- Free public feed, no sign-up or key: the 500 most reliable IPs, domains and SHA-256 hashes, refreshed hourly (URLs and MISP setup).
- Feed quality: legitimate file-sharing services (WeTransfer, MediaFire…) are no longer published as whole domains; only specific malicious links are.
Changelog
What's new
Changes to the feed, the API and the website. Changes that may affect your integrations are announced here in advance.
- Feed quality: the 10,000 most visited websites (Tranco list, refreshed weekly), major email providers and text fragments are never published as malicious domains. Dynamic DNS and cloud storage subdomains are still published.
- API: OpenAPI 3.1 specification, ready for Postman, Insomnia or your client generator.
- Free sample of the feed, downloadable without signing up.
- Account: password reset by email and self-service account deletion.
- Privacy: looked-up values and keys passed in URLs are never written to server logs.
- Data processing agreement (DPA) published, along with a technical datasheet for integration teams.
- TAXII 2.1: read-only server, four collections, compatible with OpenCTI, Microsoft Sentinel and MISP.
- STIX 2.1: TLP:GREEN marking, validity date and source articles as external references.
- Confidence decay: an IP or URL score halves after 30 days without a new sighting (90 days for domains).
- Curated sources: ESET malware-ioc and abuse.ch (Feodo Tracker, SSL Blacklist) cross-checked with research.
- IPs: new scoring (source, network type, corroboration), ASN, operator and country enrichment.
- Two-factor authentication (TOTP) with recovery codes, English version of the website.
- Launch: indicator API, blocklists, trends and the CVE exploitation forecast model, with its published performance.
