Feeds
Web portal, API and downloads for machine-consumable intelligence deliver detection and triage workflows you can use operationally.
Feed Catalog
Indicators of Compromise (IOCs)
APT / sophisticated FIN / crimeware / hacktivism hostnames/domains/IPs
IP intelligence for anonymization services (TOR, 20+ VPNs, proxies)
Infra mapping for CDNs, domain parking, suspected attacker infra (SSL, fingerprinting)
Passive DNS
Continuously updated pDNS
High-performance API
Multiple streams + filters
Robust API documentation
YARA Rules + YARA Quality Lab
- 5+ new rules/week
- deep-tested on clean sets
- YARA 3.2+ and YARA-X 0.5.0+
IP Risk / Reputation Feed
Daily-computed risk for IP ranges
43k+ ranges
AI-weighted by recency/continuity
Real-time API endpoint for domains
C2 Monitor
C2 availability tracking
Includes common tooling such as Cobalt Strike
Honeypot Samples
- Live sample stream
- Attacker IPs/protocols
Web Crawler Samples (Blackthorne)
Live stream from malware spreading servers
Re-crawls at scale
Country C2 Infrastructure (Nightfall)
View of malicious infra per country with hosting details such as ASN
Supports country-level blocking and abuse investigations
Integration
We Support What You Need
Onboarding checklist
- Short intake: your tools + your priorities
- Choose bundle/module + define success criteria
- Integrate and validate with a small test window
- Review results and tune
Want help integrating?
Book a short call and we’ll tell you exactly what’s required.