Skip to main content

Data Products

Threat data for the tools you already run.

IP, domain, URL and hash indicators, rebuilt every night from 591 sources with at least one indicator in the corpus. By API, STIX/TAXII or plain-text file.

Create free accountData Documentation

Free API key · 50 requests per month · no credit card

By the numbers

29M+

Indexed indicators

Records counted in the indicator corpus.

591

Sources in the corpus

Distinct sources with at least one indicator in the corpus; not customer references.

484K+

Additions today

Records added to the corpus today.

58%

Multiple-source records

Share of records listed by two or more sources.

Counters read at 2026-10-17T06:24:17.983Z. Indicator dates vary by source.

Datasets

Pick a dataset. Each page lists its formats and access.

Threat Feeds

Test our indicators in OpenCTI, MISP, a SIEM or a firewall before you integrate.

Ransomware Tracker

Ransomware groups, victims, and IOCs.

IP & Domain Blocklists

Plain-text, hosts, dnsmasq and AdGuard lists for firewalls and DNS resolvers.

STIX/TAXII

STIX 2.1 indicators over TAXII 2.1, rebuilt every night.

C2 Feeds

Command-and-control IPs and domains, as a TAXII collection and a blocklist.

Phishing URLs

Phishing URLs and domains, as a TAXII collection and a blocklist.

Malware Hashes

MD5, SHA-1 and SHA-256 hashes of known malware samples.

Delivery

One corpus, four ways in. Pick the format your tool reads.

MethodFormatRefreshAccess
Lookup APIJSON over HTTPSLive index, per requestEvery plan · Free: 50 requests per month
Blocklist filesTXT · hosts · dnsmasq · AdGuardRebuilt every 12 hFree: 10% sample · full lists on paid plans
STIX/TAXII feedsSTIX 2.1 over TAXII 2.1Rebuilt nightly from 02:00 UTCPro (€99/month) and Enterprise

Custom data

Need a custom feed?

Tell us the indicator types, format and volume you need.

Contact Sales
Explore

Related pages to go further.

Threat DatabaseBrowse coverage, sources, and indicator volumeIP & Domain BlocklistsFirewall-ready IP and domain listsSTIX / TAXIIStandards-based feeds for CTI platforms