STIX 2.1 over TAXII 2.1
IP, domain, URL and hash collections for authenticated Pro and Enterprise clients.
Data products
Threat Feeds Compare external indicators with your current sources
For SOC, MDR and MSSP teams testing our indicators in OpenCTI, MISP, a SIEM or a firewall.
Evaluate a feed in my tool
Pro €99/month · Enterprise on quote · not in Free · TAXII polling does not use your request quota
GET/downloads/blocklist/blocklist-domains-all.txt
# IsMalicious.com Blocklist - Domains (All Levels)# Format: Plain# Generated: 2026-10-14T09:36:11.726735279+00:00# Total entries: 18401486# Update frequency: every 12 hours# Category: All# Threat level: All Levels# Website: https://ismalicious.com# © 2026 IsMalicious (compilation). Licensed to the downloading account under https://ismalicious.com/terms; redistribution of the compilation prohibited. Third-party entries remain under their providers' licences — see https://ismalicious.com/sources.6268aa.comamericanairlknes.com.rucasino-9av.buzzvirginiabeachantiquecom-any.com
18 401 486 entriesplain text · one entry per linegenerated 6 hr. ago
Download the free sample (1 840 148 entries)10 % of the list · no account needed
Same family, other types
- blocklist-ips-all.txt8 594 722 entriesFree sample
- blocklist-urls-all.txt1 348 282 entriesFree sample
- blocklist-hashes-all.txt3 882 205 entriesFree sample
By the numbers
Recent feed statistics
Inspect the returned data and collection metadata before integrating.
Current data sample
public samplepublic sample
29 664 755
Total threats
20 199 036
Malicious domains
9 465 719
Malicious IPs
591
Sources in the corpus
By the numbersUpdated Oct 14, 15:29 UTC · Counters read at 2026-10-14T16:00:10.370Z. Indicator dates vary by source.public sample
Evaluate a feed in my tool
No credit card required · Free: a 10% sample of each list · full lists on paid plans
Evaluation
Test a feed in 14 days. In a test collection, before production rules.
- 01
Scope
Pick an indicator type, a target tool and a success criterion.
- 02
Import
Load a test collection. Count the objects your tool accepts, not those returned.
- 03
Sync again
Re-poll with added_after. Record duplicates and newly imported objects.
- 04
Review the evidence
Compare matches, check a sample of new hits and log false positives.
- Transport
- TAXII 2.1
- Object format
- STIX 2.1
- Access
- Pro / Enterprise
- Incremental filter
- added_after
Capabilities
Signals for your investigation, with their context.
Nightly rebuild
Shared collections rebuild from 02:00 UTC. Polling more often returns the same set.
Incremental pulls
Pick collections, pass added_after and follow the next token.
Three formats
STIX over TAXII, plain-text blocklists, or JSON from the lookup API.
Coverage to compare
Run a sample of your indicators against the feed. Coverage varies by type.
Lookup streaming
GET /check/stream sends one indicator's results as they arrive. It is not a collection feed.
Applications
Use cases to evaluate first.
SIEM enrichment
Import indicators into Splunk, Elastic or Sentinel.
Firewall rules
Test list size and false positives before you turn on blocking.
Threat hunting
Search your logs for indicators from the feed.
Security research
Track how indicators appear and age across sources.
FAQ
Frequently asked questions.
How do collection rebuilds differ from polling?
The shared corpus rebuilds nightly from 02:00 UTC; your client decides when to read it. A successful poll does not mean an indicator was just observed. Check the dates in the response.
How can I consume the indicators?
STIX 2.1 over TAXII 2.1 on Pro and Enterprise. Blocklist files and the JSON lookup API cover other tools. The SSE endpoint streams one lookup, not collection changes.
Can I limit the import?
Yes. Choose collections, filter with added_after and page with the next token. Agree on volume and retention during the evaluation.
How should I evaluate history and freshness?
Read the first-seen and last-seen dates in real responses and compare them with your freshness needs. Collections do not promise a fixed retention period.
Cite this data
Quote these figures credited to isMalicious, with a link to this page so readers can check them at the source.
Attribution text: Source: isMalicious, isMalicious Threat Intelligence Feeds — https://ismalicious.com/data/feeds
Explore
Related tools and pages.
Test it with your own indicators.
Send your current tool, expected volume and decision date. We will scope a test against your existing sources.
Pro €99/month · Enterprise on quote · not in Free · TAXII polling does not use your request quota