Public IOC blocklist

High-confidence domains and IPs, last 30 days, refreshed hourly. Free, no auth.

— IOCs — domains — IPs
.txt — plain .json — with sources .csv — spreadsheet 
curl https://threatcluster.io/api/iocs/public/feed.txt
Fresh from the source. We extract IOCs straight from the threat-intel report the moment it's published — typically days before the same indicators reach the major reputation aggregators. Click any source to read the report.
Recent additions Latest 10 of —
Type Value Last seen Sources
Loading…

Scope. Confidence high only. Last 30 days. Domains, IPv4, IPv6. Excludes government TLDs, academia, reserved ranges, and ~120 hard-coded legit domains.

Attribution. CC-BY 4.0 — please credit "ThreatCluster" with a link to threatcluster.io.

False positive? [email protected] — removed within one business day.

Need more? Full integration matrix (STIX, MISP, hashes, custom windows) · Pricing