The public IOC feed.
Malicious domains, IP addresses, file hashes and attacker wallets, extracted from the last 30 days of security reporting and validated before they ship. Free, refreshed hourly, no login, no key. Use it with attribution.
curl https://threatcluster.io/api/iocs/public/feed.txtDownloads
Every list in every format, on stable URLs. Point a pi-hole, pfSense, OPNsense or a FortiGate external feed straight at a file.
| List | Last 30 days — block-ready | Full history — hunt, don't block |
|---|---|---|
| Domains phishing, malware distribution, C2 — for DNS sinkholes | txt·csv | txt·csv |
| DNS filters the domain list as a hosts file or AdGuard filter — pi-hole, AdGuard Home, uBlock | hosts·adguard | — |
| IP addresses scanners, exploit sources, C2 endpoints — for firewall deny-lists | txt·csv | txt·csv |
| File hashes MD5, SHA-1, SHA-256 of named malware — for EDR blocklists and retro-hunting | txt·csv | txt·csv |
| Wallets ransom, theft and scam proceeds — for chain analysis, never in the network blocklist | txt·csv | txt·csv |
| Everything domains + IPs as one blocklist; the JSON carries reasons, dates and sources | txt·json·csv | json·csv |
| Suricata rules a DNS-query alert per domain and an IP alert per address; Snort 3 reads the same syntax | rules | — |
| MISP the same indicators as MISP events — point a MISP server at the manifest | manifest | 50-event replay on Starter and above — details |
Validated on ingest and aged out after 30 days, so the block-ready lists are safe to consume blind. A false positive, once marked, is barred from every export forever — [email protected] removes one within a business day.
The full-history files need a free API key sent as X-API-Key. They
are for hunting, not blocking — old infrastructure gets reallocated.
Daily snapshots on GitHub, so git log tells you when an indicator first
appeared.
In the feed right now
A sample of the current window. Every value links to its entity page: the incidents it appeared in, the validation verdict, and for domains a live check of what the site serves.
| Domain | Reason | Last seen | Tags |
|---|---|---|---|
| ads-it-assets.com | Listed in network logs for compromise checks, indicating attacker control. | Nov 6 | |
| ad.starx-net.com | Exfiltration endpoint for data collected by AndroSnitch malware | Nov 6 | |
| assets-int.com | Listed in network logs for compromise checks, indicating attacker control. | Nov 6 | |
| cdn.adv-static.com | Listed in network logs for compromise checks, indicating attacker control. | Nov 6 | |
| edge-ord.clouds-stacks.com | Listed in network logs for compromise checks, indicating attacker control. | Nov 6 | |
| wpvortex-mod.com | Listed in network logs for compromise checks, indicating attacker control. | Nov 6 | |
| amasonses.com | Misspelled domain used for SPF abuse, indicating attacker control. | Nov 5 | |
| amzonses.com | Misspelled domain used for SPF abuse, indicating attacker control. | Nov 5 | |
Showing the first 150 of 783. The download above has every one.
By category
What each indicator is used for, with its own files and RSS. Abused services and influence operations are left out of domains.txt, ips.txt and feed.txt, so you ask for those by name.
- Malware 1,446
- Crypto theft 495
- Command and control 404
- Phishing 214
- Supply chain 87
- Botnets 54
- Exploit delivery 54
- Scams and fraud 51
- Ransomware 49
- Data exfiltration 30
- Proxies and tunnels 29
More feeds
Stories, not indicators: the 50 latest threat clusters as RSS, one entry per story instead of one per outlet, and ransomware leak-site victims as a second feed.
The same indicators are also republished as AlienVault OTX pulses. Every public feed — CVEs, weaponised exploits, dark-web victims, onions and groups — is listed on the feeds page, with an OPML bundle that imports the RSS ones in one go.
Dark web
Ransomware leak-site victims and the onion infrastructure behind them. Not indicators for a blocklist, an observation record of who has been named, by which group, and where the post lives.
Prefer a versioned copy? The same files are snapshotted daily into Jam0k/Ransomware-Intel on GitHub, including a victims-firstparty.csv of only the rows we read off the
leak sites ourselves, so git log tells you when a victim first appeared.
These are claims published by the groups themselves. Groups routinely
re-post old victims, exaggerate, and name organisations they never breached, so a
listing is reporting on what was posted, not confirmation of a breach. Rows we read off
the leak sites ourselves are marked first_party=yes, with the group's
claimed data size and the post URL; our own screenshots are face-blurred and
watermarked. The full record lives at /dark-web.
Questions
How often does the feed update?
The dataset rebuilds hourly from the article pipeline. Indicators enter as soon as validated reporting supports them and age out after 30 days without fresh sightings.
Can I use this commercially?
Free in your own environment and in non-commercial community defence work — credit "ThreatCluster" with a link to threatcluster.io. Redistributing it inside a commercial product or service needs a licence: email [email protected].
Can I block these lists blind?
That's what they're built for. Every indicator survives a validation pipeline before it ships, anything ever marked as a false positive is barred from every export forever, and every export re-checks each value against government and academic suffixes, e-gov portals and freemail providers on the way out.
I need more volume, history, or STIX/MISP/TAXII.
The format matrix covers STIX 2.1, TAXII, MISP feeds and hash exports; the authenticated API adds full history, per-cluster IOC packs and custom windows. Pricing.
Every indicator links to its incident.
The actors, the CVEs, the victims and the full reporting trail are one click upstream. A free account gets you the platform behind the feed.