Open-source intelligence
More context for your investigations
MISP's default feeds bring together public indicators and threat intelligence from community providers. Use them to investigate matches in your events and attributes, discover related activity, and compare coverage across sources.
Cache & correlate
Check your existing attributes against feed indicators without creating local events.
Fetch & import
Bring selected feed content into your MISP instance for further analysis.
Three supported feed formats
Read from a network URL or a local file.
STRUCTURED EVENTS
MISP format
The native format for sharing complete events, with attributes and their context.
TABULAR DATA
CSV
Select the columns to parse and import from a table of indicators.
UNSTRUCTURED TEXT
Free text
Let MISP detect supported indicator types in an unstructured text source.
MISP · Community intelligence
Explore the default feeds
Find public threat intelligence sources for correlation and import in MISP. Browse by provider, search for a topic, or choose a feed format.
108 feeds52 providers47 CSV43 FREETEXT18 MISP
abuse.ch SSL IPBL
abuse.ch
Open feed sslbl.abuse.ch
Feed details
- Source URL or path
https://sslbl.abuse.ch/blacklist/sslblacklist.csv- Input transport
- network
- Enabled in source metadata
- Yes
alienvault reputation generic
.alienvault.com
Open feed reputation.alienvault.com
Feed details
- Source URL or path
https://reputation.alienvault.com/reputation.generic- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
All current domains belonging to known malicious DGAs
osint.bambenekconsulting.com
Open feed osint.bambenekconsulting.com
Feed details
- Source URL or path
https://osint.bambenekconsulting.com/feeds/dga-feed-high.csv- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
blocklist.de/lists/all.txt
blocklist.de
Open feed lists.blocklist.de
Feed details
- Source URL or path
https://lists.blocklist.de/lists/all.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
blocklist.greensnow.co
greensnow.co
Open feed blocklist.greensnow.co
Feed details
- Source URL or path
https://blocklist.greensnow.co/greensnow.txt- Input transport
- network
- Enabled in source metadata
- Yes
blockrules of rules.emergingthreats.net
rules.emergingthreats.net
Open feed rules.emergingthreats.net
Feed details
- Source URL or path
https://rules.emergingthreats.net/blockrules/compromised-ips.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
ci-badguys.txt
cinsscore.com
Open feed cinsscore.com
Feed details
- Source URL or path
https://cinsscore.com/list/ci-badguys.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
CIRCL OSINT Feed
CIRCL
Open feed www.circl.lu
Feed details
- Source URL or path
https://www.circl.lu/doc/misp/feed-osint- Input transport
- network
- Enabled in source metadata
- Yes
cybercrime-tracker.net - all
cybercrime-tracker.net
Open feed cybercrime-tracker.net
Feed details
- Source URL or path
https://cybercrime-tracker.net/all.php- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
CyberCure - Blocked URL Feed
www.cybercure.ai
Open feed api.cybercure.ai
Feed details
- Source URL or path
https://api.cybercure.ai/feed/get_url?type=csv- Input transport
- network
- Enabled in source metadata
- Yes
CyberCure - Hash Feed
www.cybercure.ai
Open feed api.cybercure.ai
Feed details
- Source URL or path
https://api.cybercure.ai/feed/get_hash?type=csv- Input transport
- network
- Enabled in source metadata
- No
CyberCure - IP Feed
www.cybercure.ai
Open feed api.cybercure.ai
Feed details
- Source URL or path
https://api.cybercure.ai/feed/get_ips?type=csv- Input transport
- network
- Enabled in source metadata
- No
diamondfox_panels
pan-unit42
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/pan-unit42/iocs/master/diamondfox/diamondfox_panels.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
DigitalSide Threat-Intel OSINT Feed
osint.digitalside.it
Open feed osint.digitalside.it
Feed details
- Source URL or path
https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/- Input transport
- network
- Enabled in source metadata
- No
DNS CH TXT version.bind
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/dnsversion.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
DNS recursion desired
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/dnsrd.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
DNS recursion desired IN ANY
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/dnsrdany.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Domains from High-Confidence DGA-based C&C Domains Actively Resolving
osint.bambenekconsulting.com
Open feed osint.bambenekconsulting.com
Feed details
- Source URL or path
https://osint.bambenekconsulting.com/feeds/c2-dommasterlist-high.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
ELLIO: IP Feed (Community version)
ellio.tech
Open feed cdn.ellio.tech
Feed details
- Source URL or path
https://cdn.ellio.tech/community-feed- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Feodo IP Blocklist
abuse.ch
Open feed feodotracker.abuse.ch
Feed details
- Source URL or path
https://feodotracker.abuse.ch/downloads/ipblocklist.csv- Input transport
- network
- Enabled in source metadata
- Yes
firehol_level1
iplists.firehol.org
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level1.netset- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
hideNseek LAB - CSV Threat Feed
hideNseek LAB
Open feed data.hidenseek.dev
Feed details
- Source URL or path
https://data.hidenseek.dev/download/cti/hns_cti.csv- Input transport
- network
- Enabled in source metadata
- No
hideNseek LAB - IP Blocklist
hideNseek LAB
Open feed data.hidenseek.dev
Feed details
- Source URL or path
https://data.hidenseek.dev/download/cti/hns_blocklist.txt- Input transport
- network
- Enabled in source metadata
- No
hideNseek LAB - Threat Intelligence JSON
hideNseek LAB
Open feed data.hidenseek.dev
Feed details
- Source URL or path
https://data.hidenseek.dev/download/cti/hns_cti.json- Input transport
- network
- Enabled in source metadata
- No
HoneyLabs active exploiters
HoneyLabs
Open feed honeylabs.net
Feed details
- Source URL or path
https://honeylabs.net/feed/exploiters- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
HoneyLabs malware infrastructure
HoneyLabs
Open feed honeylabs.net
Feed details
- Source URL or path
https://honeylabs.net/feed/malware-infrastructure- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
http://cybercrime-tracker.net gatelist
http://cybercrime-tracker.net gatelist
Open feed cybercrime-tracker.net
Feed details
- Source URL or path
https://cybercrime-tracker.net/ccamgate.php- Input transport
- network
- Enabled in source metadata
- Yes
http://cybercrime-tracker.net hashlist
http://cybercrime-tracker.net hashlist
Open feed cybercrime-tracker.net
Feed details
- Source URL or path
https://cybercrime-tracker.net/ccamlist.php- Input transport
- network
- Enabled in source metadata
- Yes
Infoblox-Threat-Intelligence
infoblox.com
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/infobloxopen/threat-intelligence/main/indicators/misp- Input transport
- network
- Enabled in source metadata
- Yes
IP protocol 41
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/proto41.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
ip-block-list - snort.org
https://snort.org
Open feed snort.org
Feed details
- Source URL or path
https://snort.org/downloads/ip-block-list- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
IPs from High-Confidence DGA-Based C&Cs Actively Resolving - requires a valid license
osint.bambenekconsulting.com
Open feed osint.bambenekconsulting.com
Feed details
- Source URL or path
https://osint.bambenekconsulting.com/feeds/c2-ipmasterlist-high.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
ipspamlist
ipspamlist
Open feed www.ipspamlist.com
Feed details
- Source URL or path
http://www.ipspamlist.com/public_feeds.csv- Input transport
- network
- Enabled in source metadata
- Yes
IPsum (aggregation of all feeds) - level 1 - lot of false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/1.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="automatic-collection"
IPsum (aggregation of all feeds) - level 2 - medium false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
IPsum (aggregation of all feeds) - level 3 - low false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
IPsum (aggregation of all feeds) - level 4 - very low false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
IPsum (aggregation of all feeds) - level 5 - ultra false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/5.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
IPsum (aggregation of all feeds) - level 6 - no false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/6.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
IPsum (aggregation of all feeds) - level 7 - no false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/7.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
IPsum (aggregation of all feeds) - level 8 - no false positives
IPsum
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/stamparm/ipsum/master/levels/8.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
James Brine Bruteforce IPs
jamesbrine.com.au
Open feed jamesbrine.com.au
Feed details
- Source URL or path
https://jamesbrine.com.au/csv- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
List of malicious domains in Poland
CERT-PL
Open feed hole.cert.pl
Feed details
- Source URL or path
https://hole.cert.pl/domains/domains.txt- Input transport
- network
- Enabled in source metadata
- Yes
List of malicious hashes
Banco do Brasil S.A
Open feed cti.bb.com.br
Feed details
- Source URL or path
https://cti.bb.com.br:8443/hash-list.csv- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
malshare.com - current all
malshare.com
Open feed malshare.com
Feed details
- Source URL or path
https://malshare.com/daily/malshare.current.all.txt- Input transport
- network
- Enabled in source metadata
- No
malsilo.domain
MalSilo
Open feed malsilo.gitlab.io
Feed details
- Source URL or path
https://malsilo.gitlab.io/feeds/dumps/domain_list.txt- Input transport
- network
- Enabled in source metadata
- No
malsilo.ipv4
MalSilo
Open feed malsilo.gitlab.io
Feed details
- Source URL or path
https://malsilo.gitlab.io/feeds/dumps/ip_list.txt- Input transport
- network
- Enabled in source metadata
- No
malsilo.url
MalSilo
Open feed malsilo.gitlab.io
Feed details
- Source URL or path
https://malsilo.gitlab.io/feeds/dumps/url_list.txt- Input transport
- network
- Enabled in source metadata
- No
Malware Bazaar
abuse.ch
Open feed bazaar.abuse.ch
Feed details
- Source URL or path
https://bazaar.abuse.ch/export/txt/md5/recent/- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
MalwareBazaar
abuse.ch
Open feed bazaar.abuse.ch
Feed details
- Source URL or path
https://bazaar.abuse.ch/downloads/misp/- Input transport
- network
- Enabled in source metadata
- No
Metasploit exploits with CVE assigned
eCrimeLabs
Open feed feeds.ecrimelabs.net
Feed details
- Source URL or path
https://feeds.ecrimelabs.net/data/metasploit-cve- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
NOCACTI: Adversary Infrastructure Feed
NOCACTI
Open feed misp-feed.nocacti.com
Feed details
- Source URL or path
https://misp-feed.nocacti.com/AdversaryInfrastructure/- Input transport
- network
- Enabled in source metadata
- Yes
NOCACTI: Intrusion Feed
NOCACTI
Open feed misp-feed.nocacti.com
Feed details
- Source URL or path
https://misp-feed.nocacti.com/Intrusion/- Input transport
- network
- Enabled in source metadata
- Yes
OpenPhish url list
openphish.com
Open feed raw.githubusercontent.com
Feed details
- Source URL or path
https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
Panels Tracker
Benkow.cc
Open feed benkow.cc
Feed details
- Source URL or path
https://benkow.cc/export.php- Input transport
- network
- Enabled in source metadata
- No
Phishing.Database - New domains of today
Phishing.Database
Open feed phish.co.za
Feed details
- Source URL or path
https://phish.co.za/latest/phishing-domains-NEW-today.txt- Input transport
- network
- Enabled in source metadata
- Yes
Phishing.Database - New IPs of today
Phishing.Database
Open feed phish.co.za
Feed details
- Source URL or path
https://phish.co.za/latest/phishing-IPs-NEW-today.txt- Input transport
- network
- Enabled in source metadata
- Yes
Phishing.Database - New URLs of today
Phishing.Database
Open feed phish.co.za
Feed details
- Source URL or path
https://phish.co.za/latest/phishing-links-NEW-today.txt- Input transport
- network
- Enabled in source metadata
- Yes
PhishScore
PhishStats
Open feed phishstats.info
Feed details
- Source URL or path
https://phishstats.info/phish_score.csv- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Phishtank online valid phishing
Phishtank
Open feed data.phishtank.com
Feed details
- Source URL or path
https://data.phishtank.com/data/online-valid.csv- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
phishunt.io active phishing URLs
phishunt.io
Open feed phishunt.io
Feed details
- Source URL or path
https://phishunt.io/feed.txt- Input transport
- network
- Enabled in source metadata
- No
pop3gropers
home.nuug.no
Open feed home.nuug.no
Feed details
- Source URL or path
https://home.nuug.no/~peter/pop3gropers.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
PrecisionSec OSINT Threat Intelligence
precisionsec.com
Open feed misp-osint.precisionsec.com
Feed details
- Source URL or path
https://misp-osint.precisionsec.com/- Input transport
- network
- Enabled in source metadata
- Yes
Rectifyq - Curated Enriched MISP Threat Information for 2024
rectifyq.com
Open feed feeds.rectifyq.com
Feed details
- Source URL or path
https://feeds.rectifyq.com/MISP2024/- Input transport
- network
- Enabled in source metadata
- Yes
Rectifyq - Curated Enriched MISP Threat Information for 2025
rectifyq.com
Open feed feeds.rectifyq.com
Feed details
- Source URL or path
https://feeds.rectifyq.com/MISP2025/- Input transport
- network
- Enabled in source metadata
- Yes
Rectifyq - Curated Enriched MISP Threat Information for 2026
rectifyq.com
Open feed feeds.rectifyq.com
Feed details
- Source URL or path
https://feeds.rectifyq.com/MISP2026/- Input transport
- network
- Enabled in source metadata
- Yes
Rectifyq - Curated Enriched MISP Threat Information for ICS-OT
rectifyq.com
Open feed feeds.rectifyq.com
Feed details
- Source URL or path
https://feeds.rectifyq.com/MISP-ICS-OT/- Input transport
- network
- Enabled in source metadata
- Yes
Rectifyq - Curated Enriched MISP Threat Information relevant for Malaysian Context
rectifyq.com
Open feed feeds.rectifyq.com
Feed details
- Source URL or path
https://feeds.rectifyq.com/MISP-MY/- Input transport
- network
- Enabled in source metadata
- Yes
Rösti - Repackaged Öpen Source Threat Intelligence
bin.re
Open feed misp.rosti.dev
Feed details
- Source URL or path
https://misp.rosti.dev- Input transport
- network
- Enabled in source metadata
- Yes
SERPRO: Reputation IP Feed
SERPRO
Open feed s3.i02.estaleiro.serpro.gov.br
Feed details
- Source URL or path
https://s3.i02.estaleiro.serpro.gov.br/blocklist/blocklist.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Shreshta: Newly Registered domain names (NRD) - 1 month (Community policy feed)
shreshtait.com
Open feed shreshtait.com
Feed details
- Source URL or path
https://shreshtait.com/newly-registered-domains/nrd-1m- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Shreshta: Newly Registered domain names(NRD) - 1 week (Community policy feed)
shreshtait.com
Open feed shreshtait.com
Feed details
- Source URL or path
https://shreshtait.com/newly-registered-domains/nrd-1w- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
SiberKapan
siberkapan.org
Open feed siberkapan.org
Feed details
- Source URL or path
https://siberkapan.org/misp-feed/- Input transport
- network
- Enabled in source metadata
- No
sipinvitation
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/sipinvitation.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
sipquery
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/sipquery.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
sipregistration
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/sipregistration.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
SMTP data
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/smtpdata.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
SMTP greet
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/smtpgreet.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
SSH Bruteforce IPs
APNIC Community Honeynet Project
Open feed feeds.honeynet.asia
Feed details
- Source URL or path
https://feeds.honeynet.asia/bruteforce/latest-sshbruteforce-unique.csv- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
sshpwauth.txt
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/sshpwauth.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Telnet Bruteforce IPs
APNIC Community Honeynet Project
Open feed feeds.honeynet.asia
Feed details
- Source URL or path
https://feeds.honeynet.asia/bruteforce/latest-telnetbruteforce-unique.csv- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
TELNET login
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/telnetlogin.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
The Botvrij.eu Data
Botvrij.eu
Open feed www.botvrij.eu
Feed details
- Source URL or path
https://www.botvrij.eu/data/feed-osint- Input transport
- network
- Enabled in source metadata
- Yes
This list contains all browser mining domains - A list to prevent browser mining only
ZeroDot1 - CoinBlockerLists
Open feed gitlab.com
Feed details
- Source URL or path
https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_browser.txt?inline=false- Input transport
- network
- Enabled in source metadata
- Yes
This list contains all domains - A list for administrators to prevent mining in networks
ZeroDot1 - CoinBlockerLists
Open feed gitlab.com
Feed details
- Source URL or path
https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list.txt?inline=false- Input transport
- network
- Enabled in source metadata
- Yes
This list contains all optional domains - An additional list for administrators
ZeroDot1 - CoinBlockerLists
Open feed gitlab.com
Feed details
- Source URL or path
https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_optional.txt?inline=false- Input transport
- network
- Enabled in source metadata
- Yes
Threatbase (Domain feed)
threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
- Source URL or path
https://threatbase.qzz.io/ioc/misp/threatbase-domain.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
Threatbase (File hash feed)
threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
- Source URL or path
https://threatbase.qzz.io/ioc/misp/threatbase-hash.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
Threatbase (IP feed)
threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
- Source URL or path
https://threatbase.qzz.io/ioc/misp/threatbase-ip.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
Threatbase (URL feed)
threatbase.qzz.io
Open feed threatbase.qzz.io
Feed details
- Source URL or path
https://threatbase.qzz.io/ioc/misp/threatbase-url.txt- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
Threatfox
abuse.ch
Open feed threatfox.abuse.ch
Feed details
- Source URL or path
https://threatfox.abuse.ch/downloads/misp/- Input transport
- network
- Enabled in source metadata
- Yes
threatfox indicators of compromise
abuse.ch
Open feed threatfox.abuse.ch
Feed details
- Source URL or path
https://threatfox.abuse.ch/export/csv/recent/- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - Bitcoin Address Intel
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/MALICIOUS-BITCOIN_FEED.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - C2 Hunt Feed
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - Domain Blocklist
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - IP Blocklist
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/IP-High-Confidence-Feed.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - MD5 Hash Blocklist
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/MD5-HASH-ALL.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - OSINT Threat Feed
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/Experimental-IOC-Tweets.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - SHA File Hash Blocklist
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/SHA-HASH-FEED.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Threatview.io - URL Blocklist
threatview.io
Open feed threatview.io
Feed details
- Source URL or path
https://threatview.io/Downloads/URL-High-Confidence-Feed.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Tor ALL nodes
TOR Node List from dan.me.uk - careful, this feed applies a lock-out after each pull. This is shared with the "Tor exit nodes" feed.
Open feed www.dan.me.uk
Feed details
- Source URL or path
https://www.dan.me.uk/torlist/- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
Tor exit nodes
TOR Node List from dan.me.uk - careful, this feed applies a lock-out after each pull. This is shared with the "Tor ALL nodes" feed.
Open feed www.dan.me.uk
Feed details
- Source URL or path
https://www.dan.me.uk/torlist/?exit- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
TweetFeed
tweetfeed.live
Open feed tweetfeed.live
Feed details
- Source URL or path
https://tweetfeed.live/misp- Input transport
- network
- Enabled in source metadata
- No
URL Seen in honeypots
APNIC Community Honeynet Project
Open feed feeds.honeynet.asia
Feed details
- Source URL or path
https://feeds.honeynet.asia/url/latest-url-unique.csv- Input transport
- network
- Enabled in source metadata
- No
- Tags
- osint:source-type="block-or-filter-list"
URLhaus
abuse.ch
Open feed urlhaus.abuse.ch
Feed details
- Source URL or path
https://urlhaus.abuse.ch/downloads/misp/- Input transport
- network
- Enabled in source metadata
- No
URLHaus Malware URLs
abuse.ch
Open feed urlhaus.abuse.ch
Feed details
- Source URL or path
https://urlhaus.abuse.ch/downloads/csv_recent/- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
VNC RFB
dataplane.org
Open feed dataplane.org
Feed details
- Source URL or path
https://dataplane.org/vncrfb.txt- Input transport
- network
- Enabled in source metadata
- Yes
- Tags
- osint:source-type="block-or-filter-list"
VXvault - URL List
VXvault
Open feed vxvault.net
Feed details
- Source URL or path
http://vxvault.net/URL_List.php- Input transport
- network
- Enabled in source metadata
- Yes
No matching feeds. Try a different search or reset the filters.
This catalogue lists source metadata, including disabled entries. It does not check feed availability. Providers may require a licence, authentication or impose rate limits.
Using feeds in your MISP instance
- Cache for correlation: turn on Caching enabled for your selected feeds, then run a cache action from the Feeds screen. Caching prepares indicator lookups without creating local events.
- Share lookups: enable Lookup visible so other users on your instance can see feed correlations.
- Import when needed: enable the feed and use a fetch action to store its data locally.
See the feed management guide for configuration steps and the site administrator permissions required to manage feeds.
Feed overlap analysis matrix
How to have my feed published in the default MISP OSINT feed
- Fork the MISP project on GitHub.
- Update the default MISP feed to add your feed(s).
- Make a pull-request with the updated JSON file.