Threat Intel Feeds

Welcome to Antisource Threat Intelligence feeds. This is an ongoing project to identify, parse, validate, extend and consolidate sources of available threat intel data provided by the infosec community (OSINT). The final data is then made available to the public as CSV, TAB, JSON, and single-column text files. Other export formats will be created in the future. Currently these feeds contain data from the following sites:

MalwareDomainsList
Abuse.ch ZeuS Tracker
Abuse.ch SSL Blacklist
Abuse.ch RansomwareTracker
Malc0de Malicious Executables
PhishTank Verified Phishing
TOR Exit Nodes
Botrij MISP-powered indicators
DynDNS Security Research (Ponmocup)
Project Honeypot
DNS Sinkhole List
Bambenek Consulting OSINT

Please note the DNS Sinkholes file is a static list, originating from Lesley Carhart's (hacks4pancakes) diligently compiled spreadsheet provided here. I removed a couple ranges that were noted to contain legitimate sites.

New files are generated every 4 hours.

Threat Intel Feed CSV
Threat Intel Feed TAB
Threat Intel Feed JSON
Threat Intel Feed IP Blocklist
Threat Intel Feed Domain Blocklist
Threat Intel Feed Combined Blocklist

Any comments, questions or concerns please contact me on Twitter @rswestmoreland.