| Abuse.ch | DNS | Active | 2026-09-02 | 47,680 | https://threatfox.abuse.ch/downloads/hostfile/ |
| Abuse.ch | IP | Active | 2026-09-02 | 0 | https://sslbl.abuse.ch/blacklist/sslipblacklist.csv |
| Abuse.ch | IP | Active | 2026-09-02 | 0 | https://sslbl.abuse.ch/blacklist/sslipblacklist.txt |
| Abuse.ch | IP | Active | 2026-09-02 | 0 | https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv |
| Abuse.ch | IP | Active | 2026-09-02 | 0 | https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.txt |
| Abuse.ch | IP | Active | 2026-09-02 | 5 | https://feodotracker.abuse.ch/downloads/ipblocklist.txt |
| Abuse.ch | IP | Active | 2026-09-02 | 0 | https://feodotracker.abuse.ch/blocklist/ |
| Abuse.ch | MD5 | Active | 2026-09-02 | 693 | https://bazaar.abuse.ch/export/txt/md5/recent/ |
| Abuse.ch | MD5 | Active | 2026-09-02 | 72 | https://threatfox.abuse.ch/export/csv/md5/recent/ |
| Abuse.ch | SHA1 | Active | 2026-09-02 | 685 | https://bazaar.abuse.ch/export/txt/sha1/recent/ |
| Abuse.ch | SHA256 | Active | 2026-09-02 | 684 | https://bazaar.abuse.ch/export/txt/sha256/recent/ |
| Abuse.ch | SHA256 | Active | 2026-09-02 | 90 | https://threatfox.abuse.ch/export/csv/sha256/recent/ |
| Abuse.ch | SSL | Active | 2026-09-02 | 10,616 | https://sslbl.abuse.ch/blacklist/sslblacklist.csv |
| Abuse.ch | URL | Active | 2026-09-02 | 298 | https://threatfox.abuse.ch/export/csv/urls/recent/ |
| Abuse.ch | URL | Active | 2026-09-02 | 30,533 | https://urlhaus.abuse.ch/downloads/csv_recent/ |
| Abuse.ch | JA3 | Active | 2026-09-02 | 97 | https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv |
| AlienVault | IP | Active | 2026-09-02 | 609 | https://reputation.alienvault.com/reputation.generic |
| Alienvault | IP | Active | 2026-09-02 | 609 | http://reputation.alienvault.com/reputation.data |
| Binarydefense | IP | Active | 2026-09-02 | 250 | https://www.binarydefense.com/banlist.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/all.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/ssh.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/mail.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/apache.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/imap.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/bots.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/bruteforcelogin.txt |
| Blocklist.de | IP | Active | — | 0 | https://lists.blocklist.de/lists/strongips.txt |
| Botvrij.eu | DNS | Active | 2026-09-02 | 2,810 | https://www.botvrij.eu/data/blocklist/blocklist_domain.csv |
| Botvrij.eu | MD5 | Active | 2026-09-02 | 0 | https://www.botvrij.eu/data/ioclist.md5 |
| Botvrij.eu | SHA1 | Active | 2026-09-02 | 0 | https://www.botvrij.eu/data/ioclist.md5 |
| Botvrij.eu | SHA256 | Active | 2026-09-02 | 16 | https://www.botvrij.eu/data/ioclist.sha256 |
| Botvrij.eu | MD5 | Active | 2026-09-02 | 28,342 | https://www.botvrij.eu/data/feed-osint/hashes.csv |
| CINSscore | IP | Active | 2026-09-02 | 15,000 | https://cinsscore.com/list/ci-badguys.txt |
| CISA | CVEID | Active | 2026-09-02 | 1,708 | https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv |
| CISA | CVEID | Active | 2026-09-02 | 1,708 | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
| Carbon Black | IP | Active | 2026-09-02 | 285 | https://github.com/carbonblack/active_c2_ioc_public/blob/main/cobaltstrike/actor-specific/cobaltstrike_luckymouse_ta428.csv |
| Carbon Black | IP | Active | 2026-09-02 | 164 | https://github.com/carbonblack/active_c2_ioc_public/blob/main/cobaltstrike/actor-specific/cobaltstrike_pyxie.csv |
| Cert.PL | URL | Active | 2026-09-02 | 0 | https://hole.cert.pl/domains/domains.csv |
| Daniel Austin MBCS | IP | Active | — | 0 | https://www.dan.me.uk/torlist/?exit |
| Daniel Austin MBCS | IP | Active | — | 0 | https://www.dan.me.uk/torlist/?full |
| Ellio | IP | Active | — | 0 | https://cdn.ellio.tech/community-feed |
| Github | SHA1 | Active | 2026-09-02 | 687 | https://raw.githubusercontent.com/aptnotes/data/master/APTnotes.csv |
| Github | URL | Active | 2026-09-02 | 688 | https://raw.githubusercontent.com/aptnotes/data/master/APTnotes.csv |
| Github | IP | Active | 2026-09-02 | 8,011 | https://raw.githubusercontent.com/fox-it/cobaltstrike-extraneous-space/master/cobaltstrike-servers.csv |
| GreenSnow | IP | Active | 2026-09-02 | 5,262 | https://blocklist.greensnow.co/greensnow.txt |
| Ipsum | IP | Active | 2026-09-02 | 115,538 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/1.txt |
| Ipsum | IP | Active | 2026-09-02 | 31,697 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt |
| Ipsum | IP | Active | 2026-09-02 | 15,048 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt |
| Ipsum | IP | Active | 2026-09-02 | 6,448 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txt |
| Ipsum | IP | Active | 2026-09-02 | 1,591 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/5.txt |
| Ipsum | IP | Active | 2026-09-02 | 231 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/6.txt |
| Ipsum | IP | Active | 2026-09-02 | 57 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/7.txt |
| Ipsum | IP | Active | 2026-09-02 | 15 | https://raw.githubusercontent.com/stamparm/ipsum/master/levels/8.txt |
| MISP Feed CERT-FR | MD5 | Active | 2026-09-02 | 2,199 | https://misp.cert.ssi.gouv.fr/feed-misp/hashes.csv |
| NIST | CVEID | Active | 2026-09-02 | 2,001 | https://services.nvd.nist.gov/rest/json/cves/2.0 |
| NetCraft | DNS | Active | 2026-09-02 | 35 | https://trends.netcraft.com/cybercrime/tlds |
| OpenPhish | URL | Active | 2026-09-02 | 300 | https://openphish.com/feed.txt |
| Phishing Army | URL | Active | 2026-09-02 | 0 | https://phishing.army/download/phishing_army_blocklist.txt |
| Phishing Army | URL | Active | 2026-09-02 | 0 | https://phishing.army/download/phishing_army_blocklist_extended.txt |
| Proofpoint | IP | Active | 2026-09-02 | 533 | https://rules.emergingthreats.net/blockrules/compromised-ips.txt |
| SNORT | IP | Active | 2026-09-02 | 0 | https://snort.org/downloads/ip-block-list |
| SiberKapan | IP | Active | — | 0 | https://siberkapan.org/api/v1/list/txt |
| SiberKapan | DNS | Active | — | 0 | https://siberkapan.org/domains/siberkapan/txt |
| Spamhaus Project | IP | Active | 2026-09-02 | 1,706 | https://www.spamhaus.org/drop/drop_v4.json |
| ThreatCluster | DNS | Active | 2026-09-02 | 62 | https://threatcluster.io/api/iocs/public/domains.txt |
| ThreatCluster | IP | Active | 2026-09-02 | 42 | https://threatcluster.io/api/iocs/public/ips.txt |
| ThreatCluster | MD5 | Active | 2026-09-02 | 231 | https://threatcluster.io/api/iocs/public/hashes.txt |
| ThreatCluster | SHA1 | Active | 2026-09-02 | 17 | https://threatcluster.io/api/iocs/public/hashes.txt |
| ThreatCluster | SHA256 | Active | 2026-09-02 | 301 | https://threatcluster.io/api/iocs/public/hashes.txt |
| ThreatMon | URL | Active | 2026-09-02 | 230 | https://github.com/ThreatMon/ThreatMon-Daily-C2-Feeds |
| X4BNet | IP | Active | 2026-09-02 | 10,814 | https://github.com/X4BNet/lists_vpn/blob/main/output/vpn/ipv4.txt |
| drb-ra | IP | Active | 2026-09-02 | 243 | https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv |
| drb-ra | URL | Active | 2026-09-02 | 225 | https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/domainC2swithURLwithIP-30day-filter-abused.csv |
| drb-ra | IP | Active | 2026-09-02 | 58 | https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/domainC2swithURLwithIP-30day-filter-abused.csv |
| drb-ra | URL | Active | 2026-09-02 | 225 | https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/domainC2s.csv |
| drb-ra | IP | Active | 2026-09-02 | 2,078 | https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/unverified/IPC2s.csv |
| eCrimeLabs | CVEID | Active | 2026-09-02 | 3,218 | https://feeds.ecrimelabs.net/data/metasploit-cve |
| fireho | IP | Active | 2026-09-02 | 4,650 | https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level1.netset |
| mthcht | NamePipe | Active | 2026-09-02 | 0 | https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_named_pipe_list.csv |
| mthcht | IP | Active | 2026-09-02 | 3 | https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/NordVPN/nordvpn_ips_list.csv |
| mthcht | IP | Active | 2026-09-02 | 10,607 | https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/ProtonVPN/protonvpn_ip_list.csv |
| ransomware.live | RANSOMWARELEAK | Active | — | 0 | https://api.ransomware.live/allcyberattacks |
| threatview.io | IP | Active | 2026-09-02 | 4 | https://threatview.io/Downloads/Experimental-IOC-Tweets.txt |
| threatview.io | IP | Active | 2026-09-02 | 804 | https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt |
| threatview.io | DNS | Active | 2026-09-02 | 972 | https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt |
| threatview.io | IP | Active | 2026-09-02 | 23,903 | https://threatview.io/Downloads/IP-High-Confidence-Feed.txt |
| threatview.io | IP | Active | — | 0 | https://lists.blocklist.de/lists/ftp.txt |
| threatview.io | DNS | Active | 2026-09-02 | 588 | https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt |
| threatview.io | MD5 | Active | 2026-09-02 | 883 | https://threatview.io/Downloads/MD5-HASH-ALL.txt |
| threatview.io | URL | Active | 2026-09-02 | 2,555 | https://threatview.io/Downloads/URL-High-Confidence-Feed.txt |
| threatview.io | SHA1 | Active | 2026-09-02 | 595 | https://threatview.io/Downloads/SHA-HASH-FEED.txt |
| tsirolnik | DNS | Active | 2026-09-02 | 51,620 | https://raw.githubusercontent.com/tsirolnik/spam-domains-list/master/spamdomains.txt |
| tweetfeed.live | URL | Active | 2026-09-02 | 0 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv |
| tweetfeed.live | DNS | Active | 2026-09-02 | 0 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv |
| tweetfeed.live | IP | Active | 2026-09-02 | 0 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv |
| tweetfeed.live | SHA256 | Active | 2026-09-02 | 0 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv |
| tweetfeed.live | MD5 | Active | 2026-09-02 | 0 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv |
| tweetfeed.live | URL | Active | 2026-09-02 | 227 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv |
| tweetfeed.live | DNS | Active | 2026-09-02 | 120 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv |
| tweetfeed.live | IP | Active | 2026-09-02 | 20 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv |
| tweetfeed.live | SHA256 | Active | 2026-09-02 | 10 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv |
| tweetfeed.live | MD5 | Active | 2026-09-02 | 4 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv |
| tweetfeed.live | URL | Active | 2026-09-02 | 4,779 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv |
| tweetfeed.live | DNS | Active | 2026-09-02 | 3,363 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv |
| tweetfeed.live | IP | Active | 2026-09-02 | 565 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv |
| tweetfeed.live | SHA256 | Active | 2026-09-02 | 366 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv |
| tweetfeed.live | MD5 | Active | 2026-09-02 | 187 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv |
| tweetfeed.live | URL | Active | 2026-09-02 | 80,546 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv |
| tweetfeed.live | DNS | Active | 2026-09-02 | 41,620 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv |
| tweetfeed.live | IP | Active | 2026-09-02 | 8,674 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv |
| tweetfeed.live | SHA256 | Active | 2026-09-02 | 2,567 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv |
| tweetfeed.live | MD5 | Active | 2026-09-02 | 2,356 | https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv |
| urlabuse | URL | Active | 2026-09-02 | 0 | https://urlabuse.com/public/data/data.txt |
| urlabuse | URL | Active | 2026-09-02 | 0 | https://urlabuse.com/public/data/phishing_url.txt |
| urlabuse | URL | Active | 2026-09-02 | 0 | https://urlabuse.com/public/data/hacked_url.txt |
| urlabuse | URL | Active | 2026-09-02 | 0 | https://urlabuse.com/public/data/malware_url.txt |
| Carbon Black | IP | Offline | — | 0 | https://github.com/carbonblack/active_c2_ioc_public/blob/main/shadowpad/shadowpad_202209.tsv |
| Cisco Talos | IP | Offline | — | 0 | http://www.talosintelligence.com/documents/ip-blacklist |
| CyberCure | MD5 | Offline | — | 0 | https://api.cybercure.ai/feed/get_hash?type=csv |
| CyberCure | URL | Offline | — | 0 | https://api.cybercure.ai/feed/get_url?type=csv |
| CyberCure | IP | Offline | — | 0 | https://api.cybercure.ai/feed/get_ips?type=csv |
| DigitalSide Threat-Intel | URL | Offline | — | 0 | https://osint.digitalside.it/Threat-Intel/lists/latesturls.txt |
| DigitalSide Threat-Intel | IP | Offline | — | 0 | https://osint.digitalside.it/Threat-Intel/lists/latesturls.txt |
| DigitalSide Threat-Intel | DNS | Offline | — | 0 | https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt |
| PhishTank | URL | Offline | — | 0 | http://data.phishtank.com/data/online-valid.json |
| cydave | IP | Offline | — | 0 | https://blocklists.0dave.ch/ssh.txt |
| montysecurity | IP | Offline | — | 0 | https://github.com/montysecurity/C2-Tracker/blob/main/data/Brute%20Ratel%20C4%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://github.com/montysecurity/C2-Tracker/blob/main/data/Sliver%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://github.com/montysecurity/C2-Tracker/blob/main/data/Posh%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://github.com/montysecurity/C2-Tracker/blob/main/data/Metasploit%20Framework%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://github.com/montysecurity/C2-Tracker/blob/main/data/Havoc%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/BurpSuite%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Deimos%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/GoPhish%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Gotham%20Stealer%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Hachcat%20Cracking%20Tool%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Metasploit%20Framework%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Mythic%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/NimPlant%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/PANDA%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Posh%20C2%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/PowerSploit%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/XMRig%20Monero%20Cryptominer%20IPs.txt |
| montysecurity | IP | Offline | — | 0 | https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/all.txt |
| mrlooquer | IP | Offline | — | 0 | https://iocfeed.mrlooquer.com/feed.csv |
| mrlooquer | DNS | Offline | — | 0 | https://iocfeed.mrlooquer.com/feed.csv |
| virtualfabric | DNS | Offline | — | 0 | https://nocdn.nrd-list.com/0/nrd-list-32-days.txt |
| virtualfabric | DNS | Offline | — | 0 | https://nocdn.threat-list.com/0/domains.txt |
| virtualfabric | DNS | Offline | — | 0 | https://nocdn.threat-list.com/1/domains.txt |