The public IOC feed.

Every list in every format, on stable URLs. Point a pi-hole, pfSense, OPNsense or a FortiGate external feed straight at a file.

Validated on ingest and aged out after 30 days, so the block-ready lists are safe to consume blind. A false positive, once marked, is barred from every export forever — [email protected] removes one within a business day.

The full-history files need a free API key sent as X-API-Key. They are for hunting, not blocking — old infrastructure gets reallocated.

Daily snapshots on GitHub, so git log tells you when an indicator first appeared.

A sample of the current window. Every value links to its entity page: the incidents it appeared in, the validation verdict, and for domains a live check of what the site serves.

What each indicator is used for, with its own files and RSS. Abused services and influence operations are left out of domains.txt, ips.txt and feed.txt, so you ask for those by name.

• Malware 1,318
• Crypto theft 426
• Command and control 277
• Phishing 269
• Supply chain 93
• Botnets 50
• Scams and fraud 49
• Traffic distribution 49
• Ransomware 49
• Exploit delivery 48
• Data exfiltration 31
• Scanners 25

Stories, not indicators: the 50 latest threat clusters as RSS, one entry per story instead of one per outlet, and ransomware leak-site victims as a second feed.

The same indicators are also republished as AlienVault OTX pulses. Every public feed — CVEs, weaponised exploits, dark-web victims, onions and groups — is listed on the feeds page, with an OPML bundle that imports the RSS ones in one go.

Ransomware leak-site victims and the onion infrastructure behind them. Not indicators for a blocklist, an observation record of who has been named, by which group, and where the post lives.

Prefer a versioned copy? The same files are snapshotted daily into Jam0k/Ransomware-Intel on GitHub, including a victims-firstparty.csv of only the rows we read off the leak sites ourselves, so git log tells you when a victim first appeared.

These are claims published by the groups themselves. Groups routinely re-post old victims, exaggerate, and name organisations they never breached, so a listing is reporting on what was posted, not confirmation of a breach. Rows we read off the leak sites ourselves are marked first_party=yes, with the group's claimed data size and the post URL; our own screenshots are face-blurred and watermarked. The full record lives at /dark-web.