Threat Indicator Feeds

Included Indicator Feeds

• https://www.binarydefense.com/banlist.txt
• https://blacklist.3coresec.net/lists/http.txt
• https://lists.blocklist.de/lists/bruteforcelogin.txt
• https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.txt
• https://rules.emergingthreats.net/blockrules/compromised-ips.txt
• https://threatview.io/Downloads/IP-High-Confidence-Feed.txt
• https://blacklist.3coresec.net/lists/ssh.txt
• https://dataplane.org/signals/sshidpw.txt
• https://threatview.io/Downloads/Experimental-IOC-Tweets.txt
• https://iplists.firehol.org/files/xroxy_30d.ipset
• https://blacklist.3coresec.net/lists/misc.txt
• https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt
• https://iplists.firehol.org/files/cleantalk_30d.ipset
• https://iplists.firehol.org/files/stopforumspam_90d.ipset
• https://view.sentinel.turris.cz/greylist-data/greylist-latest.csv
• https://iplists.firehol.org/files/php_spammers_30d.ipset
• https://iplists.firehol.org/files/cybercrime.ipset
• https://dataplane.org/signals/sshclient.txt
• https://dataplane.org/signals/vncrfb.txt
• https://iplists.firehol.org/files/tor_exits_30d.ipset
• https://iplists.firehol.org/files/dm_tor.ipset
• https://iplists.firehol.org/files/php_harvesters_30d.ipset
• https://iplists.firehol.org/files/bds_atif.ipset
• https://iplists.firehol.org/files/vxvault.ipset
• https://iplists.firehol.org/files/botscout_30d.ipset
• https://lists.blocklist.de/lists/21.txt
• https://iplists.firehol.org/files/iblocklist_onion_router.netset
• https://iplists.firehol.org/files/proxylists_30d.ipset
• https://iplists.firehol.org/files/firehol_abusers_30d.netset
• https://iplists.firehol.org/files/greensnow.ipset
• https://iplists.firehol.org/files/ipblacklistcloud_recent_30d.ipset
• https://dataplane.org/signals/telnetlogin.txt
• https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst
• https://iplists.firehol.org/files/bitcoin_nodes_30d.ipset
• https://iplists.firehol.org/files/php_dictionary_30d.ipset
• https://kriskintel.com/feeds/ktip_malicious_Ips.txt
• https://lists.blocklist.de/lists/80.txt
• https://dataplane.org/signals/dnsrd.txt
• https://myip.ms/files/blacklist/htaccess/latest_blacklist.txt
• https://lists.blocklist.de/lists/22.txt
• https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/vpn/NordVPNIPs.csv
• https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/vpn/ProtonVPNIPs.csv
• https://www.talosintelligence.com/documents/ip-blacklist
• https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv
• https://reputation.alienvault.com/reputation.generic
• http://cinsscore.com/list/ci-badguys.txt
• https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt
• https://lists.blocklist.de/lists/25.txt
• https://iplists.firehol.org/files/et_compromised.ipset
• https://iplists.firehol.org/files/sslproxies_30d.ipset
• https://www.botvrij.eu/data/ioclist.ip-src
• https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-nodes.lst
• https://raw.githubusercontent.com/scriptzteam/badIPS/main/ips.txt
• https://reputation.alienvault.com/reputation.data
• https://iplists.firehol.org/files/blocklist_net_ua.ipset
• https://raw.githubusercontent.com/rodanmaharjan/ThreatIntelligence/main/Mirai.txt
• https://raw.githubusercontent.com/Neo23x0/signature-base/master/iocs/c2-iocs.txt
• https://osint.digitalside.it/Threat-Intel/lists/latestips.txt
• https://www.dan.me.uk/torlist/
• https://threatfox.abuse.ch/export/csv/ip-port/recent/
• https://charles.the-haleys.org/ssh_dico_attack_with_timestamps.php?days=30
• http://sekuripy.hr/blacklist.txt
• https://lists.blocklist.de/lists/993.txt
• https://cdn.ellio.tech/community-feed
• https://iplists.firehol.org/files/tor_exits_30d.ipset
• https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.txt
• https://www.botvrij.eu/data/ioclist.ip-dst
• https://iplists.firehol.org/files/et_compromised.ipset
• https://check.torproject.org/torbulkexitlist
• https://lists.blocklist.de/lists/110.txt
• https://iplists.firehol.org/files/firehol_webclient.netset
• https://iplists.firehol.org/files/proxz_30d.ipset
• https://danger.rulez.sk/projects/bruteforceblocker/blist.php
• https://iplists.firehol.org/files/socks_proxy_30d.ipset
• https://dataplane.org/signals/sshpwauth.txt
• https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/unverified/IPC2s-30day.csv
• https://lists.blocklist.de/lists/443.txt
• https://lists.blocklist.de/lists/143.txt
• https://dataplane.org/signals/dnstcp.txt
• https://iplists.firehol.org/files/dyndns_ponmocup.ipset
• https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/all.txt
• https://github.com/rodanmaharjan/ThreatIntelligence/raw/main/blackcat%20ransomware.txt
• https://beesting.tools/
• https://github.com/rodanmaharjan/ThreatIntelligence/raw/main/CobaltStrike.txt
• https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s-30day.csv
• https://raw.githubusercontent.com/CriticalPathSecurity/Public-Intelligence-Feeds/master/compromised-ips.txt
• https://raw.githubusercontent.com/CriticalPathSecurity/Public-Intelligence-Feeds/master/illuminate.txt
• https://github.com/rodanmaharjan/ThreatIntelligence/raw/main/Malicious%20IP.txt
• https://lists.blocklist.de/lists/bots.txt
• https://mirai.security.gives/data/ip_list.txt
• https://www.darklist.de/raw.php
• https://report.rutgers.edu/DROP/attackers
• https://iplists.firehol.org/files/et_tor.ipset
• https://raw.githubusercontent.com/CriticalPathSecurity/Public-Intelligence-Feeds/master/sans.txt
• https://iplists.firehol.org/files/firehol_proxies.netset
• https://github.com/rodanmaharjan/ThreatIntelligence/raw/main/C2%20IOC.txt
• https://dataplane.org/signals/proto41.txt
• https://raw.githubusercontent.com/elliotwutingfeng/rstthreatsall/main/ioc_ip_short_all.txt