.com | Blizzard IPs | 🟢 | ↗ |
| iBlocklist.com | Ubisoft IPs | 🟢 | ↗ |
| iBlocklist.com | Nintendo IPs | 🟢 | ↗ |
| iBlocklist.com | Activision IPs | 🟢 | ↗ |
| iBlocklist.com | Sony Online Entertainment IPs | 🟢 | ↗ |
| iBlocklist.com | Crowd Control Productions IPs | 🟢 | ↗ |
| iBlocklist.com | Linden Lab IPs | 🟢 | ↗ |
| iBlocklist.com | Electronic Arts IPs | 🟢 | ↗ |
| iBlocklist.com | Square Enix IPs | 🟢 | ↗ |
| iBlocklist.com | NCsoft IPs | 🟢 | ↗ |
| iBlocklist.com | Riot Games IPs | 🟢 | ↗ |
| iBlocklist.com | Punkbuster IPs | 🟢 | ↗ |
| iBlocklist.com | Joost IPs | 🟢 | ↗ |
| iBlocklist.com | Pandora IPs | 🟢 | ↗ |
| iBlocklist.com | The Pirate Bay IPs | 🟢 | ↗ |
| iBlocklist.com | AOL IPs | 🟢 | ↗ |
| iBlocklist.com | Comcast IPs | 🟢 | ↗ |
| iBlocklist.com | Cablevision IPs | 🟢 | ↗ |
| iBlocklist.com | Verizon IPs | 🟢 | ↗ |
| iBlocklist.com | AT&T IPs | 🟢 | ↗ |
| iBlocklist.com | Cox Communications IPs | 🟢 | ↗ |
| iBlocklist.com | Time Warner Cable IPs | 🟢 | ↗ |
| iBlocklist.com | Charter IPs | 🟢 | ↗ |
| iBlocklist.com | Qwest IPs | 🟢 | ↗ |
| iBlocklist.com | Embarq IPs | 🟢 | ↗ |
| iBlocklist.com | Suddenlink IPs | 🟢 | ↗ |
| iBlocklist.com | Sprint IPs | 🟢 | ↗ |
| Ngosang | BitTorrent Trackers IP List | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| 0x4D31 | Awesome Threat Detection | 🟢 | ↗ |
| Avast | Avast IOC repository | 🟢 | ↗ |
| Bert-JanP | Open Source Threat Intel Feeds | 🟢 | ↗ |
| Bert-JanP | KQL Hunting Queries | 🟢 | ↗ |
| Black Lotus Labs | Black Lotus Labs IOC repository | 🟢 | ↗ |
| blackorbird | APT Report IOC repository | 🟢 | ↗ |
| blocklistproject | Block Lists – comprehensive domain blocklists (ads, malware, phishing, ransomware, scam) | 🟢 | ↗ |
| BushidoUK | Tools used by Russian APT | 🟢 | ↗ |
| Cisco Talos | Cisco Talos IOC repository | 🟢 | ↗ |
| DoctorWeb | Dr.Web malware IOC repository | 🟢 | ↗ |
| Elastic | Elastic Detection Rules | 🟢 | ↗ |
| Elastic Security Labs | Elastic Security Labs threat indicators repository | 🟢 | ↗ |
| ESET | ESET Malware IOC Repository | 🟢 | ↗ |
| executemalware | Community Malware IOCs (GitHub repo) | 🟢 | ↗ |
| FireHOL | FireHOL blocklist-ipsets — curated IP blocklist collections (multiple sets) | 🟢 | ↗ |
| HarfangLab | HarfangLab IOC repository | 🟢 | ↗ |
| JoeSecurity | JoeSecurity Sigma-Rules | 🟢 | ↗ |
| kraloveckey | FireWALL-E: ipsets-blocklist | 🟢 | ↗ |
| lolc2 | LOLC2 | 🟢 | ↗ |
| LOLESXi-Project | LOLESXI | 🟢 | ↗ |
| mdecrevoisier | SIGMA detection rules | 🟢 | ↗ |
| mthcht | SOC/DFIR detection lists – VPN IPs, Named Pipes, Suspicious Services, Extensions and more | 🟢 | ↗ |
| mthcht | Unit42 IOC by mthcht | 🟢 | ↗ |
| mthcht | Threat Hunting yara rules | 🟢 | ↗ |
| mthcht | Suspicious TLDs | 🟢 | ↗ |
| mthcht | Suspicious ASNs | 🟢 | ↗ |
| mthcht | Maxmind GeoIP Database Extracted | 🟢 | ↗ |
| mthcht | Suspicious CERTs signer | 🟢 | ↗ |
| mthcht | Suspicious Browser Extensions | 🟢 | ↗ |
| mthcht | Phishing domains and urls | 🟢 | ↗ |
| mthcht | Sinkholed servers Domains folder | 🟢 | ↗ |
| mthcht | TOR Nodes Lists folder | 🟢 | ↗ |
| mthcht | RMM detection | 🟢 | ↗ |
| mthcht | Important Roles and groups for AD/EntraID/AWS | 🟢 | ↗ |
| mthcht | DNSTWIST Lists | 🟢 | ↗ |
| mthcht | PROXIES PROXY IP/Port Lists | 🟢 | ↗ |
| mthcht | Companies IP Range Lists (Default) | 🟢 | ↗ |
| mthcht | Companies IP Range Lists (Microsoft) | 🟢 | ↗ |
| mthcht | Microsoft Defender AV signatures lists | 🟢 | ↗ |
| mthcht | Microsoft Defender AV yara rules | 🟢 | ↗ |
| mthcht | ClamAV signatures lists | 🟢 | ↗ |
| mthcht | Others correlation Lists | 🟢 | ↗ |
| mthcht | Sigma Rules by mthcht | 🟢 | ↗ |
| mthcht | ALL TI Reports | 🟢 | ↗ |
| P4T12ICK | Sigma Rule Repository | 🟢 | ↗ |
| Palo Alto Unit42 | Unit42 IOC Repository | 🟢 | ↗ |
| Palo Alto Unit42 | Unit42 Timely Threat Intelligence IOC repository | 🟢 | ↗ |
| Palo Alto Unit42 | Unit42 Threat Intelligence Article IOC repository | 🟢 | ↗ |
| pr0xylife | pr0xylife malware IOC collections (DarkGate, QakBot, Emotet, IcedID and more) | 🟢 | ↗ |
| prodaft | prodaft malware IOC repository | 🟢 | ↗ |
| SecurityScorecard | Public IoCs from SecurityScorecard technical blog posts | 🟢 | ↗ |
| Sekoia | Sekoia Community IOC repository | 🟢 | ↗ |
| Sophos | Sophos Labs IOC repository | 🟢 | ↗ |
| Splunk | Splunk Detections Rules | 🟢 | ↗ |
| The-DFIR-Report | DFIR-Report Sigma-Rules | 🟢 | ↗ |
| ThreatLabz | Zscaler ThreatLabz Ransomware notes | 🟢 | ↗ |
| ThreatMon | ThreatMon Daily C2 Feeds | 🟢 | ↗ |
| tsale | Sigma Rules | 🟢 | ↗ |
| unknownhad | CloudIntel – cloud-specific IOC repository | 🟢 | ↗ |
| Volexity | Volexity Threat Intelligence IOC repository | 🟢 | ↗ |
| vx-underground | Samples and Intelligence Reports | 🟢 | ↗ |
| Zimperium | Zimperium mobile threat IOC repository | 🟢 | ↗ |
| Zscaler ThreatLabz | Zscaler ThreatLabz IOC repository | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| MaxMind | GeoLite2 ASN Database – IP to ASN mapping (requires free license key at maxmind.com) | 🔒 | ↗ |
| MaxMind | GeoLite2 Country Database – IP to Country mapping (requires free license key at maxmind.com) | 🔒 | ↗ |
| osint.bambenekconsulting.com | All current domains belonging to known malicious DGAs (requires license for commercial use) | 🔒 | ↗ |
| osint.bambenekconsulting.com | Domains from High-Confidence DGA-based C&C Domains Actively Resolving (requires license for commercial use) | 🔒 | ↗ |
| osint.bambenekconsulting.com | IPs from High-Confidence DGA-Based C&Cs Actively Resolving (requires license for commercial use) | 🔒 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| DB-IP | DB-IP Country Lite – free IP to Country database (monthly updated, fixed URL) | 🟢 | ↗ |
| IP2Location | IP2Location LITE DB1 – IP to Country database (free, no key required) | 🟢 | ↗ |
| IPDeny.com | IPDeny country IP blocks – all zones (tar.gz, updated daily) | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| CERT-UA | CERT UA RSS Feed | 🟢 | ↗ |
| Checkpoint | Checkpoint Research Feed | 🟢 | ↗ |
| CISA | CISA Cybersecurity Advisories | 🟢 | ↗ |
| Cisco | Talos Intelligence Feed | 🟢 | ↗ |
| Google Threat Intelligence Feed | 🟢 | ↗ | |
| Kaspersky | Securelist APT Attacks Feed | 🟢 | ↗ |
| Microsoft | Microsoft Threat Intel Feed | 🟢 | ↗ |
| Palo Alto | Unit42 Threat Intel RSS | 🟢 | ↗ |
| TheDFIRReport | The DFIR Report Feed | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| andreacristaldi | APTMAP (APT Tracker) | 🟢 | ↗ |
| MITRE | MITRE ATT&CK Matrix Navigator | 🟢 | ↗ |
| MITRE | CVE Vulnerability Database | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| Censys | Censys OSINT Search | 🟢 | ↗ |
| CyberGordon | CyberGordon URL Reputation | 🟢 | ↗ |
| Pulsedive | Pulsedive Threat Intelligence | 🟢 | ↗ |
| Shodan | Shodan OSINT Search | 🟢 | ↗ |
| ThreatMiner | ThreatMiner Data Mining | 🔴 | ↗ |
| URLScan | URLScan Website Scanner | 🟢 | ↗ |
| Vendor | Description | Status | URL |
|---|---|---|---|
| AnyRun | Any.Run Interactive Sandbox | 🟢 | ↗ |
| JoeSecurity | JoeSandbox | 🔴 | ↗ |
| Triage | Triage Malware Sandbox | 🟢 | ↗ |
-
Add a row to
threat-intelligence-feeds.csv:Vendor;Description;Category;Url -
Choose the right category — see the table above for descriptions. Key rules:
- Feed must have a direct, machine-readable URL (raw text, CSV, JSON) — if not, use
REPO. - If the feed requires registration or an API key, use
RESTRICTEDand note it in the Description. Status will be shown as 🔒 and the URL will not be checked automatically. - If it's a GitHub repository without a direct machine-readable URL, use
REPO. Status will be checked automatically (🟢 if reachable, 🔴 if deleted/unavailable). - If the feed contains mixed IOC types (IP + domain + hash in one file), use
IOC. - If it's a general ISP / ASN / ad-tracker blocklist (not malware-specific), use
BLOCKLIST. - If it's an IP geolocation database (country/ASN mapping, not malicious IPs), use
GEOIP. - If it's an RSS/Atom threat intelligence feed from a vendor or CERT, use
RSS. - If it's a framework, matrix or tracking tool (MITRE, APT maps), use
FRAMEWORK. - If it's an OSINT investigation platform (Shodan, Censys, URLScan), use
OSINT. - If it's an online malware sandbox, use
SANDBOX.
- Feed must have a direct, machine-readable URL (raw text, CSV, JSON) — if not, use
-
Free and publicly accessible feeds without registration are preferred.
RESTRICTEDfeeds are accepted if they are well-known and valuable. -
Validate before opening a PR:
cd scripts python3 tif-validator.py python3 tif-update-readme.py -
Open a Pull Request with a short description of the feed and why it belongs here.
Valid categories: IP DNS URL MD5 SHA1 SHA256 SSL JA3 CVEID RANSOMWARELEAK MISP IOC BLOCKLIST REPO RESTRICTED GEOIP RSS FRAMEWORK OSINT SANDBOX.