Open-source intelligence
More context for your investigations
MISP's default feeds bring together public indicators and threat intelligence from community providers. Use them to investigate matches in your events and attributes, discover related activity, and compare coverage across sources.
Cache & correlate
Check your existing attributes against feed indicators without creating local events.
Fetch & import
Bring selected feed content into your MISP instance for further analysis.
MISP · Community intelligence
Explore the default feeds
Find public threat intelligence sources for correlation and import in MISP. Browse by provider, search for a topic, or choose a feed format.
108 feeds52 providers47 CSV43 FREETEXT18 MISP
CSV
abuse.ch SSL IPBL abuse.ch
Open feed sslbl.abuse.ch
Feed details
Source URL or path https://sslbl.abuse.ch/blacklist/sslblacklist.csvInput transport network
Enabled in source metadata Yes
CSV
alienvault reputation generic .alienvault.com
Open feed reputation.alienvault.com
Feed details
Source URL or path https://reputation.alienvault.com/reputation.genericInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
All current domains belonging to known malicious DGAs osint.bambenekconsulting.com
Open feed osint.bambenekconsulting.com
Feed details
Source URL or path https://osint.bambenekconsulting.com/feeds/dga-feed-high.csvInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
blocklist.de/lists/all.txt blocklist.de
Open feed lists.blocklist.de
Feed details
Source URL or path https://lists.blocklist.de/lists/all.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
blocklist.greensnow.co greensnow.co
Open feed blocklist.greensnow.co
Feed details
Source URL or path https://blocklist.greensnow.co/greensnow.txtInput transport network
Enabled in source metadata Yes
CSV
blockrules of rules.emergingthreats.net rules.emergingthreats.net
Open feed rules.emergingthreats.net
Feed details
Source URL or path https://rules.emergingthreats.net/blockrules/compromised-ips.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
ci-badguys.txt cinsscore.com
Open feed cinsscore.com
Feed details
Source URL or path https://cinsscore.com/list/ci-badguys.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
CIRCL OSINT Feed CIRCL
Open feed www.circl.lu
Feed details
Source URL or path https://www.circl.lu/doc/misp/feed-osintInput transport network
Enabled in source metadata Yes
FREETEXT
cybercrime-tracker.net - all cybercrime-tracker.net
Open feed cybercrime-tracker.net
Feed details
Source URL or path https://cybercrime-tracker.net/all.phpInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
CyberCure - Blocked URL Feed www.cybercure.ai
Open feed api.cybercure.ai
Feed details
Source URL or path https://api.cybercure.ai/feed/get_url?type=csvInput transport network
Enabled in source metadata Yes
CSV
CyberCure - Hash Feed www.cybercure.ai
Open feed api.cybercure.ai
Feed details
Source URL or path https://api.cybercure.ai/feed/get_hash?type=csvInput transport network
Enabled in source metadata No
CSV
CyberCure - IP Feed www.cybercure.ai
Open feed api.cybercure.ai
Feed details
Source URL or path https://api.cybercure.ai/feed/get_ips?type=csvInput transport network
Enabled in source metadata No
FREETEXT
diamondfox_panels pan-unit42
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/pan-unit42/iocs/master/diamondfox/diamondfox_panels.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
DigitalSide Threat-Intel OSINT Feed osint.digitalside.it
Open feed osint.digitalside.it
Feed details
Source URL or path https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/Input transport network
Enabled in source metadata No
CSV
DNS CH TXT version.bind dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/dnsversion.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
DNS recursion desired dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/dnsrd.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
DNS recursion desired IN ANY dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/dnsrdany.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Domains from High-Confidence DGA-based C&C Domains Actively Resolving osint.bambenekconsulting.com
Open feed osint.bambenekconsulting.com
Feed details
Source URL or path https://osint.bambenekconsulting.com/feeds/c2-dommasterlist-high.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
ELLIO: IP Feed (Community version) ellio.tech
Open feed cdn.ellio.tech
Feed details
Source URL or path https://cdn.ellio.tech/community-feedInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Feodo IP Blocklist abuse.ch
Open feed feodotracker.abuse.ch
Feed details
Source URL or path https://feodotracker.abuse.ch/downloads/ipblocklist.csvInput transport network
Enabled in source metadata Yes
FREETEXT
firehol_level1 iplists.firehol.org
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level1.netsetInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
hideNseek LAB - CSV Threat Feed hideNseek LAB
Open feed data.hidenseek.dev
Feed details
Source URL or path https://data.hidenseek.dev/download/cti/hns_cti.csvInput transport network
Enabled in source metadata No
FREETEXT
hideNseek LAB - IP Blocklist hideNseek LAB
Open feed data.hidenseek.dev
Feed details
Source URL or path https://data.hidenseek.dev/download/cti/hns_blocklist.txtInput transport network
Enabled in source metadata No
FREETEXT
hideNseek LAB - Threat Intelligence JSON hideNseek LAB
Open feed data.hidenseek.dev
Feed details
Source URL or path https://data.hidenseek.dev/download/cti/hns_cti.jsonInput transport network
Enabled in source metadata No
CSV
HoneyLabs active exploiters HoneyLabs
Open feed honeylabs.net
Feed details
Source URL or path https://honeylabs.net/feed/exploitersInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
HoneyLabs malware infrastructure HoneyLabs
Open feed honeylabs.net
Feed details
Source URL or path https://honeylabs.net/feed/malware-infrastructureInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
http://cybercrime-tracker.net gatelist http://cybercrime-tracker.net gatelist
Open feed cybercrime-tracker.net
Feed details
Source URL or path https://cybercrime-tracker.net/ccamgate.phpInput transport network
Enabled in source metadata Yes
FREETEXT
http://cybercrime-tracker.net hashlist http://cybercrime-tracker.net hashlist
Open feed cybercrime-tracker.net
Feed details
Source URL or path https://cybercrime-tracker.net/ccamlist.phpInput transport network
Enabled in source metadata Yes
MISP
Infoblox-Threat-Intelligence infoblox.com
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/infobloxopen/threat-intelligence/main/indicators/mispInput transport network
Enabled in source metadata Yes
CSV
IP protocol 41 dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/proto41.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
ip-block-list - snort.org https://snort.org
Open feed snort.org
Feed details
Source URL or path https://snort.org/downloads/ip-block-listInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
IPs from High-Confidence DGA-Based C&Cs Actively Resolving - requires a valid license osint.bambenekconsulting.com
Open feed osint.bambenekconsulting.com
Feed details
Source URL or path https://osint.bambenekconsulting.com/feeds/c2-ipmasterlist-high.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
ipspamlist ipspamlist
Open feed www.ipspamlist.com
Feed details
Source URL or path http://www.ipspamlist.com/public_feeds.csvInput transport network
Enabled in source metadata Yes
FREETEXT
IPsum (aggregation of all feeds) - level 1 - lot of false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/1.txtInput transport network
Enabled in source metadata No Tags osint:source-type="automatic-collection"
FREETEXT
IPsum (aggregation of all feeds) - level 2 - medium false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
IPsum (aggregation of all feeds) - level 3 - low false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
IPsum (aggregation of all feeds) - level 4 - very low false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
IPsum (aggregation of all feeds) - level 5 - ultra false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/5.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
IPsum (aggregation of all feeds) - level 6 - no false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/6.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
IPsum (aggregation of all feeds) - level 7 - no false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/7.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
IPsum (aggregation of all feeds) - level 8 - no false positives IPsum
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/stamparm/ipsum/master/levels/8.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
CSV
James Brine Bruteforce IPs jamesbrine.com.au
Open feed jamesbrine.com.au
Feed details
Source URL or path https://jamesbrine.com.au/csvInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
List of malicious domains in Poland CERT-PL
Open feed hole.cert.pl
Feed details
Source URL or path https://hole.cert.pl/domains/domains.txtInput transport network
Enabled in source metadata Yes
CSV
List of malicious hashes Banco do Brasil S.A
Open feed cti.bb.com.br
Feed details
Source URL or path https://cti.bb.com.br:8443/hash-list.csvInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
malshare.com - current all malshare.com
Open feed malshare.com
Feed details
Source URL or path https://malshare.com/daily/malshare.current.all.txtInput transport network
Enabled in source metadata No
CSV
malsilo.domain MalSilo
Open feed malsilo.gitlab.io
Feed details
Source URL or path https://malsilo.gitlab.io/feeds/dumps/domain_list.txtInput transport network
Enabled in source metadata No
CSV
malsilo.ipv4 MalSilo
Open feed malsilo.gitlab.io
Feed details
Source URL or path https://malsilo.gitlab.io/feeds/dumps/ip_list.txtInput transport network
Enabled in source metadata No
CSV
malsilo.url MalSilo
Open feed malsilo.gitlab.io
Feed details
Source URL or path https://malsilo.gitlab.io/feeds/dumps/url_list.txtInput transport network
Enabled in source metadata No
CSV
Malware Bazaar abuse.ch
Open feed bazaar.abuse.ch
Feed details
Source URL or path https://bazaar.abuse.ch/export/txt/md5/recent/Input transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
MISP
MalwareBazaar abuse.ch
Open feed bazaar.abuse.ch
Feed details
Source URL or path https://bazaar.abuse.ch/downloads/misp/Input transport network
Enabled in source metadata No
CSV
Metasploit exploits with CVE assigned eCrimeLabs
Open feed feeds.ecrimelabs.net
Feed details
Source URL or path https://feeds.ecrimelabs.net/data/metasploit-cveInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
NOCACTI: Adversary Infrastructure Feed NOCACTI
Open feed misp-feed.nocacti.com
Feed details
Source URL or path https://misp-feed.nocacti.com/AdversaryInfrastructure/Input transport network
Enabled in source metadata Yes
MISP
NOCACTI: Intrusion Feed NOCACTI
Open feed misp-feed.nocacti.com
Feed details
Source URL or path https://misp-feed.nocacti.com/Intrusion/Input transport network
Enabled in source metadata Yes
FREETEXT
OpenPhish url list openphish.com
Open feed raw.githubusercontent.com
Feed details
Source URL or path https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
CSV
Panels Tracker Benkow.cc
Open feed benkow.cc
Feed details
Source URL or path https://benkow.cc/export.phpInput transport network
Enabled in source metadata No
CSV
Phishing.Database - New domains of today Phishing.Database
Open feed phish.co.za
Feed details
Source URL or path https://phish.co.za/latest/phishing-domains-NEW-today.txtInput transport network
Enabled in source metadata Yes
CSV
Phishing.Database - New IPs of today Phishing.Database
Open feed phish.co.za
Feed details
Source URL or path https://phish.co.za/latest/phishing-IPs-NEW-today.txtInput transport network
Enabled in source metadata Yes
CSV
Phishing.Database - New URLs of today Phishing.Database
Open feed phish.co.za
Feed details
Source URL or path https://phish.co.za/latest/phishing-links-NEW-today.txtInput transport network
Enabled in source metadata Yes
CSV
PhishScore PhishStats
Open feed phishstats.info
Feed details
Source URL or path https://phishstats.info/phish_score.csvInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Phishtank online valid phishing Phishtank
Open feed data.phishtank.com
Feed details
Source URL or path https://data.phishtank.com/data/online-valid.csvInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
phishunt.io active phishing URLs phishunt.io
Open feed phishunt.io
Feed details
Source URL or path https://phishunt.io/feed.txtInput transport network
Enabled in source metadata No
CSV
pop3gropers home.nuug.no
Open feed home.nuug.no
Feed details
Source URL or path https://home.nuug.no/~peter/pop3gropers.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
PrecisionSec OSINT Threat Intelligence precisionsec.com
Open feed misp-osint.precisionsec.com
Feed details
Source URL or path https://misp-osint.precisionsec.com/Input transport network
Enabled in source metadata Yes
MISP
Rectifyq - Curated Enriched MISP Threat Information for 2024 rectifyq.com
Open feed feeds.rectifyq.com
Feed details
Source URL or path https://feeds.rectifyq.com/MISP2024/Input transport network
Enabled in source metadata Yes
MISP
Rectifyq - Curated Enriched MISP Threat Information for 2025 rectifyq.com
Open feed feeds.rectifyq.com
Feed details
Source URL or path https://feeds.rectifyq.com/MISP2025/Input transport network
Enabled in source metadata Yes
MISP
Rectifyq - Curated Enriched MISP Threat Information for 2026 rectifyq.com
Open feed feeds.rectifyq.com
Feed details
Source URL or path https://feeds.rectifyq.com/MISP2026/Input transport network
Enabled in source metadata Yes
MISP
Rectifyq - Curated Enriched MISP Threat Information for ICS-OT rectifyq.com
Open feed feeds.rectifyq.com
Feed details
Source URL or path https://feeds.rectifyq.com/MISP-ICS-OT/Input transport network
Enabled in source metadata Yes
MISP
Rectifyq - Curated Enriched MISP Threat Information relevant for Malaysian Context rectifyq.com
Open feed feeds.rectifyq.com
Feed details
Source URL or path https://feeds.rectifyq.com/MISP-MY/Input transport network
Enabled in source metadata Yes
MISP
Rösti - Repackaged Öpen Source Threat Intelligence bin.re
Open feed misp.rosti.dev
Feed details
Source URL or path https://misp.rosti.devInput transport network
Enabled in source metadata Yes
FREETEXT
SERPRO: Reputation IP Feed SERPRO
Open feed s3.i02.estaleiro.serpro.gov.br
Feed details
Source URL or path https://s3.i02.estaleiro.serpro.gov.br/blocklist/blocklist.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Shreshta: Newly Registered domain names (NRD) - 1 month (Community policy feed) shreshtait.com
Open feed shreshtait.com
Feed details
Source URL or path https://shreshtait.com/newly-registered-domains/nrd-1mInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Shreshta: Newly Registered domain names(NRD) - 1 week (Community policy feed) shreshtait.com
Open feed shreshtait.com
Feed details
Source URL or path https://shreshtait.com/newly-registered-domains/nrd-1wInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
SiberKapan siberkapan.org
Open feed siberkapan.org
Feed details
Source URL or path https://siberkapan.org/misp-feed/Input transport network
Enabled in source metadata No
CSV
sipinvitation dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/sipinvitation.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
sipquery dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/sipquery.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
sipregistration dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/sipregistration.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
SMTP data dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/smtpdata.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
SMTP greet dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/smtpgreet.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
SSH Bruteforce IPs APNIC Community Honeynet Project
Open feed feeds.honeynet.asia
Feed details
Source URL or path https://feeds.honeynet.asia/bruteforce/latest-sshbruteforce-unique.csvInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
CSV
sshpwauth.txt dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/sshpwauth.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Telnet Bruteforce IPs APNIC Community Honeynet Project
Open feed feeds.honeynet.asia
Feed details
Source URL or path https://feeds.honeynet.asia/bruteforce/latest-telnetbruteforce-unique.csvInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
CSV
TELNET login dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/telnetlogin.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
The Botvrij.eu Data Botvrij.eu
Open feed www.botvrij.eu
Feed details
Source URL or path https://www.botvrij.eu/data/feed-osintInput transport network
Enabled in source metadata Yes
FREETEXT
This list contains all browser mining domains - A list to prevent browser mining only ZeroDot1 - CoinBlockerLists
Open feed gitlab.com
Feed details
Source URL or path https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_browser.txt?inline=falseInput transport network
Enabled in source metadata Yes
FREETEXT
This list contains all domains - A list for administrators to prevent mining in networks ZeroDot1 - CoinBlockerLists
Open feed gitlab.com
Feed details
Source URL or path https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list.txt?inline=falseInput transport network
Enabled in source metadata Yes
FREETEXT
This list contains all optional domains - An additional list for administrators ZeroDot1 - CoinBlockerLists
Open feed gitlab.com
Feed details
Source URL or path https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_optional.txt?inline=falseInput transport network
Enabled in source metadata Yes
FREETEXT
Threatbase (Domain feed) threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
Source URL or path https://threatbase.qzz.io/ioc/misp/threatbase-domain.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatbase (File hash feed) threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
Source URL or path https://threatbase.qzz.io/ioc/misp/threatbase-hash.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatbase (IP feed) threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
Source URL or path https://threatbase.qzz.io/ioc/misp/threatbase-ip.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatbase (URL feed) threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
Source URL or path https://threatbase.qzz.io/ioc/misp/threatbase-url.txtInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
MISP
Threatfox abuse.ch
Open feed threatfox.abuse.ch
Feed details
Source URL or path https://threatfox.abuse.ch/downloads/misp/Input transport network
Enabled in source metadata Yes
CSV
threatfox indicators of compromise abuse.ch
Open feed threatfox.abuse.ch
Feed details
Source URL or path https://threatfox.abuse.ch/export/csv/recent/Input transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - Bitcoin Address Intel threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/MALICIOUS-BITCOIN_FEED.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Threatview.io - C2 Hunt Feed threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - Domain Blocklist threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - IP Blocklist threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/IP-High-Confidence-Feed.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - MD5 Hash Blocklist threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/MD5-HASH-ALL.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - OSINT Threat Feed threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/Experimental-IOC-Tweets.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - SHA File Hash Blocklist threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/SHA-HASH-FEED.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
Threatview.io - URL Blocklist threatview.io
Open feed threatview.io
Feed details
Source URL or path https://threatview.io/Downloads/URL-High-Confidence-Feed.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Tor ALL nodes TOR Node List from dan.me.uk - careful, this feed applies a lock-out after each pull. This is shared with the "Tor exit nodes" feed.
Open feed www.dan.me.uk
Feed details
Source URL or path https://www.dan.me.uk/torlist/Input transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
Tor exit nodes TOR Node List from dan.me.uk - careful, this feed applies a lock-out after each pull. This is shared with the "Tor ALL nodes" feed.
Open feed www.dan.me.uk
Feed details
Source URL or path https://www.dan.me.uk/torlist/?exitInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
MISP
TweetFeed tweetfeed.live
Open feed tweetfeed.live
Feed details
Source URL or path https://tweetfeed.live/mispInput transport network
Enabled in source metadata No
FREETEXT
URL Seen in honeypots APNIC Community Honeynet Project
Open feed feeds.honeynet.asia
Feed details
Source URL or path https://feeds.honeynet.asia/url/latest-url-unique.csvInput transport network
Enabled in source metadata No Tags osint:source-type="block-or-filter-list"
MISP
URLhaus abuse.ch
Open feed urlhaus.abuse.ch
Feed details
Source URL or path https://urlhaus.abuse.ch/downloads/misp/Input transport network
Enabled in source metadata No
CSV
URLHaus Malware URLs abuse.ch
Open feed urlhaus.abuse.ch
Feed details
Source URL or path https://urlhaus.abuse.ch/downloads/csv_recent/Input transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
CSV
VNC RFB dataplane.org
Open feed dataplane.org
Feed details
Source URL or path https://dataplane.org/vncrfb.txtInput transport network
Enabled in source metadata Yes Tags osint:source-type="block-or-filter-list"
FREETEXT
VXvault - URL List VXvault
Open feed vxvault.net
Feed details
Source URL or path http://vxvault.net/URL_List.phpInput transport network
Enabled in source metadata Yes
No matching feeds. Try a different search or reset the filters.
This catalogue lists source metadata, including disabled entries. It does not check feed availability. Providers may require a licence, authentication or impose rate limits.
Using feeds in your MISP instance
Cache for correlation: turn on Caching enabled for your selected feeds, then run a cache action from the Feeds screen. Caching prepares indicator lookups without creating local events.Share lookups: enable Lookup visible so other users on your instance can see feed correlations.Import when needed: enable the feed and use a fetch action to store its data locally.
See the feed management guide for configuration steps and the site administrator permissions required to manage feeds.
Feed overlap analysis matrix
How to have my feed published in the default MISP OSINT feed
