Threat intel distribution
Intel Feeds
Bulk IOC distribution. Domains, IPs, URLs, file hashes per source — refreshed daily in three SIEM-consumable formats. See Sigma Rules for detection logic.
Subscribe: GET /intel/manifest.json for the catalog.
- Feeds
- 4
- Total indicators
- 10,953
- Window
- 7 days
- Last refreshed
- June 10, 2026
Available feeds
| Feed | Source | IOC type | Indicators | Downloads |
|---|---|---|---|---|
| MISP — Suspicious Domains | misp | domain | 5,000 | CSVMISPSTIX |
| MISP — Flagged IPs | misp | ip | 1,082 | CSVMISPSTIX |
| URLhaus — Malware Distribution URLs | urlhaus | url | 4,222 | CSVMISPSTIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 649 | CSVMISPSTIX |
Subscription
Poll the manifest, compare each feed's generated_at against your last-pulled timestamp,
pull what's newer. Trailing 7-day window per feed;
cap of 5,000 indicators per file.