Get ThreatCluster IOCs into your tools
Four public, no-key paths cover most needs; the full endpoint list is at the bottom.
Start here
The four things people actually come for. All four are public, no key required.
Block malicious IPs and domains
A free blocklist for your firewall, pi-hole, pfSense or DNS sinkhole. High-confidence, last 30 days, one indicator per line.
$curl https://threatcluster.io/api/iocs/public/feed.txtAlso .json (with sources and reasons) and .csv. Full details on the IOC feed page.
Sync with MISP
Point your MISP instance at one URL and it polls the rest. The public mirror gives the 10 newest events, no key. Starter and above unlock 50 events plus historical backfill.
$https://threatcluster.io/misp/manifest.jsonFor the full feed,
/api/misp/manifest.json?token=…gives 50 events with?since=YYYY-MM-DDreplay.Pull one incident's full data
Everything for a single cluster as a STIX 2.1 bundle: the report, actors, malware, attack patterns and indicators with their relationships. Built for MISP, OpenCTI or Anomali ingest.
$curl ".../api/threats/{id}/stix?tlp=clear"Just the indicators:
/api/threats/{id}/iocs. Just the TTPs as an ATT&CK Navigator layer:/api/threats/{id}/attack-navigator.Look up one indicator
You have an unknown IP, domain or hash. Find out whether we have seen it, and in which reports, with titles, threat scores and dates.
$curl ".../api/iocs/lookup?value=1.2.3.4"Case-insensitive. Cap results with
?limit=N(max 100).
Need more?
An API key widens the time window to your plan's lookback (free 7 days, Starter 90, Growth and above full history), adds every IOC type (hashes, wallets, emails), and includes medium and low confidence. The versioned /api/public/v1 endpoints work on every plan with the same ladder. Every option is in the full reference below; Starter is $7.99 a month (plans).
Full reference
Every endpoint, format, auth and tier.
Show every endpoint
| Endpoint | What it's for | Format | Auth / tier | Notes |
|---|---|---|---|---|
| Bulk feeds, every confirmed bad indicator, site-wide, rolling window | ||||
/api/public/v1/taxii2/ | TAXII 2.1 server for Sentinel, Elastic, OpenCTI and other clients | STIX 2.1 | API key, Starter and up | Two collections, 90-day window, 3 credits a page |
| /api/iocs/public/feed.txt | Free blocklist | txt | Public · no auth | One IOC per line, last 30 days, domains + IPs, high confidence. pi-hole / pfSense / sinkholes. |
| /api/iocs/public/feed.json | Blocklist + evidence | json | Public · CORS | Adds confidence, reason, first/last seen, up to 5 source citations per IOC. |
| /api/iocs/public/feed.csv | Spreadsheet | csv | Public | Sources pipe-separated inside the cell. |
| /api/iocs/feed | Fuller feed | txt · csv · json · stix | API key / Starter+ | Wider window, every IOC type, medium/low included, defang option. Cache 15 min. Your API key is the token. |
| /api/iocs/export | File download | txt · csv · json | API key / Starter+ | Same data as a downloaded file. Filter ?confidence=, ?hours=, ?types=. |
| /api/public/v1/iocs/feed | Feed, versioned API | txt · csv · json · stix | API key, any plan | Stable v1 contract (scope iocs:read); the lookback follows your plan. |
| /api/public/v1/iocs/export | Download, versioned API | txt · csv · json | API key, any plan | Public-API equivalent of /api/iocs/export; the lookback follows your plan. |
| Look up one threat, you supply a cluster ID | ||||
| /api/threats/{id}/iocs | Just this incident's IOCs | txt · csv · json | Public | Excludes false_positive. Optional ?defang=true. |
| /api/threats/{id}/stix | Full incident graph | STIX 2.1 Bundle | Public | Report + ThreatActor + Malware + AttackPattern + Vulnerability + Indicator + relationships. TLP-marked. |
| /api/threats/{id}/attack-navigator | Just this incident's TTPs | ATT&CK Navigator layer | Public | JSON layer (no IOCs). Drop into MITRE Navigator. |
| /api/public/v1/threats/{id}/iocs | Incident IOCs, versioned API | txt · csv · json | API key, any plan | Public-API contract for embedded integrations. |
| /api/public/v1/threats/{id}/stix | Incident graph, versioned API | STIX 2.1 Bundle | API key, any plan | Public-API contract for embedded integrations. |
| Look up one indicator, you supply the value | ||||
| /api/iocs/lookup?value=… | Reverse lookup | json | Public | Clusters mentioning this IOC, with titles, threat scores, dates. Case-insensitive. ?limit=N (max 100). |
| MISP feed, point MISP at one URL, it polls the rest | ||||
| /misp/manifest.json | Public MISP mirror | MISP feed manifest | Public · 10 events | Add /misp/{event_uuid}.json per event, /misp/hashes.csv for bulk hashes. |
| /api/misp/manifest.json?token=… | Full MISP feed | MISP feed manifest | Token / Starter+ · 50 events | Historical replay via ?since=YYYY-MM-DD or ?days=N. |
Confidence levels
confirmed(default)Validated by the offline classifier with high/medium/low confidence. Excludes pending and false-positive.pendingFreshly extracted from articles but not yet validated. Returned in theX-IOC-Pending-Countheader on every response so consumers can see the lag.high/medium/lowIndividual filters for slicing the validated set.false_positiveClassifier-rejected indicators (legitimate domains, security-vendor IPs, and so on). Excluded from every default response.
Usage and licensing
Rate limits. Public endpoints: 60 requests per minute, per IP, no key required. Keyed endpoints follow the plan: free 30/minute, Starter 120, Business 600. Full detail on the API page.
Redistribution and attribution. The public feed is free to use inside your own environment and in non-commercial community defence work, with attribution to ThreatCluster. Redistribution as part of a commercial product or paid service needs a licence, so talk to us first. Authenticated exports follow your plan's terms.