Attribution
Where the data comes from
isMalicious aggregates 673 feeds. This page credits each one: who publishes it, under which licence, and where the upstream file lives. It exists because most open licences ask for exactly that, and because a verdict you cannot trace is not evidence.
483 active feeds, 190 retired or disabled entries kept for the record
Licence labels are the registry's reading of each provider's terms on the audit date; the linked upstream page is authoritative. Feeds marked share-alike or attribution carry those obligations into anything we redistribute.
Feeds by provider
FireHOL148
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| FireHOL - Bds Atifinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Bitcoin Nodesinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Bitcoin Nodes 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Bitcoin Nodes 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Bitcoin Nodes 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Apache | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Bots | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Bruteforce | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Ftp | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Imap | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Mail | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Sip | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Ssh | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist De Strongips | not stated | ip | raw.githubusercontent.com |
| FireHOL - Blocklist Net Ua | not stated | ip | raw.githubusercontent.com |
| FireHOL - Botscout | not stated | ip | raw.githubusercontent.com |
| FireHOL - Botscout 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Botscout 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Botscout 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Botvrij Dst | not stated | ip | raw.githubusercontent.com |
| FireHOL - Botvrij Src | not stated | ip | raw.githubusercontent.com |
| FireHOL - Bruteforceblocker | not stated | ip | raw.githubusercontent.com |
| FireHOL - Ciarmy | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cidr Report Bogons | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalkinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk Newinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk New 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk New 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk New 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk Top20inactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk Updatedinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk Updated 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk Updated 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cleantalk Updated 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cta Cryptowallinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Cybercrime | not stated | ip | raw.githubusercontent.com |
| FireHOL - Darklist Deinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Dm Tor | not stated | ip | raw.githubusercontent.com |
| FireHOL - Dshield | not stated | ip | raw.githubusercontent.com |
| FireHOL - Dshield 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Dshield 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Dshield 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Et Block | not stated | ip | raw.githubusercontent.com |
| FireHOL - Et Compromised | not stated | ip | raw.githubusercontent.com |
| FireHOL - Et Dshield | not stated | ip | raw.githubusercontent.com |
| FireHOL - Et Spamhaus | not stated | ip | raw.githubusercontent.com |
| FireHOL - Et Tor | not stated | ip | raw.githubusercontent.com |
| FireHOL - Feodo Badips | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Abusers 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Abusers 30d | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Anonymous | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Level1 | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Level2 | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Level3 | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Level4 | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Proxies | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Webclient | not stated | ip | raw.githubusercontent.com |
| FireHOL - Firehol Webserver | not stated | ip | raw.githubusercontent.com |
| FireHOL - Gpf Comics | not stated | ip | raw.githubusercontent.com |
| FireHOL - Graphiclineweb | not stated | ip | raw.githubusercontent.com |
| FireHOL - Greensnow | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Abuse Palevo | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Abuse Spyeye | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Abuse Zeus | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Ciarmy Malicious | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Cidr Report Bogons | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Cruzit Web Attacks | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Aolinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Attinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Cablevisioninactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Charterinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Comcastinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Embarqinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Qwestinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Sprintinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Suddenlinkinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Twcinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Isp Verizoninactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Malc0de | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Onion Router | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Activisioninactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Appleinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Blizzardinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Crowd Controlinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Electronic Artsinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Joostinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Linden Labinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Logmeininactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Ncsoftinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Nintendoinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Pandorainactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Pirate Bayinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Punkbusterinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Riot Gamesinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Sony Onlineinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Square Enixinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Steaminactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Ubisoftinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Org Xfireinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Pedophiles | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Spamhaus Drop | not stated | ip | raw.githubusercontent.com |
| FireHOL - Iblocklist Yoyo Adservers | not stated | ip | raw.githubusercontent.com |
| FireHOL - Myip | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Commenters | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Commenters 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Commenters 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Commenters 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Dictionary | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Dictionary 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Dictionary 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Dictionary 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Harvesters | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Harvesters 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Harvesters 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Harvesters 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Spammers | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Spammers 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Spammers 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Php Spammers 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Sblam | not stated | ip | raw.githubusercontent.com |
| FireHOL - Socks Proxy | not stated | ip | raw.githubusercontent.com |
| FireHOL - Socks Proxy 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Socks Proxy 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Socks Proxy 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Spamhaus Drop | not stated | ip | raw.githubusercontent.com |
| FireHOL - Spamhaus Edrop | not stated | ip | raw.githubusercontent.com |
| FireHOL - Sslproxies | not stated | ip | raw.githubusercontent.com |
| FireHOL - Sslproxies 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Sslproxies 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Sslproxies 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam 180d | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam 365d | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam 90d | not stated | ip | raw.githubusercontent.com |
| FireHOL - Stopforumspam Toxic | not stated | ip | raw.githubusercontent.com |
| FireHOL - Tor Exits | not stated | ip | raw.githubusercontent.com |
| FireHOL - Tor Exits 1dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Tor Exits 30dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Tor Exits 7dinactive | not stated | ip | raw.githubusercontent.com |
| FireHOL - Vxvault | not stated | ip | raw.githubusercontent.com |
| FireHOL - Yoyo Adservers | not stated | ip | raw.githubusercontent.com |
raw.githubusercontent.com38
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AdAway Default Blocklist | unverified | domain | raw.githubusercontent.com |
| AdAway Hostsinactive | not stated | domain | raw.githubusercontent.com |
| AFAT Malicious IPs Feed | not stated | ip | raw.githubusercontent.com |
| Badd‑Boyz Hosts | unverified | domain | raw.githubusercontent.com |
| CoinBlockerLists All | GPL-3.0 | domain | raw.githubusercontent.com |
| CoinBlockerLists Browser | GPL-3.0 | domain | raw.githubusercontent.com |
| CoinBlockerLists Optionalinactive | not stated | domain | raw.githubusercontent.com |
| Dandelion Sprout Anti‑Malware (AdGuard Home) | unverified | domain | raw.githubusercontent.com |
| Data-Shield IPv4 Blocklist | no commercial grant | ip | raw.githubusercontent.com |
| DeveloperDan Ads & Tracking (extended) | Apache-2.0 | domain | raw.githubusercontent.com |
| DeveloperDan AMP Hosts (extended) | Apache-2.0 | domain | raw.githubusercontent.com |
| DeveloperDan Dating Services (extended)inactive | Apache-2.0 | domain | raw.githubusercontent.com |
| DeveloperDan Hate & Junk (extended) | Apache-2.0 | domain | raw.githubusercontent.com |
| DeveloperDan Tracking Aggressive (extended) | Apache-2.0 | domain | raw.githubusercontent.com |
| Disposable Email Blocklist | unverified | domain | raw.githubusercontent.com |
| FadeMind add.Dead | MIT | domain | raw.githubusercontent.com |
| FadeMind add.Risk | MIT | domain | raw.githubusercontent.com |
| Frellwit’s Swedish Hosts File | GPL-3.0 | domain | raw.githubusercontent.com |
| Infoblox Threat Intelligence | CC-BY-4.0 | mixed | raw.githubusercontent.com |
| IPsum Level 1 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 2 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 3 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 4 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 5 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 6 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 7 | Unlicense | ip | raw.githubusercontent.com |
| IPsum Level 8 | Unlicense | ip | raw.githubusercontent.com |
| Macedonian Pi‑hole Blocklist | not stated | domain | raw.githubusercontent.com |
| Matomo Referrer Spam Blacklist | not stated | domain | raw.githubusercontent.com |
| MMotti Pi‑hole Regexinactive | MIT | domain | raw.githubusercontent.com |
| MontySecurity C2 Trackerinactive | not stated | ip | raw.githubusercontent.com |
| NoCoin Filter List (hosts) | MIT | domain | raw.githubusercontent.com |
| OpenPhish URL List | not stated | url, domain | raw.githubusercontent.com |
| Polish Pi‑hole Filter | unverified | domain | raw.githubusercontent.com |
| Scam Blocklist (DurableNapkin) | MIT | domain | raw.githubusercontent.com |
| Spam404 Online Scams List | not stated | domain | raw.githubusercontent.com |
| ThreatFox IOC IPs | BSD-3-Clause | ip | raw.githubusercontent.com |
| VeleSila yHosts | not stated | domain | raw.githubusercontent.com |
ShadowWhisperer32
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ShadowWhisperer - Ads | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Adultinactive | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Apple Bloat | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Bloatinactive | not stated | domain | raw.githubusercontent.com |
| ShadowWhisperer - Chatinactive | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Cryptocurrency | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Datinginactive | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - DNS | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Dynamic DNS | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Fonts | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Free Hosting | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Gamblinginactive | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Junk | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Malware | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Marketing | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Microsoft Bloat | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Remote Control | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Risk | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Scam | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Shockinactive | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Top Level Domains | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Tracking | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Tunnels | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Typosquatting | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - URL Shorteners | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Ads | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Apple | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Chatinactive | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Fonts | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Microsoft | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Tracking | Unlicense | domain | raw.githubusercontent.com |
| ShadowWhisperer - Wild Tunnel | Unlicense | domain | raw.githubusercontent.com |
Blocklist Project24
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Blocklist Project - Abuse List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Ads List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Crypto List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Drugs List.txtinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Everything List.txtinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Facebook List.txtinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Fraud List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Gambling List.txtinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Malware List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Phishing List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Piracy List.txtinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Porn List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Ransomware List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Redirect List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Scam List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Tiktok List.txtinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Torrent List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project - Tracking List.txt | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project – Crypto | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project – Drugsinactive | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project – Ransomware | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project – Redirect | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project – Tracking | Unlicense | domain | raw.githubusercontent.com |
| Blocklist Project – Vaping | Unlicense | domain | raw.githubusercontent.com |
Hectorm21
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Hectorm - Hmirror - Adaway.org | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Adblock-nocoin-list | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Adguard-simplified | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Anudeepnd-adservers | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Easylist | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Easyprivacy | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Eth-phishing-detectinactive | not stated | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Fademind-add.2o7net | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Fademind-add.dead | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Fademind-add.risk | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Fademind-add.spam | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Kadhosts | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Matomo.org-spammers | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Mitchellkrogza-badd-boyz-hosts | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Pgl.yoyo.org | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Ransomwaretracker.abuse.chinactive | not stated | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Someonewhocares.org | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Spam404.com | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Stevenblack | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Winhelp2002.mvps.org | MIT | domain | raw.githubusercontent.com |
| Hectorm - Hmirror - Zerodot1-coinblockerlists-browserinactive | not stated | domain | raw.githubusercontent.com |
abuse.ch15
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| abuse.ch - SSL Blacklist (SHA1 Fingerprints) | CC0-1.0 | fingerprint | sslbl.abuse.ch |
| abuse.ch - SSLBL JA3 Fingerprints | CC0-1.0 | fingerprint | sslbl.abuse.ch |
| Feodo Tracker - Botnet C2 IPs | free | ip | feodotracker.abuse.ch |
| MalwareBazaar - Full CSV (file metadata) | open | hash | bazaar.abuse.ch |
| MalwareBazaar - Full MD5 Hashes | open | hash | bazaar.abuse.ch |
| MalwareBazaar - Full SHA-1 Hashes | open | hash | bazaar.abuse.ch |
| MalwareBazaar - Full SHA-256 Hashes | open | hash | bazaar.abuse.ch |
| MalwareBazaar - Recent Malware Hashesinactive | free | hash | mb-api.abuse.ch |
| MalwareBazaar - Recent MD5 Hashes | open | hash | bazaar.abuse.ch |
| MalwareBazaar - Recent SHA-1 Hashes | open | hash | bazaar.abuse.ch |
| MalwareBazaar - Recent SHA-256 Hashes | open | hash | bazaar.abuse.ch |
| ThreatFox - Full IOC Export | CC0-1.0 | ip, domain, url, hash | threatfox.abuse.ch |
| ThreatFox - Recent IOCs | free | ip, domain, url, hash | threatfox.abuse.ch |
| URLhaus - 90-Day Malicious URLs | CC0-1.0 | url, domain | urlhaus.abuse.ch |
| URLhaus - Recent Malicious URLs | free | url, domain | urlhaus.abuse.ch |
dataplane.org12
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| DNS CH TXT Version Bind | no commercial grant | ip | dataplane.org |
| DNS Recursion Desired | no commercial grant | ip | dataplane.org |
| DNS Recursion Desired ANY | no commercial grant | ip | dataplane.org |
| IP Protocol 41 | no commercial grant | ip | dataplane.org |
| SIP Invitation | no commercial grant | ip | dataplane.org |
| SIP Query | no commercial grant | ip | dataplane.org |
| SIP Registration | no commercial grant | ip | dataplane.org |
| SMTP Data | no commercial grant | ip | dataplane.org |
| SMTP Greet | no commercial grant | ip | dataplane.org |
| SSH Password Auth | no commercial grant | ip | dataplane.org |
| Telnet Login | no commercial grant | ip | dataplane.org |
| VNC RFB | no commercial grant | ip | dataplane.org |
InfinityTec12
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| InfinityTec – Adfilters | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Ads & Trackers | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Annoyances (pop‑ups & cookies) | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Bad TLDsinactive | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Clickbait Sites | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Extra‑Strict | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Medical Pseudoscienceinactive | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Multi‑Level Marketing (MLM) Blocklist | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Reddit Blocklistinactive | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Rednote (Xiaohongshu) Blocklistinactive | MIT | domain | raw.githubusercontent.com |
| InfinityTec – Scams & Phishing | MIT | domain | raw.githubusercontent.com |
| InfinityTec – TikTok Blocklistinactive | MIT | domain | raw.githubusercontent.com |
Maltrail (stamparm)10
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Maltrail - Bitcoin Ransomware Trailsinactive | open | domain, ip | raw.githubusercontent.com |
| Maltrail - BlackCat/ALPHV Ransomware Trailsinactive | open | domain, ip | raw.githubusercontent.com |
| Maltrail - Cerber Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
| Maltrail - Conti Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
| Maltrail - LockBit Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
| Maltrail - Locky Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
| Maltrail - Ransomware Trailsinactive | open | domain, ip | raw.githubusercontent.com |
| Maltrail - REvil/Sodinokibi Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
| Maltrail - Ryuk Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
| Maltrail - WannaCry Ransomware Trails | open | domain, ip | raw.githubusercontent.com |
OSV.dev10
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OSV.dev - Malicious crates.io Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious GitHub Actions | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious Go Modules | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious Hex Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious Maven Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious npm Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious NuGet Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious Packagist Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious PyPI Packages | free, attribution | package | storage.googleapis.com |
| OSV.dev - Malicious RubyGems Packages | free, attribution | package | storage.googleapis.com |
Blocklist9
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Blocklist - All Apache attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All Attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All FTP attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All IMAP attacks (1h) | not stated | ip | lists.blocklist.de |
| Blocklist - All Mail attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All RFI-Attacks, REG-Bots, IRC-Bots or BadBots attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All SIP/VoIP/Asterisk attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All SSH attacks (48h) | not stated | ip | lists.blocklist.de |
| Blocklist - All StrongIPs attacks (2 month + 5k attacks) | not stated | ip | lists.blocklist.de |
RPiList9
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| RPiList – Child Protection | unverified | domain | raw.githubusercontent.com |
| RPiList – Corona Blocklist | unverified | domain | raw.githubusercontent.com |
| RPiList – Crypto Scams | unverified | domain | raw.githubusercontent.com |
| RPiList – Fake Science | unverified | domain | raw.githubusercontent.com |
| RPiList – Malware | unverified | domain | raw.githubusercontent.com |
| RPiList – MS‑Office Telemetry | unverified | domain | raw.githubusercontent.com |
| RPiList – Overblock | unverified | domain | raw.githubusercontent.com |
| RPiList – Samsung Ads & Telemetry | unverified | domain | raw.githubusercontent.com |
| RPiList – Streaming & Piracyinactive | unverified | domain | raw.githubusercontent.com |
Firebog8
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Firebog - Admiral | not stated | domain | v.firebog.net |
| Firebog - Easylist Dutch | not stated | domain | v.firebog.net |
| Firebog - Kowabit | not stated | domain | v.firebog.net |
| Firebog - Neohostsbasic | not stated | domain | v.firebog.net |
| Firebog - Prigent Adultinactive | not stated | domain | v.firebog.net |
| Firebog - Prigent Crypto | not stated | domain | v.firebog.net |
| Firebog - Rpilist Malware | not stated | domain | v.firebog.net |
| Firebog - Rpilist Phishing | not stated | domain | v.firebog.net |
Opendbl Net8
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Opendbl Net - Blocklistde All.list | not stated | ip | opendbl.net |
| Opendbl Net - Bruteforce.list | not stated | ip | opendbl.net |
| Opendbl Net - Dshield.list | not stated | ip | opendbl.net |
| Opendbl Net - Etknown.list | not stated | ip | opendbl.net |
| Opendbl Net - Ipsum.list | not stated | ip | opendbl.net |
| Opendbl Net - Sslblock.listinactive | not stated | ip | opendbl.net |
| Opendbl Net - Talos.listinactive | not stated | ip | opendbl.net |
| Opendbl Net - Tor Exit.list | not stated | ip | opendbl.net |
Romain Marcoux8
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Romain Marcoux - Full Domains Aa.txt | MIT | domain | raw.githubusercontent.com |
| Romain Marcoux - Full Domains Ab.txt | MIT | domain | raw.githubusercontent.com |
| Romain Marcoux - Malicious IPs | MIT | ip | raw.githubusercontent.com |
| Romain Marcoux - Malicious IPs | MIT | ip | raw.githubusercontent.com |
| Romain Marcoux - Malicious IPs | MIT | ip | raw.githubusercontent.com |
| Romain Marcoux - Malicious Outgoing IPsinactive | not stated | ip | raw.githubusercontent.com |
| Romain Marcoux - Malicious Outgoing IPs | MIT | ip | raw.githubusercontent.com |
| Romain Marcoux - Malicious Outgoing IPs | MIT | ip | raw.githubusercontent.com |
threatview.io7
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Threatview C2 Hunt Feed | unverified | mixed | threatview.io |
| Threatview Domain Blocklist | unverified | domain | threatview.io |
| Threatview IP Blocklist | unverified | ip | threatview.io |
| Threatview MD5 Hash Blocklist | unverified | hash | threatview.io |
| Threatview OSINT Threat Feed | unverified | mixed | threatview.io |
| Threatview SHA File Hash Blocklist | unverified | hash | threatview.io |
| Threatview URL Blocklist | unverified | url, domain | threatview.io |
cyb3rko6
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| cyb3rko – Discord Hostsinactive | not stated | domain | raw.githubusercontent.com |
| cyb3rko – Instagram Hostsinactive | not stated | domain | raw.githubusercontent.com |
| cyb3rko – Pinterest Hostsinactive | not stated | domain | raw.githubusercontent.com |
| cyb3rko – Telegram Hostsinactive | not stated | domain | raw.githubusercontent.com |
| cyb3rko – TikTok Hostsinactive | not stated | domain | raw.githubusercontent.com |
| cyb3rko – Twitter Hostsinactive | not stated | domain | raw.githubusercontent.com |
Malware-Filter6
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Malware-Filter - Botnet Filter | unverified | ip | malware-filter.gitlab.io |
| Malware-Filter - Botnet Filter IPs | unverified | ip | malware-filter.gitlab.io |
| Malware-Filter - Phishing Domains | unverified | domain | malware-filter.gitlab.io |
| Malware-Filter - Phishing Hosts.txt | unverified | domain | malware-filter.gitlab.io |
| Malware-Filter - Tracking Filter | unverified | domain | malware-filter.gitlab.io |
| Malware-Filter - URLhaus Domains | unverified | domain | malware-filter.gitlab.io |
Phishing.Database6
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Free OSINT Pack - Phishing.Database Active IPs | open | ip | raw.githubusercontent.com |
| Free OSINT Pack - Phishing.Database Active Now URLs | open | url, domain | raw.githubusercontent.com |
| Free OSINT Pack - Phishing.Database New Domains Last Hourinactive | open | domain | raw.githubusercontent.com |
| Phishing.Database - Active Phishing Domains | open | domain | raw.githubusercontent.com |
| Phishing.Database - Active Phishing URLs | open | url | raw.githubusercontent.com |
| Phishing.Database - New Phishing Domains (Today) | open | domain | raw.githubusercontent.com |
Steven Black6
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Steven Black - 2o7Net | MIT | domain | raw.githubusercontent.com |
| Steven Black - Hosts | MIT | domain | raw.githubusercontent.com |
| Steven Black - KADhosts | MIT | domain | raw.githubusercontent.com |
| Steven Black - Risk | MIT | domain | raw.githubusercontent.com |
| Steven Black - Spam | MIT | domain | raw.githubusercontent.com |
| Steven Black - UncheckyAds | MIT | domain | raw.githubusercontent.com |
V Firebog Net6
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| V Firebog Net - Adguard DNS.txt | not stated | domain | v.firebog.net |
| V Firebog Net - Bill Stearns.txt | not stated | domain | v.firebog.net |
| V Firebog Net - Easylist.txt | not stated | domain | v.firebog.net |
| V Firebog Net - Easyprivacy.txt | not stated | domain | v.firebog.net |
| V Firebog Net - Prigent Ads.txt | not stated | domain | v.firebog.net |
| V Firebog Net - Prigent Malware.txt | not stated | domain | v.firebog.net |
Frogeye5
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Frogeye - First Party Trackers | MIT | domain | hostfiles.frogeye.fr |
| Frogeye – First‑Party Only Trackersinactive | not stated | domain | hostfiles.frogeye.fr |
| Frogeye – First‑Party Trackers Hosts | MIT | domain | hostfiles.frogeye.fr |
| Frogeye – Multi‑Party Only Trackers | MIT | domain | hostfiles.frogeye.fr |
| Frogeye – Multi‑Party Trackers Hosts | MIT | domain | hostfiles.frogeye.fr |
CriticalPathSecurity4
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Free OSINT Pack - CriticalPathSecurity Cobalt Strike IPs | MIT | ip | raw.githubusercontent.com |
| Free OSINT Pack - CriticalPathSecurity Collected IOCs | MIT | ip, domain, url, hash | raw.githubusercontent.com |
| Free OSINT Pack - CriticalPathSecurity Miraiinactive | MIT | ip, domain, url | raw.githubusercontent.com |
| Free OSINT Pack - CriticalPathSecurity OpenPhish URLs | MIT | url, domain | raw.githubusercontent.com |
DigitalSide-IT4
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| DigitalSide-IT OSINT - Latest Malicious Domainsinactive | open | domain | osint.digitalside.it |
| DigitalSide-IT OSINT - Latest Malicious IPsinactive | open | ip | osint.digitalside.it |
| DigitalSide-IT OSINT - Latest Malicious URLsinactive | open | url | osint.digitalside.it |
| DigitalSide-IT OSINT - Latest Malware SHA-256inactive | open | hash | osint.digitalside.it |
justdomains.github.io4
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AdGuard DNS Domains | not stated | domain | justdomains.github.io |
| EasyList Domains | not stated | domain | justdomains.github.io |
| EasyPrivacy Domains | not stated | domain | justdomains.github.io |
| NoCoin Domains | not stated | domain | justdomains.github.io |
OFAC4
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OFAC SDN - BTC Addresses | open | crypto | raw.githubusercontent.com |
| OFAC SDN - ETH Addresses | open | crypto | raw.githubusercontent.com |
| OFAC SDN - LTC Addresses | open | crypto | raw.githubusercontent.com |
| OFAC SDN - TRX Addresses | open | crypto | raw.githubusercontent.com |
OpenAI4
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OpenAI - AdsBot IP Ranges | free | ip | openai.com |
| OpenAI - ChatGPT-User IP Ranges | free | ip | openai.com |
| OpenAI - GPTBot IP Ranges | free | ip | openai.com |
| OpenAI - OAI-SearchBot IP Ranges | free | ip | openai.com |
Tempest Solutions Company4
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Tempest Solutions Company - Banking Trojan | no commercial grant | domain | raw.githubusercontent.com |
| Tempest Solutions Company - C2 Servers | no commercial grant | domain | raw.githubusercontent.com |
| Tempest Solutions Company - Malware | no commercial grant | domain | raw.githubusercontent.com |
| Tempest Solutions Company - Phishing | no commercial grant | domain | raw.githubusercontent.com |
AnudeepND3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AnudeepND – Adserversinactive | not stated | domain | raw.githubusercontent.com |
| AnudeepND – CoinMiner | MIT | domain | raw.githubusercontent.com |
| AnudeepND – Facebook Domainsinactive | MIT | domain | raw.githubusercontent.com |
api.cybercure.ai3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CyberCure Blocked URL Feedinactive | not stated | domain | api.cybercure.ai |
| CyberCure Hash Feedinactive | not stated | hash | api.cybercure.ai |
| CyberCure IP Feedinactive | not stated | ip | api.cybercure.ai |
feeds.honeynet.asia3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| SSH Bruteforce IPs | not stated | ip | feeds.honeynet.asia |
| Telnet Bruteforce IPs | not stated | ip | feeds.honeynet.asia |
| URL Seen in Honeypots | not stated | url, domain | feeds.honeynet.asia |
Google3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Google - Googlebot IP Ranges | free | ip | developers.google.com |
| Google - Special Crawlers IP Ranges | free | ip | developers.google.com |
| Google - User-Triggered Fetchers IP Ranges | free | ip | developers.google.com |
HaGeZi3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HaGeZi - Gambling Domains (DNS Blocklist)inactive | no commercial grant | domain | cdn.jsdelivr.net |
| HaGeZi TIF - Threat Intelligence Feed Domains | no commercial grant | domain | raw.githubusercontent.com |
| HaGeZi TIF - Threat Intelligence Feed IPs | no commercial grant | ip | raw.githubusercontent.com |
Nickoppen3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Nickoppen – Activision Blocklistinactive | not stated | domain | raw.githubusercontent.com |
| Nickoppen – Advertisers (adotmob) Blocklist | not stated | domain | raw.githubusercontent.com |
| Nickoppen – Blizzard Blocklistinactive | not stated | domain | raw.githubusercontent.com |
PhishDestroy3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| PhishDestroy - Active Domains | MIT | domain | raw.githubusercontent.com |
| PhishDestroy - Destroylist Domains | MIT | domain | raw.githubusercontent.com |
| PhishDestroy - Destroylist Domains JSON | MIT | domain | raw.githubusercontent.com |
Phishing Army3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Phishing Army - Blocklist | no commercial grant | domain | phishing.army |
| Phishing Army - Blocklist Extended.txt | no commercial grant | domain | phishing.army |
| Phishing Army – Extended Blocklistinactive | not stated | domain | phishing.army |
S3 Amazonaws3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| S3 Amazonaws - Simple Ad.txt | GPL-3.0 | domain | s3.amazonaws.com |
| S3 Amazonaws - Simple Malvertising.txt | GPL-3.0 | domain | s3.amazonaws.com |
| S3 Amazonaws - Simple Tracking.txt | GPL-3.0 | domain | s3.amazonaws.com |
Smokingwheels Github Io3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Smokingwheels Github Io - Fromlogtosh | unverified | domain | smokingwheels.github.io |
| Smokingwheels Github Io - Searchengineinactive | unverified | domain | smokingwheels.github.io |
| Smokingwheels Github Io - Searchengine1inactive | unverified | domain | smokingwheels.github.io |
Spamhaus3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Spamhaus - ASN-DROPinactive | no commercial grant | asn | www.spamhaus.org |
| Spamhaus DROP - IPv4 (direct) | free | ip | www.spamhaus.org |
| Spamhaus DROP - IPv6 (direct) | free | ip | www.spamhaus.org |
T1453
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| T145 - Black Mirror Domain Blocklist | AGPL-3.0 | domain | github.com |
| T145 - Black Mirror IPv4 Blocklist | AGPL-3.0 | ip | github.com |
| T145 - Black Mirror IPv6 Blocklist | AGPL-3.0 | ip | github.com |
threatfox.abuse.ch3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ThreatFox IOCs Host File | no commercial grant | domain | threatfox.abuse.ch |
| ThreatFox MISP | no commercial grant | mixed | threatfox.abuse.ch |
| ThreatFox Recent IOCs | no commercial grant | mixed | threatfox.abuse.ch |
urlhaus.abuse.ch3
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| URLhaus Host File | no commercial grant | domain | urlhaus.abuse.ch |
| URLHaus Malware URLsinactive | not stated | domain | urlhaus.abuse.ch |
| URLhaus MISP | no commercial grant | mixed | urlhaus.abuse.ch |
AlienVault OTX2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AlienVault - IP Reputation Feed | free | ip | reputation.alienvault.com |
| AlienVault OTX - Subscribed Pulse Indicators | API key | ip, domain, url, hash, cve | otx.alienvault.com |
Andre Vich2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Andre Vich - Community | MIT | domain | raw.githubusercontent.com |
| Andre Vich - Domains All | MIT | domain | raw.githubusercontent.com |
Apple2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Apple - Applebot IP Ranges | free | ip | search.developer.apple.com |
| Apple - iCloud Private Relay Egress IP Ranges | free | ip | mask-api.icloud.com |
Bitwire2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Bitwire - Inbound Blocklist | MIT | ip | raw.githubusercontent.com |
| Bitwire - Outbound Blocklist | MIT | ip | raw.githubusercontent.com |
BlockConvert2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| BlockConvert - Domain Blocklist | MIT | domain | mkb2091.github.io |
| BlockConvert - Malware Domainsinactive | MIT | domain | raw.githubusercontent.com |
blocklistproject.github.io2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Blocklist Project Fraud (NL)inactive | Unlicense | domain | blocklistproject.github.io |
| Blocklist Project Phishing (NL)inactive | Unlicense | domain | blocklistproject.github.io |
Borestad2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Borestad - AbuseIPDB Blocklist (1d) | not stated | ip | raw.githubusercontent.com |
| Borestad - AbuseIPDB Blocklist (30d) | not stated | ip | raw.githubusercontent.com |
Datadog2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Datadog - Malicious npm Packages | Apache-2.0 | package | raw.githubusercontent.com |
| Datadog - Malicious PyPI Packages | Apache-2.0 | package | raw.githubusercontent.com |
drb-ra2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| C2IntelFeeds - C2 Domains (30 day) | free, attribution | domain | raw.githubusercontent.com |
| C2IntelFeeds - C2 IPs (30 day) | free, attribution | ip | raw.githubusercontent.com |
feodotracker.abuse.ch2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Feodo IP Blocklistinactive | not stated | ip | feodotracker.abuse.ch |
| Feodo Tracker (Abuse.ch) | CC0-1.0 | ip | feodotracker.abuse.ch |
Gitlab2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Gitlab - Notrack Blocklist.txt | no commercial grant | domain | gitlab.com |
| Gitlab - Notrack Malware.txt | no commercial grant | domain | gitlab.com |
malsilo.gitlab.io2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| MalSilo Domain Listinactive | not stated | domain | malsilo.gitlab.io |
| MalSilo IP List | not stated | ip | malsilo.gitlab.io |
NickSpaargaren2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| NickSpaargaren – No Amazoninactive | not stated | domain | raw.githubusercontent.com |
| NickSpaargaren – No Google (Pi‑hole Google)inactive | Unlicense | domain | raw.githubusercontent.com |
polkadot-js2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Polkadot-js - Phishing Site Domains | Apache-2.0 | domain | polkadot.js.org |
| Polkadot-js - Scam Crypto Addresses | Apache-2.0 | crypto | polkadot.js.org |
ScamSniffer2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ScamSniffer - Scam Crypto Addresses | no commercial grant | crypto | raw.githubusercontent.com |
| ScamSniffer - Scam Domains | no commercial grant | domain | raw.githubusercontent.com |
Sefinek2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Sefinek - Blacklisted Emails | MIT | raw.githubusercontent.com | |
| Sefinek - Malicious IP Addresses | MIT | ip | raw.githubusercontent.com |
shreshtait.com2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Shreshta NRD Monthlyinactive | no commercial grant | domain | shreshtait.com |
| Shreshta NRD Weeklyinactive | no commercial grant | domain | shreshtait.com |
Sinfonietta2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Sinfonietta – Gambling Hostsinactive | MIT | domain | raw.githubusercontent.com |
| Sinfonietta – Pornography Hostsinactive | MIT | domain | raw.githubusercontent.com |
Stamparm2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Stamparm - Blackbook.txt | not stated | domain | raw.githubusercontent.com |
| Stamparm – Blackbookinactive | not stated | domain | raw.githubusercontent.com |
stamparm/maltrail2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Free OSINT Pack - Maltrail Malware Domains | open | domain | raw.githubusercontent.com |
| Free OSINT Pack - Maltrail Static Trails | open | ip, domain, url | raw.githubusercontent.com |
Team Cymru2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Team Cymru - Full Bogons (IPv4) | free | ip | www.team-cymru.org |
| Team Cymru - Full Bogons (IPv6) | free | ip | www.team-cymru.org |
The Block List Project2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| The Block List Project - Phishing List | Unlicense | domain | blocklistproject.github.io |
| The Block List Project - Ransomware Listinactive | Unlicense | domain | blocklistproject.github.io |
winhelp2002.mvps.org2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| MVPS Hosts | no commercial grant | domain | winhelp2002.mvps.org |
| MVPS HOSTSinactive | not stated | domain | winhelp2002.mvps.org |
www.dan.me.uk2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Tor ALL Nodes | not stated | ip | www.dan.me.uk |
| Tor Exit Nodes | not stated | ip | www.dan.me.uk |
X4BNet2
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| X4BNet - Datacenter IPv4 Ranges | MIT | ip | raw.githubusercontent.com |
| X4BNet - VPN Provider IPv4 Ranges | MIT | ip | raw.githubusercontent.com |
13MrBlackCat131
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| 13MrBlackCat13 - Malicious Domains.txt | MIT | domain | raw.githubusercontent.com |
1Hosts Lite1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| 1Hosts Lite – balanced hosts file | MPL-2.0 | domain | raw.githubusercontent.com |
1Hosts Xtra1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| 1Hosts Xtra – aggressive hosts file | MPL-2.0 | domain | raw.githubusercontent.com |
7c/fakefilter1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| fakefilter - Fraud/Fake-Shop Domains | free | domain | cdn.jsdelivr.net |
AbuseIPDB1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AbuseIPDB - IP Blacklist | API key | ip | api.abuseipdb.com |
adguardteam.github.io1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AdGuard DNS Filter (raw)inactive | GPL-3.0 | domain | adguardteam.github.io |
AMF (France)1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AMF - Listes noires des entites non autorisees | Etalab-2.0 | domain, url, email | www.data.gouv.fr |
Amitambekar5101
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Amitambekar510 - Malicious Domain Threat List | not stated | domain | raw.githubusercontent.com |
anti‑AD1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| anti‑AD – EasyList for AdGuard Home | MIT | domain | anti-ad.net |
AntiScam Squad1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AntiScam Squad - Pi-Hole Crypto Scam.txt | not stated | domain | raw.githubusercontent.com |
Anudeep ND1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Anudeep ND - Adservers.txt | MIT | domain | raw.githubusercontent.com |
Atlassian1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Atlassian - Cloud IP Ranges | free | ip | ip-ranges.atlassian.com |
Avast (Gen)1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Avast Threat Labs - Malware IOC Hashes | free, attribution | hash | codeload.github.com |
AWS1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| AWS - Published IP Ranges | free | ip | ip-ranges.amazonaws.com |
Binary Defense1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Binary Defense - Banlist | no commercial grant | ip | www.binarydefense.com |
Bitbucket Org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Bitbucket Org - Mandiant APT1 Report Appendix D.txt | not stated | domain | bitbucket.org |
Bundy011
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Bundy01 – Meta Domainsinactive | GPL-3.0 | domain | raw.githubusercontent.com |
CallShield1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CallShield - Hot Spam Numbers | MIT | phone | raw.githubusercontent.com |
cdn.ellio.tech1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ELLIO IP Feed Community | no commercial grant | ip | cdn.ellio.tech |
cinsscore.com1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CINSSCORE Bad Guys | not stated | ip | cinsscore.com |
CISA1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CISA - Known Exploited Vulnerabilities Catalog | free | cve | raw.githubusercontent.com |
CISA/NSA1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CISA/NSA - BRICKSTORM Malware Analysis (STIX2)inactive | free | ip, domain, hash, url, mitre | www.cisa.gov |
Cisco Talos1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Cisco Talos - Published IOCs | CC0-1.0 | domain, ip, url, hash | codeload.github.com |
Cloudflare1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Cloudflare - Published IP Ranges | free | ip | api.cloudflare.com |
CloudSEK1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CloudSEK - Threat Intelligence Placeholderinactive | API key | ip, domain, url, hash | api.cloudsek.com |
Codeberg Org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Codeberg Org - Blocklist.txt | unverified | domain | codeberg.org |
CoinBlockerLists1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CoinBlockerLists – Hostsinactive | not stated | domain | raw.githubusercontent.com |
Common Crawl1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Common Crawl - CCBot IP Ranges | free | ip | index.commoncrawl.org |
Crazy Max1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Crazy Max - Spy.txt | MIT | domain | raw.githubusercontent.com |
CriminalIP1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CriminalIP - C2 Daily Feedinactive | not stated | ip | raw.githubusercontent.com |
Curbengh1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Curbengh - VN Badsite Filter | MIT | domain | curbengh.github.io |
cybercrime-tracker.net1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Cybercrime Tracker - C2 Panel URLsinactive | CC0-1.0 | url | cybercrime-tracker.net |
CZ.NIC1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Turris Sentinel - Greylistinactive | non-commercial | ip | view.sentinel.turris.cz |
Dbl Oisd Nl1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Dbl Oisd Nl - inactive | no commercial grant | domain | raw.githubusercontent.com |
DigitalOcean1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| DigitalOcean - RFC8805 Geofeed | free | ip | digitalocean.com |
DigitalSide1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| DigitalSide - Threat-Intel Domainsinactive | MIT | domain | raw.githubusercontent.com |
disposable.github.io1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Disposable Email Domains (disposable.github.io) | MIT | domain | disposable.github.io |
Dl Red Flag Domains1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Dl Red Flag Domains - Red.flag.domains.txt | no commercial grant | domain | dl.red.flag.domains |
Dogino1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Dogino - Discord Phishing URLs - Scam Urls | Unlicense | domain | raw.githubusercontent.com |
duggytuxy1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| duggytuxy - Ransomware IP Addressesinactive | no commercial grant | ip | raw.githubusercontent.com |
Duggytuxy1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Duggytuxy - Blacklist Ips For Fortinet Firewall Aa.txt | no commercial grant | ip | raw.githubusercontent.com |
EasyList HOSTS1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| EasyList HOSTS – unified hosts d’EasyList | unverified | domain | raw.githubusercontent.com |
ESET1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ESET Research - Malware IOC Hashes | BSD-2-Clause | hash | codeload.github.com |
Fabriziosalmi1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Fabriziosalmi - Aggregated Blacklist | GPL-3.0 | domain | github.com |
faf.bambenekconsulting.com1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Bambenek DGA Feed High | no commercial grant | domain | faf.bambenekconsulting.com |
Fastly1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Fastly - Public IP List | free | ip | api.fastly.com |
FBI IC31
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| FBI IC3 - Public Service Announcements (RSS)inactive | free | domain, url | www.ic3.gov |
feeds.ecrimelabs.net1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Metasploit CVE Exploits | not stated | cve | feeds.ecrimelabs.net |
FGRibreau1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| MailChecker - Disposable/Invalid Domains | MIT | domain | cdn.jsdelivr.net |
FireHOL blocklist.de1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| FireHOL blocklist.de – fail2ban offendersinactive | not stated | ip | raw.githubusercontent.com |
Geonode1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Geonode - Free Proxy List | free | ip | proxylist.geonode.com |
Gist Githubusercontent1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Gist Githubusercontent - Test.txtinactive | not stated | domain | gist.githubusercontent.com |
Github1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Github - Smart TV.txt | MIT | domain | github.com |
GitHub1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| GitHub - Published IP Ranges | free | ip | api.github.com |
Global Anti Scam Org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Global Anti Scam Org – Scam Domains | BSD-3-Clause | domain | raw.githubusercontent.com |
GoodByeAds Main1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| GoodByeAds Main – ads, tracking & malware | MIT | domain | raw.githubusercontent.com |
Google Cloud1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| GCP - Published IP Ranges | free | ip | www.gstatic.com |
Greensnow1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Greensnow - Attacks Multi-protocols | not stated | ip | blocklist.greensnow.co |
HAGEZI1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HAGEZI - Ultimate.txt | no commercial grant | domain | raw.githubusercontent.com |
HaGeZi Light1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HaGeZi Light – minimal DNS blocklist | no commercial grant | domain | raw.githubusercontent.com |
HaGeZi Multi1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HaGeZi Multi – medium DNS blocklist | no commercial grant | domain | raw.githubusercontent.com |
HaGeZi Pro1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HaGeZi Pro – heavy DNS blocklist | no commercial grant | domain | raw.githubusercontent.com |
HaGeZi Pro Plus1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HaGeZi Pro Plus – very heavy DNS blocklist | no commercial grant | domain | raw.githubusercontent.com |
Have I Been Pwned1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HIBP - Breach Catalogue (Domains)inactive | free, attribution | domain | haveibeenpwned.com |
Hole Cert Pl1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Hole Cert Pl - Domains.txt | no commercial grant | domain | hole.cert.pl |
home.nuug.no1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| POP3 Gropers | not stated | ip | home.nuug.no |
HorusTeknoloji1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| HorusTeknoloji - Url Lists.txt | MIT | domain | raw.githubusercontent.com |
Hyder3651
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Hyder365 - Combined.txt | not stated | domain | raw.githubusercontent.com |
iocium1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| iocium - List.txt | not stated | domain | media.githubusercontent.com |
IOCIUM1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| IOCIUM - Dangerous domains | not stated | domain | media.githubusercontent.com |
IPsum1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| IPsum – malicious IP feedinactive | not stated | ip | raw.githubusercontent.com |
Jarellama1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Jarellama - Scam Blocklist | GPL-3.0 | domain | raw.githubusercontent.com |
Joewein Net1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Joewein Net - Dom Bl.txt | not stated | domain | www.joewein.net |
KADhosts1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| KADhosts – Polish Scam & Fraud List | no commercial grant | domain | raw.githubusercontent.com |
kboghdady1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| kboghdady – YouTube Ads (Googlevideo) Blocklistinactive | not stated | domain | raw.githubusercontent.com |
Linode (Akamai)1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Linode - RFC8805 Geofeed | free | ip | geoip.linode.com |
lists.cyberhost.uk1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CyberHost Malware & Phishing Blocklist | CC-BY-SA-4.0 | domain | lists.cyberhost.uk |
Maltrail1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Maltrail – Malware Domainsinactive | not stated | domain | raw.githubusercontent.com |
malware-filter.gitlab.io1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Phishing URL Blocklist | unverified | domain | malware-filter.gitlab.io |
Marco ACORTE1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Marco ACORTE - Antispam Domains.txt | no commercial grant | domain | raw.githubusercontent.com |
MAS (Singapore)1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| MAS - Investor Alert List | free, attribution | domain, url | www.mas.gov.sg |
MetaMask1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| MetaMask - Ethereum Phishing Detect | MIT | domain | raw.githubusercontent.com |
Microsoft1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Microsoft 365 - Worldwide Endpoint IPs | free | ip | endpoints.office.com |
Microsoft Azure1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Azure - Published IP Ranges | free | ip | raw.githubusercontent.com |
Microsoft Bing1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Microsoft - Bingbot IP Ranges | free | ip | www.bing.com |
MISP1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Free OSINT Pack - MISP Warninglist URL Shortenersinactive | CC0-1.0 | domain | raw.githubusercontent.com |
Mitchell Krogza1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Mitchell Krogza - Phishing Databaseinactive | MIT | domain | raw.githubusercontent.com |
MITRE1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| MITRE ATT&CK Enterprise STIX | free | mitre | raw.githubusercontent.com |
montysecurity1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| montysecurity C2 Tracker - All Domainsinactive | open | domain | raw.githubusercontent.com |
Mullvad1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Mullvad - Published VPN Relay IPs | free | ip | api.mullvad.net |
NanduWasTaken1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| NanduWasTaken - Discord Scam Links | MIT | domain | raw.githubusercontent.com |
nathanu981
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Scammer Phone Numbers (nathanu98) | open | phone | raw.githubusercontent.com |
NEO DEV Host1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| NEO DEV Host – unified blocklist | MIT | domain | raw.githubusercontent.com |
Networksec Org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Networksec Org - Block.txtinactive | not stated | domain | www.networksec.org |
NordVPN1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| NordVPN - Published Server IPs | free | ip | api.nordvpn.com |
NoTracking Hostnames1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| NoTracking Hostnames – combined hosts file | not stated | domain | raw.githubusercontent.com |
NUBI1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| NUBI - Bad IPs | free | ip | www.nubi-network.com |
OISD Big1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OISD Big – general purpose list | no commercial grant | domain | raw.githubusercontent.com |
OISD NSFW1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OISD NSFW – adult domainsinactive | no commercial grant | domain | raw.githubusercontent.com |
OISD Small1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OISD Small - Ads | no commercial grant | domain | raw.githubusercontent.com |
Okta1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Okta - Cell IP Ranges | free | ip | s3.amazonaws.com |
OpenPhish1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OpenPhish - Feedinactive | not stated | domain | openphish.com |
openphish.com1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OpenPhish Feedinactive | no commercial grant | domain | openphish.com |
Oracle Cloud1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OCI - Published IP Ranges | free | ip | docs.oracle.com |
particlelevel1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| uBlacklist - Fake Shops (German) | free | domain | cdn.jsdelivr.net |
paulgb.github.io1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| BarbBlock Hosts File | MIT | domain | paulgb.github.io |
Perplexity1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Perplexity - PerplexityBot IP Ranges | free | ip | www.perplexity.ai |
pgl.yoyo.org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Peter Lowe’s Ad Servers List | not stated | domain | pgl.yoyo.org |
ph00lt0 Blocklist1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ph00lt0 Blocklist – stats, analytics, lottery & ads | CC-BY-SA-4.0 | domain | raw.githubusercontent.com |
PhishStats1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| PhishStats - Recent High-Score Phishing | free | url, ip, domain | api.phishstats.info |
PhishTank1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| PhishTank - Online Valid Phishing URLs | CC-BY-SA-2.5 | url | data.phishtank.com |
Phishunt1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Phishunt - Phishing URL Feed | free | url, domain | phishunt.io |
Pihole Tg121
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Pihole Tg12 - Phish Domains.txt | not stated | domain | raw.githubusercontent.com |
ProxyScrape1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ProxyScrape - Free HTTP Proxy List | free | ip | api.proxyscrape.com |
Ransomfeed1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Ransomfeed - Recent Ransomware Posts | free | domain, url | api.ransomfeed.it |
RansomLook1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| RansomLook - Recent Ransomware Victims/Sites | free | domain, url | www.ransomlook.io |
Reddestdream Github Io1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Reddestdream Github Io - Minimalhosts | not stated | domain | reddestdream.github.io |
reputation.alienvault.com1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Alienvault Reputation Generic | no commercial grant | ip | reputation.alienvault.com |
rules.emergingthreats.net1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Emerging Threats Compromised IPs | BSD-3-Clause | ip | rules.emergingthreats.net |
Salesforce1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Salesforce - IP Ranges | free | ip | ip-ranges.salesforce.com |
Scriptzteam1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Scriptzteam - BlockList V4 Ips.txtinactive | no commercial grant | ip | raw.githubusercontent.com |
Seb Sauvage1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Seb Sauvage - Hosts | no commercial grant | domain | sebsauvage.net |
snort.org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Snort IP Block Listinactive | unverified | ip | snort.org |
Someonewhocares1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Someonewhocares - Hosts | no commercial grant | domain | someonewhocares.org |
someonewhocares.org1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Dan Pollock’s hosts (someonewhocares.org) | no commercial grant | domain | someonewhocares.org |
Spys.me1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Spys.me - Free Proxy List | free | ip | spys.me |
stamparm1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| IPsum - Malicious IPs | free | ip | raw.githubusercontent.com |
Stopforumspam1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Stopforumspam - Toxic Domains Whole.txt | no commercial grant | domain | www.stopforumspam.com |
Stripe1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Stripe - Webhook Source IPs | free | ip | stripe.com |
Taiwan MOI/CIB1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Taiwan MOI/CIB - Fraud-Reported Domainsinactive | open | domain | opdadm.moi.gov.tw |
ThreatHive1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ThreatHive - Hive Blocklist | unverified | ip | threathive.net |
Tor Project1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Tor Project - Bulk Exit List (official) | free | ip | check.torproject.org |
TweetFeed1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| TweetFeed - IOCs from Security Researchers (7 day) | free, attribution | ip, domain, url, hash | api.tweetfeed.live |
UK FCDO1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| UK Sanctions List - Crypto Addresses | free | crypto | sanctionslist.fcdo.gov.uk |
Ultimate Hosts Blacklist1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Ultimate Hosts Blacklist - Blocklist.de | MIT | ip | raw.githubusercontent.com |
Urlhaus Abuse Ch1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Urlhaus Abuse Ch - Textinactive | no commercial grant | domain | urlhaus.abuse.ch |
US Treasury OFAC1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| OFAC - SDN Advanced List (Crypto Addresses) | free | crypto | sanctionslistservice.ofac.treas.gov |
USOM1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| USOM - Malicious URL List (Turkey CERT)inactive | not stated | domain | www.usom.gov.tr |
ViriBack1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| ViriBack C2 Tracker | free | url, ip, domain | tracker.viriback.com |
Volexity1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Volexity - Threat Intel IOCs | BSD-2-Clause | domain, ip, url, hash | codeload.github.com |
VulnCheck1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| VulnCheck - Vulnerability Intelligence | API key | cve | api.vulncheck.com |
Vultr1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Vultr - RFC8805 Geofeed | free | ip | geofeed.constant.com |
vxvault.net1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| VXvault URL Listinactive | not stated | domain | vxvault.net |
WindowsSpyBlocker1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| WindowsSpyBlocker – Spy rulesinactive | not stated | domain | raw.githubusercontent.com |
www.botvrij.eu1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Botvrij.eu Data | unverified | mixed | www.botvrij.eu |
www.circl.lu1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| CIRCL OSINT Feed | CC-BY-4.0 | mixed | www.circl.lu |
www.ipspamlist.com1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| IPSpamList Public Feed | no commercial grant | ip | www.ipspamlist.com |
www.stopforumspam.com1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| StopForumSpam Toxic Domainsinactive | not stated | domain | www.stopforumspam.com |
YoYo1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| YoYo - Serverlist | not stated | domain | pgl.yoyo.org |
Zoom1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Zoom - IP Ranges | free | ip | assets.zoom.us |
Zscaler1
| Feed | Licence | Indicators | Upstream |
|---|---|---|---|
| Zscaler - ZIA Data Center Ranges (CENR) | free | ip | config.zscaler.com |