Resources
Docs, research and support
API reference, threat research, playbooks and service status in one place.
255
Articles
9
Playbooks
78
Glossary terms
Resource categories
Evaluate
Evaluation paths
Threat Intelligence API
Lookup, bulk and streaming endpoints, SDKs and rate limits.
IP & Domain Reputation
IP, domain and URL lookups, the threat database and blocklists.
CVE & Ransomware Intelligence
CVE search with EPSS and KEV context, and ransomware group tracking.
Data Feeds & Integrations
STIX/TAXII feeds and connectors for SIEM, SOAR and CTI platforms.
Read
Recommended reading
Buyer Guide
Threat API Comparison
Evaluate API-first threat intelligence options.
IP Reputation
Check IP Reputation
Reduce false positives in lookup workflows.
CVE Intel
CVE Lifecycle Guide
Prioritize vulnerabilities with better context.
- Threat HuntingLiving-off-the-Land AttacksSpot abuse of trusted administrative tools.
- DNS SecurityDNS Hardening GuideStrengthen resolver, zone, and monitoring controls.
- AutomationThreat Classification with MLRoute noisy indicators into useful risk signals.
- IndustryConnected Car SecurityUnderstand automotive cyber exposure patterns.
Reference
Practitioner index
Playbooks
Ingest Threat Intelligence over TAXII Without Vendor ToolsCVE Prioritization with KEV, EPSS, and isMaliciousLightweight Reputation Checks vs Full Threat AnalysisAutomating Malicious IP and Domain Blocklist DownloadsBulk IOC Triage with the isMalicious Batch APIPhishing Domain Detection with Typosquatting AnalysisBlocking Malicious IPs with Firewall AutomationEnriching SIEM Alerts with isMalicious Threat IntelDetecting C2 Beacons with YARA Rules
Core definitions
IOC (Indicator of Compromise)EPSS (Exploit Prediction Scoring System)CVSS (Common Vulnerability Scoring System)CVE (Common Vulnerabilities and Exposures)KEV (CISA Known Exploited Vulnerabilities)C2 (Command and Control)STIX (Structured Threat Information Expression)TAXII (Trusted Automated eXchange of Intelligence Information)SSVC (Stakeholder-Specific Vulnerability Categorization)Threat ActorThreat HuntingWHOISFast FluxTyposquattingOpenCTIBulk APIStreaming Threat FeedFalse NegativeLateral MovementDGA (Domain Generation Algorithm)Prompt Injection
Firewall, DNS and SIEM setup guides
Load isMalicious lists into the firewall, resolver or SIEM your team already runs.
FortiGate threat feedPalo Alto EDL blocklistpfSense malicious IP blocklistOPNsense blocklistMikroTik adlist blocklistLinux firewall IP blocklistPi-hole malware blocklistAdGuard Home blocklistSplunk threat intelligence lookupsElastic Security TAXII threat feedWazuh threat intelligence CDB listsSuricata dataset blocklistQRadar reference set of malicious IPs
What to do now: scam and phishing guides
I clicked a phishing link: what to do nowI entered my password on a phishing site: what to do nowSextortion email demanding bitcoin: what to doGot a scam call or text message? What to do nowBefore you send crypto: how to spot the scamSuspicious email attachment: check the file before you open itIs this website legit? How to spot a fake shop or lookalike domainTech support scam pop-up: what to do nowQR code phishing (quishing): what to doFake invoice or changed bank details: what to do before you pay
Have questions?
Sales, support or partnerships. We usually reply within one business day.