Database
Threat intelligence database
Malicious IPs, domains and cyberthreat data from commercial, open-source and community sources
Free plan · 50 requests per month · no credit card
By the numbers
Counters unavailable. No estimated volumes are displayed.
Coverage
What the database holds. And how each category reaches you.
| Category | Delivered as |
|---|---|
| Malicious IPsAddresses tied to malware, phishing, botnets, brute force and abuse, with ASN and country. | GET /checkmalicious-ipsblocklist-ips-all.txt |
| Malicious domainsPhishing, malware, scam, adware and tracking domains, with WHOIS and DNS context. | GET /checkmalicious-domainsblocklist-domains-all.txt |
| PhishingCredential-theft pages and brand lookalikes from OpenPhish, Phishing.Database and others. | GET /checkphishing-indicatorsblocklist-domains-phishing.txt |
| MalwareMalware hashes, payload hosts and C2 servers from MalwareBazaar, ThreatFox and URLhaus. | GET /checkmalicious-file-hashesblocklist-domains-malware.txt |
| Tracking and adsTracker and ad domains for privacy filtering at the DNS level. | blocklist-domains-tracking.txtblocklist-domains-ads.txt |
| VulnerabilitiesCVE records with CVSS and EPSS scores, through the CVE API. | GET /cve/{id}GET /cve/recent |
Access
Three ways in. Same corpus, your format.
Data sources in the corpus
Distinct sources with at least one indicator in the corpus at the last nightly rebuild, and some of the providers behind them.
| Source | Type |
|---|---|
| AbuseIPDB | ip |
| URLhaus | url |
| Community IOC feeds | mixed |
| IsMalicious | multi |
Use cases
Where teams plug it in.
- 01
Firewall and IDS/IPS
Block listed IPs at the network perimeter.
- 02
SIEM enrichment
Add sources and confidence to security events.
- 03
Email security
Check sender domains and links before delivery.
- 04
Incident response
Validate IOCs during an investigation.
FAQ
Frequently asked questions.
What types of threats does the database include?
Malicious IPs, domains, URLs and file hashes: phishing, malware, botnet and C2 infrastructure, ransomware, scams, adware and tracking. CVE records come through a separate API.
How often is the database updated?
Lookups run at request time. Blocklist files rebuild every 12 hours, and STIX/TAXII collections nightly from 02:00 UTC.
Is there a free tier?
Yes: 50 API requests per month, a burst of 60 per minute and a free API key. No credit card.
Can I export blocklists?
Yes. Without a key or on Free, every list returns a 10% sample. Paid plans get the full lists in plain, hosts, dnsmasq or AdGuard format.
Where does the data come from?
From commercial, open-source and community sources. Each source is weighted by reliability, and results show where sources agree or conflict.
Start with a free key.
50 requests per month. No credit card.
Explore