Judge the feed on real data
174 real indicators, taken from the feed exactly as customers receive it: confidence of at least 60, network enrichment for IPs (ASN, operator, country) and a link to the publication that cites them.
The 500 most reliable indicators of each type (confidence of at least 80, seen in the last 30 days), refreshed hourly with a 24-hour delay. Plug them straight into your firewall, MISP or SIEM.
| Feed | URL |
|---|---|
| IP addresses | https://ctiforecast.com/feeds/public/ip.txt |
| Domains | https://ctiforecast.com/feeds/public/domain.txt |
| SHA-256 hashes | https://ctiforecast.com/feeds/public/sha256.txt |
MISP: Sync Actions → Feeds → Add Feed, Freetext Parsed Feed format, one URL per feed. pfSense / OPNsense: URL Table alias with the IP feed URL.
Free for defensive use within your organisation; redistribution or resale prohibited. Real time, every type, sources, TAXII 2.1 and CVE forecasts are in the Pro plan (14-day trial, no card).
Columns: value, type, confidence, first_seen, last_seen, mentions, malware_family, asn, as_name, country, reference_url, reference_source.
To protect our customers, the sample only contains indicators seen more than 7 days ago. The paid feed is updated every 5 minutes, with up to 5 sources per indicator, the API, TAXII 2.1 and blocklists.
Values are not defanged: do not open them in a browser.
