Every feed, one page.

Threat Feed Public RSS 2.0 50 items · 1h refresh

The top 50 trending threat clusters from the last 7 days, the same content as the home page. Each item links to a cluster page with the summary, timeline, source articles and related entities.

Also served at /rss and /feed.

Early Warning Feed Public RSS 2.0 50 items · 15 min refresh

Stories that rest on one trusted source so far: a researcher disclosure, a vendor advisory, a CERT notice or a Hacker News warning, published the moment it appears instead of waiting for a second outlet. Titles are prefixed [Early signal, one source] until a second publisher covers the story, then [Corroborated]. The same list as /early-warning.

Vulnerabilities Feed Public RSS 2.0 50 items · 1h refresh

Latest CVEs from the last 7 days, enriched with severity, CISA KEV status and public PoC availability. What is hitting the news cycle this week, not the firehose of every NVD entry. Item titles look like CVE-2026-28318 [KEV] [Exploit].

Exploits Feed Public RSS 2.0 50 items · 1h refresh

CVEs with publicly available proof-of-concept code, from the last 30 days, sorted by exploit availability then CVSS, the same content as /exploits.

Dark Web Victims Feed Public RSS 2.0 50 items · 1h refresh

Newly observed victims on ransomware leak sites, from the last 14 days. Titles read “Victim, claimed by [Group]”, with description fields for country, sector and the group's public post text. Aggregated from /dark-web.

Dark Web Data, CSV & JSON Public CSV / JSON 1h refresh

The same corpus behind the RSS feed, as structured data. Victims carry group, country, sector and the leak-site post URL; the onion list covers extortion leak-site addresses with their operator and current status.

These are claims published by the groups themselves. A listing is not confirmation that a breach occurred, or that the group's claim is accurate.

Site rows carry the page title, claimed operator, language, login/captcha gate and a link to our own watermarked screenshot where we have one.

Victim feeds default to a 90-day window (CSV) and 30 days (JSON); add ?days=365 for more. The JSON carries company enrichment, legal name, headquarters, data size, where the leak post included it.

Snapshotted daily to GitHub with history: Jam0k/Ransomware-Intel , victims (90d / 365d / first-party only), groups and onion addresses.

IOC Blocklist Public TXT JSON CSV 1h refresh

High-confidence malicious domains and IP addresses from the last 30 days, ready to paste into pfSense, Pi-hole or a firewall blocklist. Plain text for drop-in use, JSON when you want the source attribution, CSV for spreadsheets. Hosts, AdGuard and Suricata variants, per-type files and full history are on the IOC page.

MISP Feed Public MISP 1h refresh

MISP-compatible public mirror: the 10 newest events, no key or token required. Starter and above unlock 50 events with historical replay (see formats). Manifest at /misp/manifest.json, per-event JSON at /misp/{uuid}.json, optional hashes index at /misp/hashes.csv. Add it in your MISP UI under Sync Actions → List Feeds.

AlienVault OTX Pulses Public OTX

ThreatCluster clusters published as pulses on AlienVault OTX. Subscribe to the projectargus account in OTX and the indicators flow straight into any tool already wired to the Open Threat Exchange, no extra integration on your side.

My Interests & Custom Feeds Starter and above RSS 2.0

Feeds filtered to the entities and keywords you track, your vendors, your sector, your suppliers. Set them up in Settings → Interests, or save a Custom Feed from any filter combination. Authenticated by session cookie, so a signed-in browser needs no API token. Custom feeds come with Starter, $7.99 a month (plans).